{"id":"https://openalex.org/W7127310348","doi":"https://doi.org/10.48550/arxiv.2602.02395","title":"David vs. Goliath: Verifiable Agent-to-Agent Jailbreaking via Reinforcement Learning","display_name":"David vs. Goliath: Verifiable Agent-to-Agent Jailbreaking via Reinforcement Learning","publication_year":2026,"publication_date":"2026-02-02","ids":{"openalex":"https://openalex.org/W7127310348","doi":"https://doi.org/10.48550/arxiv.2602.02395"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2602.02395","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2602.02395","pdf_url":"https://arxiv.org/pdf/2602.02395","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2602.02395","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120021240","display_name":"Samuel Nellessen","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nellessen, Samuel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5030772953","display_name":"Tal Kachman","orcid":"https://orcid.org/0000-0002-6065-9646","observed_orcids":["https://orcid.org/0000-0002-6065-9646"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kachman, Tal","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/jailbreaking","display_name":"jailbreaking","score":0.7599999904632568},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.7519999742507935},{"id":"https://openalex.org/keywords/tool-misuse","display_name":"tool misuse","score":0.5099999904632568},{"id":"https://openalex.org/keywords/adversarial-attacks","display_name":"adversarial attacks","score":0.5260000228881836},{"id":"https://openalex.org/keywords/zero-shot-transfer","display_name":"zero-shot transfer","score":0.49900001287460327},{"id":"https://openalex.org/keywords/slingshot","display_name":"slingshot","score":0.5569999814033508}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7529000043869019},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6766999959945679},{"id":"https://openalex.org/C85847156","wikidata":"https://www.wikidata.org/wiki/Q59015987","display_name":"Verifiable secret sharing","level":3,"score":0.6488999724388123},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.6481000185012817},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.630299985408783},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6176000237464905},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.6055999994277954},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5152000188827515},{"id":"https://openalex.org/C2777200299","wikidata":"https://www.wikidata.org/wiki/Q52943","display_name":"Conversation","level":2,"score":0.49869999289512634},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.4108999967575073},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39089998602867126},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.36880001425743103},{"id":"https://openalex.org/C2777852691","wikidata":"https://www.wikidata.org/wiki/Q13430821","display_name":"Crowds","level":2,"score":0.3384000062942505},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.33640000224113464},{"id":"https://openalex.org/C17020691","wikidata":"https://www.wikidata.org/wiki/Q139677","display_name":"Operator (biology)","level":5,"score":0.33149999380111694},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.3138999938964844},{"id":"https://openalex.org/C90509273","wikidata":"https://www.wikidata.org/wiki/Q11012","display_name":"Robot","level":2,"score":0.29840001463890076},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2973000109195709},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.2939999997615814},{"id":"https://openalex.org/C13687954","wikidata":"https://www.wikidata.org/wiki/Q4826847","display_name":"Autonomous agent","level":2,"score":0.2773999869823456},{"id":"https://openalex.org/C126388530","wikidata":"https://www.wikidata.org/wiki/Q1131737","display_name":"Imitation","level":2,"score":0.2759999930858612},{"id":"https://openalex.org/C10347200","wikidata":"https://www.wikidata.org/wiki/Q1960297","display_name":"Hindsight bias","level":2,"score":0.2671000063419342},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2662000060081482},{"id":"https://openalex.org/C2776650193","wikidata":"https://www.wikidata.org/wiki/Q264661","display_name":"Obstacle","level":2,"score":0.2540000081062317},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.25380000472068787},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.25360000133514404}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2602.02395","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2602.02395","pdf_url":"https://arxiv.org/pdf/2602.02395","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2602.02395","doi":"https://doi.org/10.48550/arxiv.2602.02395","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.02395","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2602.02395","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2602.02395","pdf_url":"https://arxiv.org/pdf/2602.02395","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7127310348.pdf","grobid_xml":"https://content.openalex.org/works/W7127310348.grobid-xml"},"referenced_works_count":14,"referenced_works":["https://openalex.org/W4304195432","https://openalex.org/W4385374425","https://openalex.org/W4385474529","https://openalex.org/W4385965642","https://openalex.org/W4387929776","https://openalex.org/W4391329245","https://openalex.org/W4396239636","https://openalex.org/W4405904694","https://openalex.org/W4414587625","https://openalex.org/W4415333036","https://openalex.org/W4415797457","https://openalex.org/W4416009616","https://openalex.org/W6966618268","https://openalex.org/W7128378279"],"related_works":["https://openalex.org/W4417275640","https://openalex.org/W4414976938","https://openalex.org/W4416037424","https://openalex.org/W7165183485","https://openalex.org/W7080323450","https://openalex.org/W7148798976","https://openalex.org/W7202366269","https://openalex.org/W7212795411","https://openalex.org/W7140082020","https://openalex.org/W7133539277"],"abstract_inverted_index":{"The":[0],"evolution":[1],"of":[2,53],"large":[3],"language":[4],"models":[5,145,157,187],"into":[6,28],"autonomous":[7],"agents":[8],"introduces":[9],"adversarial":[10],"failures":[11],"that":[12,77,177],"exploit":[13],"legitimate":[14],"tool":[15,60],"privileges,":[16],"transforming":[17],"safety":[18],"evaluation":[19],"in":[20,87],"tool-augmented":[21],"environments":[22],"from":[23,131,184],"a":[24,41,44,54,72,84,110,115,170],"subjective":[25],"NLP":[26],"task":[27],"an":[29],"objective":[30],"control":[31],"problem.":[32],"We":[33],"formalize":[34],"this":[35,67],"threat":[36,173],"model":[37,141,174],"as":[38,169],"Tag-Along":[39,167],"Attacks:":[40],"scenario":[42],"where":[43],"tool-less":[45],"adversary":[46],"\"tags":[47],"along\"":[48],"on":[49],"the":[50,122],"trusted":[51],"privileges":[52],"safety-aligned":[55],"Operator":[56,117],"to":[57,93,95,125,133,139],"induce":[58],"prohibited":[59],"use":[61],"through":[62,188],"conversation":[63],"alone.":[64,191],"To":[65],"validate":[66],"threat,":[68],"we":[69],"present":[70],"Slingshot,":[71],"'cold-start'":[73],"reinforcement":[74],"learning":[75],"framework":[76],"autonomously":[78],"discovers":[79],"emergent":[80],"attack":[81,151,161],"vectors,":[82],"revealing":[83],"critical":[85],"insight:":[86],"our":[88],"setting,":[89],"learned":[90],"attacks":[91,180],"tend":[92],"converge":[94],"short,":[96],"instruction-like":[97],"syntactic":[98],"patterns":[99],"rather":[100],"than":[101],"multi-turn":[102],"persuasion.":[103],"On":[104],"held-out":[105],"extreme-difficulty":[106],"tasks,":[107],"Slingshot":[108,136],"achieves":[109],"67.0%":[111],"success":[112,127,152,162],"rate":[113],"against":[114],"Qwen2.5-32B-Instruct-AWQ":[116],"(vs.":[118],"1.7%":[119],"baseline),":[120],"reducing":[121],"expected":[123],"attempts":[124],"first":[126],"(on":[128],"solved":[129],"tasks)":[130],"52.3":[132],"1.3.":[134],"Crucially,":[135],"transfers":[137],"zero-shot":[138],"several":[140],"families,":[142],"including":[143],"closed-source":[144],"like":[146,158],"Gemini":[147],"2.5":[148],"Flash":[149],"(56.0%":[150],"rate)":[153],"and":[154,175],"defensive-fine-tuned":[155],"open-source":[156],"Meta-SecAlign-8B":[159],"(39.2%":[160],"rate).":[163],"Our":[164],"work":[165],"establishes":[166],"Attacks":[168],"first-class,":[171],"verifiable":[172],"shows":[176],"effective":[178],"agentic":[179],"can":[181],"be":[182],"elicited":[183],"off-the-shelf":[185],"open-weight":[186],"environment":[189],"interaction":[190]},"counts_by_year":[{"year":2026,"cited_by_count":4}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-02-04T00:00:00"}