Paper page - Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection

Source: https://huggingface.co/papers/2608.16393

Abstract

Researchers evaluate indirect prompt injection risks in DeepSeek Harness using controlled taint and dual judges, finding notable success rates across text and file channels and recommending controls between untrusted content and sensitive actions.

We assessindirect prompt injectioninDeepSeek Harness(DSH), usingAI-Infra-Guard(A.I.G) to construct tests, deliver controlled taint, execute DSH, collect traces, and judge outcomes. The study covers 14,560 controlled executions over 16 indirect-content channels, text and file carrier modes, 35 payload objectives, one unmodified baseline, and 12 attack methods. The experiment preserves DSH’sagent loop,tool registry,model adapter, andsession-event path; source tools and sensitive sinks are local fixtures, so attempted actions are recorded without external side effects. We evaluate each trace with a deterministicrule-based judge, (RuleJudge), and a semanticLLM-based judge, (LLMJudge). The strongest observed attack success rates are 17.0% under forfake-completion attackin text mode, 25.5% under forhidden Unicodein file mode, and 16.0% under for theskills channelin file mode. also assigns partial compliance more often than (7.3% versus 2.0%). We relate these results to DSH’s treatment of tool results, additional contexts, andtool-call policy hooks, then identify controls that should sit between untrusted content and sensitive actions. Our code is available at https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment .

View arXiv pageView PDFAdd to collection

Get this paper in your agent:

hf papers read 2608\.16393

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2608.16393 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2608.16393 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2608.16393 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.