PaperlayerView exact revision on arXiv

Source-linked AI summary

Measuring LLM Agent Defenses by Layer: GDA Measurement and an Envelope-Layer Attack-Defense Model

Yuelin Han

arXiv:2610.00392v2cs.CR

TL;DR

ASR cannot distinguish an LLM recognition failure from an agent-layer block, complicating defense-layer evaluation. The paper introduces GDA Measurement, uses A2A-TIBA to generate validation cases, and proposes ELA-ITL; channel-label ablations report improved recognition of malicious content.

  • Problem

    ASR does not distinguish an LLM recognizing malicious content from an agent layer intercepting execution, so it cannot indicate which layer to strengthen.

    Source: §1 · p. 1

  • Method

    The paper combines gateway-side context capture and four-class judging in GDA Measurement with an A2A-TIBA validation corpus and an experimentally induced three-layer ELA-ITL model.

    Source: §1 · p. 2, §5.4 · p. 12, §6.1 · p. 12

  • Results

    Adding malicious-prompt labels raised semantic refusal to 100% for MCP tool context and restored it to 100% for memory, while A2A label neutralization raised skill07-a penetration to 60%.

    Source: §5.4 · p. 11

  • Takeaways & Limitations

    The ablations support treating channel-level annotation of untrusted content as an envelope-layer defense surface across A2A, tool, and memory channels.

    Source: §5.4 · p. 11, §6.1 · p. 12

    Evaluation covered only three agent containers and five proprietary LLMs, not real-world scenarios, and used untiered A2A inbound access.

    Source: LIMITATIONS · p. 15

Abstract

from arXiv · show

Agent interaction protocols such as ACP and A2A let a remote peer deliver a task the receiving agent treats as legitimate, opening a channel for indirect prompt injection. Evaluating and defending such agents is difficult because the attack success rate (ASR) cannot distinguish an LLM recognition failure from an agent-layer block, and so cannot indicate which layer to strengthen. We contribute three artifacts. (1) GDA Measurement, a red-team method that captures the raw agent-LLM context at the gateway, preserves conversation and raw-capture data, and judges outcomes autonomously with an agent selected by an inter-annotator-agreement (IAA) study over six candidates; its four classes, A/B/C/D, replace ASR with the semantic refusal, semantic breach, interception and penetration rates - a layer-resolved view of defense. (2) A2A-TIBA, an implant-command-exfiltration principle on A2A that generates this method's validation corpus, designed to spread outcomes across the four classes rather than to maximize the success rate. (3) ELA-ITL, a three-layer isomorphic attack-defense model induced from that corpus, which identifies the envelope layer - the channel through which content enters an agent - as a defense surface; ablating the A2A, tool and memory channels shows that annotating untrusted content markedly improves recognition of malicious content.

1 INTRODUCTION

A2A lets remote peers deliver tasks that receivers treat as legitimate, creating a channel for indirect prompt injection; ASR cannot show whether an LLM or agent-layer defense stopped an attack. The paper introduces GDA Measurement, A2A-TIBA as its validation-corpus generator, and ELA-ITL as a three-layer attack–defense model.

1 INTRODUCTION

  • A2A remote-peer requests are treated as legitimate by the receiving agent, and the protocol provides a natural channel for indirect prompt injection.Prior A2A analysis showed contextual privilege escalation through legitimate means [5].Source: §1 · p. 1
  • ASR cannot distinguish LLM recognition from agent-layer interception, leaving defenders unable to tell which defense layer to strengthen.Action-graded severity measures how severe a successful attack is, but does not identify the layer responsible for an outcome.Source: §1 · p. 1
  • GDA Measurement captures raw context at an LLM gateway, preserves conversation and capture data, and uses an IAA-selected agent judge to classify outcomes.Its A/B/C/D classes yield semantic refusal, semantic breach, interception, and penetration rates in place of ASR.Source: §1 · pp. 1–2
  • A2A-TIBA chains implant, command, and exfiltration; it generates a validation corpus designed to spread outcomes across four classes, not maximize attack success.The evaluation uses 15 agent front-end × LLM back-end combinations and a 1,000-case corpus.Source: §1 · p. 2
  • ELA-ITL, induced from experiments, divides defense into envelope packaging, LLM recognition, and agent interception, with corresponding attack dimensions.The paper reports that hermes has a higher semantic refusal rate than claude code and openclaw under the same baseline, motivating channel-annotation ablations.Source: §1 · p. 2

2 RELATED WORK

Prior work studies agent-security benchmarks, A2A attacks, and LLM- or agent-layer defenses, while this paper organizes measurement around defense-layer attribution and treats channel-level content entry as a defense surface.

2.1 Agent Security Evaluation

  • Existing agent-security benchmarks cover varied attacks, defenses, tools, and authorization scenarios, while GDA Measurement separates LLM recognition outcomes from agent interception.Beyond ASR [8] grades successful attacks by severity; GDA Measurement instead partitions outcomes by the defense layer responsible.Source: §2.1 · p. 2

2.2 Attack Principle

  • A2A protocol analyses identify trust-model weaknesses, while A2A-TIBA chains indirect injection with bypass so later command and exfiltration steps no longer depend on the agent after implantation.Related attacks also exploit tool, memory, and context-reassembly channels to bring content into an agent’s context.Source: §2.2 · pp. 2–3

2.3 Attack–Defense Model

  • Existing defenses act at the LLM-representation or agent-execution layers, leaving channel-level policy for content entering context as an unaddressed surface.ELA-ITL treats that envelope layer as a defense surface; prior channel-specific policies include A2A admission control, memory-entry screening, and trusted metadata envelopes.Source: §2.3 · p. 3
  • The paper’s ablations test context labels as a channel-specific envelope defense, unlike Spotlighting’s uniform per-message transformation inside the LLM layer.The label attaches provenance and trust information to a channel before its content reaches the model.Source: §2.3 · p. 3

3 EVALUATION METHOD

GDA Measurement captures the agent–LLM interaction and preserves evidence to distinguish LLM-level decisions from agent-layer defenses. It classifies outcomes and uses an independently checked agent judge, while stating limits on what its capture and outcome-based classes can establish.

3.1 Raw Context Capture Architecture Based on an LLM Gateway

  • The gateway captures requests and responses assembled by the agent, providing evidence below both the agent and the attacker that the agent cannot suppress or rewrite.The capture program stores raw context verbatim, including wrappers and provenance labels.Source: §3.1 · pp. 3–4

3.2 The Four Class A/B/C/D Judgment Metrics

  • The four classes distinguish refusal, partial execution, agent-layer interception, and successful penetration, with derived rates for semantic refusal, semantic breach, interception, and penetration.Penetration is equivalent to ASR; the classes decompose outcomes by the layer that decided them.Source: §3.2 · p. 4
  • Class assignment follows actual execution outcomes, including cases where the LLM recognizes malicious intent but executes it or retries after interception.The classes describe outcomes rather than inferred intent.Source: §3.2 · p. 4

3.3 Dual Data Preservation and Agent-based Autonomous Judging

  • Dual preservation stores attack conversation content as an index of the attack chain and raw gateway context as the primary evidence for judging outcomes.Conversation storage depends on attack mode: it is on the attacker’s side for direct interaction and the target agent’s side for publish-and-invoke attacks.Source: §3.3 · p. 5

3.4 Selection of the Judging Agent: The IAA Method

  • The judge is selected through two-round human–agent IAA comparisons, ranking candidates by mean four-class κ and breaking ties by binary accuracy on Classes A and D.The study samples 10% of results for each skill, agent front end, and back-end LLM combination.Source: §3.4 · p. 5

3.5 Threats to Validity of the Measurement

  • Validity is bounded because classes reflect observable execution rather than intent, the agent judge may drift, and gateway capture sees only agent–LLM traffic.Two independent judgments, human fallback on disagreement or abstention, and IAA against a human baseline bound judgment error; actions without a model call are visible only indirectly.Source: §3.5 · p. 6

4 THE A2A-TIBA ATTACK

A2A-TIBA combines indirect prompt injection with bypass to generate the measurement method’s validation corpus. It assumes an authenticated peer can deliver tasks but cannot directly execute commands, access target files, or invoke target tools.

4.1.1 Core Assumptions

  • The attacker is assumed to authenticate to the A2A endpoint and deliver tasks, but lacks the target prompt, internal policy, back-end parameters, host-file access, command execution, and tool invocation.The inbound credential permits writing arbitrary content into the agent’s context, not invoking tools or executing on the host.Source: §4.1.1 · p. 6

4.1.2 Permission Boundary and Scope of Applicability

  • A2A does not itself provide permission tiering or bind tasks to skills, so target agents must implement authorization; with tiering, an attacker needs credentials that trigger execution-type skills.Without tiering, any authenticated task-delivery credential suffices to write arbitrary content into context.Source: §4.1.2 · p. 6

4.2 Attack Principle

  • A2A-TIBA combines indirect injection and bypass in an implant–command–exfiltration chain, where the attacker first induces deployment of a resident callback program.After implantation, commands and exfiltration can proceed directly between the attacker and callback program without the agent.Source: §4.2 · p. 6

4.3 Business Data Flow and Key Injection Points

  • The addressed A2A flow runs from task delivery through context assembly and action execution to result return, with three key injection points abstracted along that chain.Source: §4.3 · pp. 6–7

4.4 Attack Implementation

  • Ten implementations survey the exploitable boundary or instantiate the principle; large-scale validation uses skill07-a, skill09, and skill10, selected for differing trigger forms, code sources, and interaction rounds.Skill07-a is an MCP tool implant, skill09 a script-repair implant, and skill10 a multi-step implant.Source: §4.4 · p. 7

5 EXPERIMENTS

The experiments use A2A-TIBA as a validation-corpus generator to test whether four-class judgments expose how outcomes move between LLM and agent layers.

5.1 Experimental Setup

  • The validation corpus contains 1,000 cases: 900 main-experiment cells and 100 ablation cases, with the 90 IAA samples drawn from the main cells.The main experiment used three attack skills, with 20 repeated tests for each of 15 agent–LLM combinations.Source: Table 2 · p. 8, §5.1 · p. 8, §5.2 · p. 9

5.2 Main Experiment

  • Across 900 main-experiment cells, outcomes were A 451 (50.11%), B 124 (13.78%), C 82 (9.11%), and D 243 (27.00%).The four-class breakdown distinguishes semantic refusal, semantic breach, interception, and penetration rather than collapsing outcomes into ASR.Source: §5.1 · p. 8, §5.2 · p. 9
  • Hermes had 12.00% total penetration versus openclaw's 24.00% and claude code's 45.00%, with semantic refusal rates of 69.33%, 35.00%, and 46.00%, respectively.The captured context showed hermes adds a defensive label warning that the A2A originator is untrusted.Source: §5.2 · p. 9
  • Implementations shifted outcomes across classes; for skill09 + kimi-k2.7-code, penetration ranged from 0% for openclaw to 100% for claude code.After policy rejection, agents often retried through another execution path, so interception was effective only when all equivalent paths were in scope.Source: §5.2 · p. 10, Figure 5 · p. 10

5.3 Selection of the Judging Agent: The IAA Experiment

  • Deepseek-flash and kimi-k2.7-code tied at mean four-class κ 0.899; both achieved 100% Class D accuracy, and the selected judge's duplicate judgments agreed on 89.6% of cells.Deepseek-flash was selected by its higher Class A accuracy, 97.8% versus 97.2%.Source: §5.3 · p. 11

5.4 Ablation Studies on the Envelope Layer

  • Neutralizing hermes's A2A label raised penetration to 60%; adding tool labels brought semantic refusal to 100%, while memory labeling restored it to 100% after contamination drove penetration to 35%.The ablations test annotation of A2A, tool, and memory channels.Source: §5.4 · p. 11, Figure 7 · p. 12
  • Envelope defense includes entry-channel annotation; the ablations vary provenance and trust labeling while holding admission condition α fixed, leaving permission tiering untested.The paper identifies A2A/ACP, MCP tools or skills, memory, and external data as envelope channels.Source: §5.4 · pp. 11–12

6 THREE-LAYER ISOMORPHIC AGENT ATTACK– DEFENSE MODEL

ELA-ITL partitions agent defenses and attacks into corresponding envelope, LLM, and agent layers. Measurements and ablations induced this model and motivate layer-specific defenses and evaluation.

6.1 The Three Layers and Their Isomorphism

  • The defense layers are envelope packaging for incoming channels, LLM recognition of malicious context, and agent interception of dangerous operations.Envelope policies include provenance tags, untrusted-content and trust labels, weights, and admission control; L1 acts before model reasoning.Source: §6.1 · pp. 12–13
  • The corresponding attack surfaces are implant-channel selection, prompt optimization, and execution-mechanism optimization, including equivalent tool paths when a command is refused.Attackers may seek weakly protected channels, disguise intent, or use tool invocation and persistent residency.Source: §6.1 · pp. 12–13

6.2 How the Model Was Induced

  • A 0% penetration rate alongside 100% semantic breach in an OpenClaw combination separated LLM compliance from agent execution; ablations then exposed entry-channel labeling as a defense surface.The envelope layer became visible after Hermes provenance labels and analogous tool and memory labels changed outcomes in the same direction.Source: §6.2 · p. 13
  • ELA-ITL’s isomorphism means each layer is a defense surface and an attack surface, although attackers normally must cross all three while defenders can strengthen any one.The model partitions the path into context entry, model recognition, and execution.Source: §6.3 · p. 13, §6.2 · p. 13

6.3 Design Implications

  • A provenance label moved an experimental cell from penetration to refusal without changing the model or tool policy; interception must cover equivalent execution paths.The back-end model’s recognition ability is not configurable by the defender, making context construction consequential.Source: §6.3 · pp. 13–14
  • The four-class decomposition identifies which defense layer an intervention moves, whereas ASR treats model refusal and agent interception alike.The paper presents GDA Measurement as the instrument for applying ELA-ITL’s layer partition.Source: §6.3 · p. 14

7 CONCLUSION AND FUTURE WORK

The paper presents GDA Measurement, A2A-TIBA, and ELA-ITL as contributions to layer-resolved evaluation and defense. It also identifies limits on the evaluation’s scope and describes future extensions.

Conclusion

  • GDA Measurement captures agent–LLM context at a gateway, preserves conversation and raw-capture data, and uses IAA-selected autonomous judging to decompose ASR into four layer-resolved rates.The rates correspond to semantic refusal, semantic breach, interception, and penetration.Source: §7 · p. 14
  • A2A-TIBA generates a 1,000-case validation corpus across 15 agent front-end × LLM back-end combinations, designed to spread outcomes across four classes.The attack principle uses implant, command, and exfiltration steps.Source: §7 · p. 14
  • Ablations on A2A, tool, and memory channels identify the envelope as a defense surface; annotating untrusted entry channels markedly raises malicious-content recognition.The paper proposes extending evaluation to more envelope channels and multi-agent topologies, and studying envelope-layer defenses.Source: §7 · p. 14

LIMITATIONS

The limitations section distinguishes external-validity bounds from design choices made to isolate the measured variable.

External-validity bounds

  • Evaluation covered only three agent containers and five proprietary LLMs, not real-world scenarios, so neither may be representative.The authors identify these as bounds on external validity.Source: LIMITATIONS · pp. 14–15
  • Each per-cell rate uses 20 repetitions, with a 95% Wilson interval reported for penetration; differences smaller than those intervals should not be over-interpreted.Source: LIMITATIONS · p. 15

Design choices

  • The testbed omits A2A permission tiering, making penetration rates an upper bound for authenticated but untiered access; fixed skill procedures trade attack power for a controlled corpus.Under skill-level authorization, an attacker would additionally need credentials able to trigger execution-type skills.Source: LIMITATIONS · p. 15

ETHICS AND REPRODUCIBILITY STATEMENT

Experiments used an isolated testbed, and the paper reports no new protocol-level vulnerability. Working attack payloads and decoys are not publicly released.

Ethics and reproducibility

APPENDIX A LIST OF ATTACK IMPLEMENTATIONS (SKILLS)

The appendix describes ten experimental skills: six preliminary skills survey attack boundaries, while four implement A2A-TIBA. The preliminary skills all deliver prompts over A2A.

APPENDIX A LIST OF ATTACK IMPLEMENTATIONS (SKILLS)

  • Ten skills were designed for validation, with skill01–06 used as preliminary boundary analysis and skill07–10 implementing A2A-TIBA.Not all skills received large-scale detailed testing, so applicability may be limited.Source: Appendix A · p. 16

A.1 Preliminary Work: skill01–skill06

  • All six preliminary skills deliver prompts to the target agent over the A2A channel.They survey the attack boundary before the A2A-TIBA attack.Source: §A.1 · p. 16
  • Skill01 also supplies the sensitive-file paths used during an attack.Source: §A.1 · p. 16

A.2 Implementations of the A2A-TIBA Attack Principle: skill07–skill10

Skills 07–10 implement the A2A-TIBA principle in different ways, with successful attacks returning sensitive host-file contents. The appendix also documents native A2A labels used by OpenClaw and Hermes.

A.2 Implementations of the A2A-TIBA Attack Principle: skill07–skill10

  • A successful skill07–10 attack returns sensitive-file contents from the target host, using paths obtained via skill01.Skill07 has four variants described in Table 5.Source: §A.2 · p. 16, Table 5 · p. 17

APPENDIX B CONTENTS OF THE LABEL HEADERS

  • The appendix introduces native A2A labels and ablation-study labels used to examine how context labels influence agent defense.The prompt body is denoted by <context>.Source: Appendix B · p. 16

B.1 Native A2A labels of openclaw

  • OpenClaw adds two kinds of A2A labels: a user-message prefix and a separate internal context block.Source: §B.1 · p. 16

B.2 Native A2A labels of hermes

  • Hermes’s native A2A label marks the remote peer message as untrusted external input and warns against following embedded instructions or disclosing secrets.The label identifies the sender using the attacker’s IP address.Source: §B.2 · pp. 16–17

B.3 The modified hermes A2A label in ablation study 1

The modified Hermes label frames an A2A message as a routine peer message, rather than flagging it as untrusted external input.

B.3 The modified hermes A2A label in ablation study 1

  • The modified label presents the remote sender’s message as routine A2A peer traffic and asks the agent to respond as to a colleague.The sender identifier uses the attacker’s IP address.Source: §B.3 · p. 17

B.4 The tool label added to hermes in ablation study 2

The appendix specifies the labels added to Hermes’s tool and memory context and reports resource-use anomalies from attack tests. It also defines the candidate-agent metric scope and identifies three injection points in the task-to-result chain.

B.4 The tool label added to hermes in ablation study 2

  • The Hermes tool label adds a provenance-check warning that an unaudited tool may carry risks and should be reviewed before invocation.<tool> denotes the tool description.Source: §B.4 · p. 17

B.5 The memory label added to hermes in ablation study 3

  • The memory label marks a memory entry as unverified history.<memory> denotes a particular memory entry.Source: §B.5 · p. 17

SUMPTION DURING THE ATTACK TESTS

AGENTS AND THE HUMAN BASELINE

  • Candidate agents pair Claude Code as the front end with a stated back-end LLM; overall accuracy covers four classes, while Class A and D accuracy use only their respective human-reference cells.Source: AGENTS AND THE HUMAN BASELINE · p. 19

APPENDIX E THE THREE KEY INJECTION POINTS IN THE MAIN

  • The paper abstracts three injection points from the task-delivery, context-assembly, action-execution, and result-return chain.Table 10 lists the points.Source: Appendix E · p. 19, Table 10 · p. 19

Related papers

Loading 2610.00392v2…