{"id":"https://openalex.org/W7164820067","doi":"https://doi.org/10.48550/arxiv.2606.14517","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","display_name":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","publication_year":2026,"publication_date":"2026-06-12","ids":{"openalex":"https://openalex.org/W7164820067","doi":"https://doi.org/10.48550/arxiv.2606.14517"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.14517","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14517","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.14517","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100514058","display_name":"Yuguang Zhou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Yuguang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138659460","display_name":"Xunguang Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Xunguang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138631859","display_name":"Pingchuan Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Pingchuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120641627","display_name":"Zhantong Xue","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xue, Zhantong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138677691","display_name":"Zhaoyu Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zhaoyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138657820","display_name":"Shuai Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Shuai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.148499995470047,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.148499995470047,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10456","display_name":"Multi-Agent Systems and Negotiation","score":0.12939999997615814,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.1145000010728836,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.4943000078201294},{"id":"https://openalex.org/keywords/shield","display_name":"Shield","score":0.46389999985694885},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.390500009059906},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.35109999775886536},{"id":"https://openalex.org/keywords/latency","display_name":"Latency (audio)","score":0.35010001063346863}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6100999712944031},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.573199987411499},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.4943000078201294},{"id":"https://openalex.org/C138081364","wikidata":"https://www.wikidata.org/wiki/Q852013","display_name":"Shield","level":2,"score":0.46389999985694885},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.390500009059906},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.35109999775886536},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.35010001063346863},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.29739999771118164},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.25619998574256897},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.22130000591278076}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.14517","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14517","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.14517","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14517","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5813729763031006,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"LLM-based":[0],"guardrails":[1],"have":[2],"emerged":[3],"as":[4],"a":[5,32,49,61,80,134,153,174,181],"highly":[6],"effective":[7],"defense":[8],"against":[9],"prompt":[10],"injection":[11],"and":[12,25,128,150,166,194],"jailbreak":[13],"attacks":[14],"in":[15,44,112,116,158],"autonomous":[16],"agents.":[17],"However,":[18],"we":[19,59,91],"reveal":[20],"that":[21,65,180],"the":[22,42,85,119,169,196,207],"very":[23],"reasoning":[24,46,72],"task-following":[26],"capabilities":[27],"enabling":[28],"this":[29,57,201],"protection":[30],"introduce":[31],"novel":[33],"vulnerability:":[34],"attackers":[35],"can":[36,185],"inject":[37],"crafted":[38],"data":[39],"to":[40,69,140,173,210],"trap":[41],"guardrail":[43,71,124,188],"extended":[45],"loops,":[47],"effectuating":[48],"systematic":[50],"denial-of-service":[51],"(DoS)":[52],"attack.":[53],"To":[54],"systematically":[55,110],"expose":[56],"threat,":[58],"design":[60],"beam-search":[62],"optimization":[63],"framework":[64,96],"crafts":[66],"natural-language":[67],"payloads":[68],"maximize":[70],"length,":[73],"utilizing":[74],"an":[75],"LLM":[76],"proposer":[77],"guided":[78],"by":[79,98],"strategy":[81],"bank.":[82],"Based":[83],"on":[84,133],"observation":[86],"of":[87],"guardrail's":[88],"schema-following":[89],"nature,":[90],"also":[92],"provide":[93],"another":[94],"attack":[95,107,120,170],"driven":[97],"mechanism-aware":[99],"structural":[100],"mutations":[101],"with":[102],"less":[103],"computational":[104],"load.":[105],"The":[106],"efficacy":[108],"is":[109],"evaluated":[111],"two":[113],"parts.":[114],"First,":[115],"standalone":[117],"evaluations,":[118],"generalizes":[121],"across":[122],"diverse":[123],"architectures,":[125],"safety":[126],"templates,":[127],"agent":[129,161],"benchmarks.":[130],"Payloads":[131],"optimized":[132],"single":[135,182],"open-source":[136],"surrogate":[137],"successfully":[138],"transfer":[139],"eight":[141],"leading":[142],"model":[143],"backbones":[144],"(e.g.,":[145],"Claude,":[146],"GPT,":[147],"Gemini,":[148],"DeepSeek,":[149],"Qwen),":[151],"achieving":[152],"13--63$\\times$":[154],"token":[155],"amplification.":[156,177],"Second,":[157],"end-to-end":[159],"real-world":[160],"deployments":[162],"(web,":[163],"desktop,":[164],"code,":[165],"multi-agent":[167],"systems),":[168],"reveals":[171],"up":[172],"148$\\times$":[175],"latency":[176],"We":[178],"show":[179],"poisoned":[183],"document":[184],"saturate":[186],"shared":[187],"infrastructures,":[189],"effectively":[190],"starving":[191],"co-located":[192],"agents":[193],"paralyzing":[195],"entire":[197],"system.":[198],"By":[199],"uncovering":[200],"availability":[202],"flaw,":[203],"our":[204],"work":[205],"underscores":[206],"urgent":[208],"need":[209],"develop":[211],"cost-bounded,":[212],"reasoning-robust":[213],"guardrails.":[214]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-16T00:00:00"}