dorsal/arxiv
View SchemaOvercoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems
| Authors | Hongyan Chang, Ergute Bao, Xinjian Luo, Ting Yu |
|---|---|
| Categories | |
| ArXiv ID | 2601.07072vv1 |
| URL | https://arxiv.org/abs/2601.07072 |
| License | http://creativecommons.org/licenses/by/4.0/ |
Abstract
Large language models (LLMs) increasingly rely on retrieving information from external corpora. This creates a new attack surface: indirect prompt injection (IPI), where hidden instructions are planted in the corpora and hijack model behavior once retrieved. Previous studies have highlighted this risk but often avoid the hardest step: ensuring that malicious content is actually retrieved. In practice, unoptimized IPI is rarely retrieved under natural queries, which leaves its real-world impact unclear. We address this challenge by decomposing the malicious content into a trigger fragment that guarantees retrieval and an attack fragment that encodes arbitrary attack objectives. Based on this idea, we design an efficient and effective black-box attack algorithm that constructs a compact trigger fragment to guarantee retrieval for any attack fragment. Our attack requires only API access to embedding models, is cost-efficient (as little as $0.21 per target user query on OpenAI's embedding models), and achieves near-100% retrieval across 11 benchmarks and 8 embedding models (including both open-source models and proprietary services). Based on this attack, we present the first end-to-end IPI exploits under natural queries and realistic external corpora, spanning both RAG and agentic systems with diverse attack objectives. These results establish IPI as a practical and severe threat: when a user issued a natural query to summarize emails on frequently asked topics, a single poisoned email was sufficient to coerce GPT-4o into exfiltrating SSH keys with over 80% success in a multi-agent workflow. We further evaluate several defenses and find that they are insufficient to prevent the retrieval of malicious text, highlighting retrieval as a critical open vulnerability.
{
"annotation_id": "1373af1e-7af8-4498-9289-0a9bbb4c3666",
"date_created": "2026-02-17T05:53:08.765000Z",
"date_modified": "2026-02-17T05:53:08.765000Z",
"file_hash": "e64ed96eba1ba29a2272d179aa0faaf074fe4a5dcdf94d56309dc06151cc8801",
"private": false,
"record": {
"abstract": "Large language models (LLMs) increasingly rely on retrieving information from external corpora. This creates a new attack surface: indirect prompt injection (IPI), where hidden instructions are planted in the corpora and hijack model behavior once retrieved. Previous studies have highlighted this risk but often avoid the hardest step: ensuring that malicious content is actually retrieved. In practice, unoptimized IPI is rarely retrieved under natural queries, which leaves its real-world impact unclear.\n We address this challenge by decomposing the malicious content into a trigger fragment that guarantees retrieval and an attack fragment that encodes arbitrary attack objectives. Based on this idea, we design an efficient and effective black-box attack algorithm that constructs a compact trigger fragment to guarantee retrieval for any attack fragment. Our attack requires only API access to embedding models, is cost-efficient (as little as $0.21 per target user query on OpenAI\u0027s embedding models), and achieves near-100% retrieval across 11 benchmarks and 8 embedding models (including both open-source models and proprietary services).\n Based on this attack, we present the first end-to-end IPI exploits under natural queries and realistic external corpora, spanning both RAG and agentic systems with diverse attack objectives. These results establish IPI as a practical and severe threat: when a user issued a natural query to summarize emails on frequently asked topics, a single poisoned email was sufficient to coerce GPT-4o into exfiltrating SSH keys with over 80% success in a multi-agent workflow. We further evaluate several defenses and find that they are insufficient to prevent the retrieval of malicious text, highlighting retrieval as a critical open vulnerability.",
"arxiv_id": "2601.07072",
"authors": [
"Hongyan Chang",
"Ergute Bao",
"Xinjian Luo",
"Ting Yu"
],
"categories": [
"cs.CR",
"cs.AI"
],
"license": "http://creativecommons.org/licenses/by/4.0/",
"title": "Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems",
"url": "https://arxiv.org/abs/2601.07072",
"version": "v1"
},
"schema_id": "dorsal/arxiv",
"source": {
"execution_id": "4dae2bab-af3b-43e7-81df-6e21c84f118d",
"id": "arXiv Dataset",
"type": "Model",
"variant": "snapshot-2026-01-17",
"version": "0.1.0"
},
"user_id": 1000002
}