{"id":"https://openalex.org/W7203687529","doi":"https://doi.org/10.48550/arxiv.2608.16393","title":"Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection","display_name":"Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection","publication_year":2026,"publication_date":"2026-08-17","ids":{"openalex":"https://openalex.org/W7203687529","doi":"https://doi.org/10.48550/arxiv.2608.16393"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.16393","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.16393","pdf_url":"https://arxiv.org/pdf/2608.16393","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.16393","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5020945039","display_name":"Zonghao Ying","orcid":"https://orcid.org/0009-0007-7393-7362","observed_orcids":["https://orcid.org/0009-0007-7393-7362","https://orcid.org/0000-0002-7249-579X"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ying, Zonghao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136049820","display_name":"XiangFan Wu","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Xiangfan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064870334","display_name":"Huiyu Wu","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Huiyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5147414059","display_name":"Xing Zheng","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zheng, Xing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5147380080","display_name":"Huangsheng Cheng","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cheng, Huangsheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5159848946","display_name":"Xiaorong Shi","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shi, Xiaorong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5144399220","display_name":"Jing Guo","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, Jing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9634000062942505,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9634000062942505,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.02239999920129776,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.00860000029206276,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/indirect-prompt-injection","display_name":"indirect prompt injection","score":0.8799999952316284},{"id":"https://openalex.org/keywords/ai-agent-security","display_name":"AI agent security","score":0.6190000176429749},{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.5640000104904175}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.748199999332428},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.6421999931335449},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.555899977684021},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.519599974155426},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5110999941825867},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4496000111103058},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.43689998984336853},{"id":"https://openalex.org/C500551929","wikidata":"https://www.wikidata.org/wiki/Q8819","display_name":"Unicode","level":2,"score":0.4359999895095825},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.39890000224113464},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.37130001187324524},{"id":"https://openalex.org/C2775892892","wikidata":"https://www.wikidata.org/wiki/Q6509517","display_name":"Revocation","level":3,"score":0.3424000144004822},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.32179999351501465},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3188999891281128},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.30649998784065247},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.29660001397132874},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.2840999960899353},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2809999883174896},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.2639999985694885},{"id":"https://openalex.org/C174839445","wikidata":"https://www.wikidata.org/wiki/Q1134386","display_name":"Lock (firearm)","level":2,"score":0.2628999948501587},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2596000134944916},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.2574000060558319},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2554999887943268}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.16393","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.16393","pdf_url":"https://arxiv.org/pdf/2608.16393","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.16393","doi":"https://doi.org/10.48550/arxiv.2608.16393","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.16393","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.16393","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.16393","pdf_url":"https://arxiv.org/pdf/2608.16393","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7203687529.pdf","grobid_xml":"https://content.openalex.org/works/W7203687529.grobid-xml"},"referenced_works_count":8,"referenced_works":["https://openalex.org/W4388886073","https://openalex.org/W4391766701","https://openalex.org/W4393177810","https://openalex.org/W4409150456","https://openalex.org/W4415800619","https://openalex.org/W7156812600","https://openalex.org/W7166848912","https://openalex.org/W7172531637"],"related_works":["https://openalex.org/W7163032196","https://openalex.org/W7117387429","https://openalex.org/W7214943140","https://openalex.org/W7204584025","https://openalex.org/W7204931828","https://openalex.org/W7222558873","https://openalex.org/W7212274194","https://openalex.org/W7138840503","https://openalex.org/W7214793382","https://openalex.org/W7170675441"],"abstract_inverted_index":{"We":[0,80,146],"assess":[1],"indirect":[2],"prompt":[3],"injection":[4],"in":[5,111,120,131],"DeepSeek":[6],"Harness":[7],"(DSH),":[8],"using":[9],"AI-Infra-Guard":[10],"(A.I.G)":[11],"to":[12,150],"construct":[13],"tests,":[14],"deliver":[15],"controlled":[16,29],"taint,":[17],"execute":[18],"DSH,":[19],"collect":[20],"traces,":[21],"and":[22,36,46,60,65,91,123,158,171],"judge":[23],"outcomes.":[24],"The":[25,50,98],"study":[26],"covers":[27],"14,560":[28],"executions":[30],"over":[31],"16":[32],"indirect-content":[33],"channels,":[34],"text":[35,112],"file":[37,121,132],"carrier":[38],"modes,":[39],"35":[40],"payload":[41],"objectives,":[42],"one":[43],"unmodified":[44],"baseline,":[45],"12":[47],"attack":[48,101,110],"methods.":[49],"experiment":[51],"preserves":[52],"DSH's":[53,151],"agent":[54],"loop,":[55],"tool":[56,154],"registry,":[57],"model":[58],"adapter,":[59],"session-event":[61],"path;":[62],"source":[63],"tools":[64],"sensitive":[66,172],"sinks":[67],"are":[68,74,104],"local":[69],"fixtures,":[70],"so":[71],"attempted":[72],"actions":[73],"recorded":[75],"without":[76],"external":[77],"side":[78],"effects.":[79],"evaluate":[81],"each":[82],"trace":[83],"with":[84],"a":[85,92],"deterministic":[86],"rule-based":[87],"judge,":[88,95],"\\JudgeR{}":[89,116,126,142],"(RuleJudge),":[90],"semantic":[93],"LLM-based":[94],"\\JudgeL{}":[96,107,134],"(LLMJudge).":[97],"strongest":[99],"observed":[100],"success":[102],"rates":[103],"17.0%":[105],"under":[106,115,125],"for":[108,117,127],"fake-completion":[109],"mode,":[113,122],"25.5%":[114],"hidden":[118],"Unicode":[119],"16.0%":[124],"the":[128],"skills":[129],"channel":[130],"mode.":[133],"also":[135],"assigns":[136],"partial":[137],"compliance":[138],"more":[139],"often":[140],"than":[141],"(7.3%":[143],"versus":[144],"2.0%).":[145],"relate":[147],"these":[148],"results":[149],"treatment":[152],"of":[153],"results,":[155],"additional":[156],"contexts,":[157],"tool-call":[159],"policy":[160],"hooks,":[161],"then":[162],"identify":[163],"controls":[164],"that":[165],"should":[166],"sit":[167],"between":[168],"untrusted":[169],"content":[170],"actions.":[173],"Our":[174],"code":[175],"is":[176],"available":[177],"at":[178],"https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment":[179],".":[180]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-19T00:00:00"}