When Alignment Isn't Enough: Response-Path Attacks on LLM Agents
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866917457261756416 |
|---|---|
| author | Luo, Mingyu Zhang, Zihan Liu, Zesen Xie, Yuchong Zhang, Zhixiang Yeung, Dung Hiu Hilton Lai, Wai Ip Chen, Ping Wen, Ming She, Dongdong |
| author_facet | Luo, Mingyu Zhang, Zihan Liu, Zesen Xie, Yuchong Zhang, Zhixiang Yeung, Dung Hiu Hilton Lai, Wai Ip Chen, Ping Wen, Ming She, Dongdong |
| contents | Bring-Your-Own-Key (BYOK) agent architectures let users route LLM traffic through third-party relays, creating a critical integrity gap: a malicious relay can modify an aligned LLM response after generation but before agent execution. We formalize this post-alignment tampering threat and show that, without end-to-end integrity, the relay can observe, suppress, or replace downstream messages, making even perfectly aligned LLMs ineffective against such attacks. We instantiate this threat as the Relay Tampering Attack (RTA), which performs multi-round strategic rewriting, minimal security-critical edits, and stealth restoration by resubmitting tampered outputs to the upstream LLM. Across AgentDojo and ASB with six LLMs, RTA achieves up to 99.1% attack success, outperforming prompt-injection baselines with modest overhead. Case studies on OpenClaw and Claude Code demonstrate real-world feasibility, and evaluations of four defenses show that none fully prevent RTA. Finally, we propose a time-based detection defense that mitigates RTA while preserving agent utility. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_02187 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | When Alignment Isn't Enough: Response-Path Attacks on LLM Agents Luo, Mingyu Zhang, Zihan Liu, Zesen Xie, Yuchong Zhang, Zhixiang Yeung, Dung Hiu Hilton Lai, Wai Ip Chen, Ping Wen, Ming She, Dongdong Cryptography and Security Artificial Intelligence Bring-Your-Own-Key (BYOK) agent architectures let users route LLM traffic through third-party relays, creating a critical integrity gap: a malicious relay can modify an aligned LLM response after generation but before agent execution. We formalize this post-alignment tampering threat and show that, without end-to-end integrity, the relay can observe, suppress, or replace downstream messages, making even perfectly aligned LLMs ineffective against such attacks. We instantiate this threat as the Relay Tampering Attack (RTA), which performs multi-round strategic rewriting, minimal security-critical edits, and stealth restoration by resubmitting tampered outputs to the upstream LLM. Across AgentDojo and ASB with six LLMs, RTA achieves up to 99.1% attack success, outperforming prompt-injection baselines with modest overhead. Case studies on OpenClaw and Claude Code demonstrate real-world feasibility, and evaluations of four defenses show that none fully prevent RTA. Finally, we propose a time-based detection defense that mitigates RTA while preserving agent utility. |
| title | When Alignment Isn't Enough: Response-Path Attacks on LLM Agents |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2605.02187 |