AI summaryⓘ
The authors introduce ContainmentBench, a new way to test how well language models that use tools handle untrusted or risky content by not just looking at final outcomes, but also tracing how information spreads and how much useful work still gets done. They tested their method using a large study with a specific language model and found that even when final safety results looked the same, the internal behavior and utility varied a lot depending on the enforcement method used. Their results suggest that simply checking if a system avoids harm at the end isn't enough; instead, evaluations should look at detailed traces of how the system behaves over time and how well it recovers from risky inputs. Their study is based on synthetic data and assumes a perfect system for tracking authorized actions.
Prompt injectionLanguage model agentsSandbox benchmarkingPolicy complianceTainted workflowsAuthorized utilityTrace-based evaluationTool-boundary enforcementStructured authorization ledgerRecovery instrumentation
Authors
Wenhao Lan, Shan Li, Xinhua Lai, Meiqi Wu, Junbin Yang, Haihua Shen
Abstract
Tool-using LLM agents process untrusted content, maintain memory, delegate across agents, and invoke side-effecting tools. Existing prompt-injection evaluations typically summarize security with terminal attack or policy outcomes, but equal endpoints can conceal different post-exposure traces and different losses of authorized utility. We introduce ContainmentBench, a sandboxed, trace-based benchmark that separately measures benchmark-defined endpoint policy compliance, instrumented logged propagation, recovery instrumentation, and authorized structured-action completion. In a pre-specified 17,640-rollout study with Qwen2.5-7B-Instruct, all 600 matched active-tainted pairs comparing taint-only and intent-aware enforcement have the same zero committed-harm outcome, yet 73.5% differ in logged trajectory or utility. Taint-only enforcement completes only 0.1642 of authorized tainted workflows; a trusted-ledger policy raises completion to 0.8567, while a strong tool-boundary baseline reaches 0.9233 under the same observed endpoint-policy outcomes. We also find that aggregate logged-spread rankings change with evidence-stage composition and denominator choice. These results show that a terminal policy label is not a sufficient statistic for operational post-exposure containment; evaluations should report endpoint, stage-stratified trajectory, and utility evidence separately, and should promote recovery evidence to comparative claims only where the corresponding controls are valid. The full-scale study is synthetic and single-model; the policy case additionally assumes a correct structured authorization ledger.