AI summaryⓘ
The authors studied how well DeepSeek Harness (DSH), an AI system, can resist indirect prompt injection attacks, which try to trick it through hidden or indirect content. They ran 14,560 controlled tests using a tool called AI-Infra-Guard (A.I.G) across different content types and attack methods while monitoring DSH's actions without causing real side effects. They used two types of judges—a rule-based one and an AI-based one—to see if attacks succeeded. Some attacks showed limited success, up to about 25%, and the AI judge often found partial compliance more than the rule-based judge. The authors discuss ways to better protect sensitive actions from untrusted inputs and provide their testing code publicly.
prompt injectionDeepSeek Harness (DSH)AI-Infra-Guard (A.I.G)rule-based judgeLLM-based judgeindirect-content channelscontrolled experimentsattack success ratetool-call policysecurity controls
Authors
Zonghao Ying, Xiangfan Wu, Huiyu Wu, Xing Zheng, Huangsheng Cheng, Xiaorong Shi, Jing Guo
Abstract
We assess indirect prompt injection in DeepSeek Harness (DSH), using AI-Infra-Guard (A.I.G) to construct tests, deliver controlled taint, execute DSH, collect traces, and judge outcomes. The study covers 14,560 controlled executions over 16 indirect-content channels, text and file carrier modes, 35 payload objectives, one unmodified baseline, and 12 attack methods. The experiment preserves DSH's agent loop, tool registry, model adapter, and session-event path; source tools and sensitive sinks are local fixtures, so attempted actions are recorded without external side effects. We evaluate each trace with a deterministic rule-based judge, \JudgeR{} (RuleJudge), and a semantic LLM-based judge, \JudgeL{} (LLMJudge). The strongest observed attack success rates are 17.0% under \JudgeL{} for fake-completion attack in text mode, 25.5% under \JudgeR{} for hidden Unicode in file mode, and 16.0% under \JudgeR{} for the skills channel in file mode. \JudgeL{} also assigns partial compliance more often than \JudgeR{} (7.3% versus 2.0%). We relate these results to DSH's treatment of tool results, additional contexts, and tool-call policy hooks, then identify controls that should sit between untrusted content and sensitive actions. Our code is available at https://github.com/Tencent/AI-Infra-Guard.