Yanting Wang, Chenlong Yin, Runpeng Geng, Jinyuan Jia
4 min
Abstract
Prompt injection poses significant security risks to LLM agents. Efficient and effective red-teaming is therefore critical, both for evaluating these risks and for collecting training data to improve defenses. Existing state-of-the-art prompt injection red-teaming methods primarily rely on reinforcement learning (RL), producing attacker models that often generalize poorly to new target LLMs. In this work, we develop PIMiner, an agentic system for prompt injection red-teaming. During training, PIMiner is trained on a sequence of (dataset, target model) pairs and builds a strategy library from scratch. At test time, the learned strategy library can be directly transferred to a previously unseen target LLM without additional training. PIMiner requires only a small number of queries to a target agent (e.g., 10) per test sample. Experimental results demonstrate that PIMiner achieves strong performance. On IPIArena, it attains a 76.2% ASR against Gemini-2.5-Pro, 61.9% ASR against GPT-5.1, and 42.9% ASR against Claude-Sonnet-4.5. On AgentDojo, it achieves an 86.7% ASR against Gemini-2.5-Pro, 53.3% ASR against GPT-5.1, and 40.0% ASR against Claude-Sonnet-4.5.
Sam: So grey-box is like having a transcript of the suspect's thoughts, while black-box is just their final statement?
Alex: That's a good way to put it. Those intermediate steps make it much easier to diagnose exactly where an attack broke down—and that diagnosis feeds directly back into the library.
Sam: It's really about building a collective memory for the security community. Instead of every engineer hitting the same wall, they just read the failure notes from the last person who tried.
Alex: That's the core of it. And it has a practical cost advantage too. Traditional reinforcement learning requires enormous compute budgets to train an attacker model. Because PIMiner treats testing as a search problem—not a training problem—the costs stay manageable. The paper also notes it uses something called prompt caching, which means it stores the parts of the strategy library that don't change between tests, so it isn't paying to re-process the same information over and over.
Sam: So the initial investment is in building the library, but every new test makes future tests cheaper?
Alex: Exactly. You're not just paying for one test—you're building a reusable asset. And because the library is transferable across different models, the same strategies that worked against one AI can be applied, with adjustments, to the next one.
Sam: So the key insight is really about transferability. The knowledge isn't locked to one specific model—it travels.
Alex: That's the main takeaway. The paper reports meaningful success rates against major commercial models, achieved with relatively few queries per test. The research suggests that by treating attack history as a structured, reusable asset, security testing becomes far more practical—without requiring massive compute budgets.
Sam: It's a shift from asking "how do we build a smarter attacker?" to "how do we make sure we never forget what we've already learned?"
Alex: That's a precise way to frame it. And it points toward something important for AI safety more broadly—that systematic, memory-based approaches may prove more durable than methods that start from scratch each time. Thanks for listening to ResearchPod.