---
title: "Voluntary Servitude: Weaponized Safety Warning Mechanisms for Controlling AI Agents"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2611.04393v1"
permalink: "https://feed.astralor.com/items/itm_7237e2d0b4b79e8f1f3566c4"
published: "2026-11-03T06:26:58.000Z"
score: 60
channel: "ai"
tags: ["LLM","AI Agent","安全","RAG","Voluntary Servitude","Weaponized Safety Warning","Mechanisms","Controlling"]
---

# Voluntary Servitude: Weaponized Safety Warning Mechanisms for Controlling AI Agents

## 速览

LLM agents increasingly act on information retrieved from public sources they treat as credible, which turns a manipulated recommendation into a transaction, a dependency, or a decision with physical consequences. The s…

## 关键点

- LLM agents increasingly act on information retrieved from public sources they treat as credible, which turns a manipulated recommendation into a transaction, a dependency, or a decision with physical consequences.
- The security literature models this threat as instruction injection, in which an adversary writes a command into retrieved content and deployed defenses learn to recognize command syntax.
- We show that an attacker can instead steer an agent through the agent's own harm-avoidance.

## 全文

LLM agents increasingly act on information retrieved from public sources they treat as credible, which turns a manipulated recommendation into a transaction, a dependency, or a decision with physical consequences. The security literature models this threat as instruction injection, in which an adversary writes a command into retrieved content and deployed defenses learn to recognize command syntax. We show that an attacker can instead steer an agent through the agent's own harm-avoidance. A single fabricated hazard, written as an ordinary review, leads the agent to disqualify the legitimate options and select the attacker's target by its own reasoning, with no command for a detector to recognize. We call this voluntary servitude. These payloads steer agents about as often as instruction injection (60.4% vs. 66.0%), and deployed injection detectors score them as benign, so behind a filter they are 1.7-4.4x more effective. We measure this at the generation stage across six models and ten consumer-service domains, for three attack families, and show that it transfers to production browser agents, outperforming instruction injection, and to a retrieval pipeline (1.0-57.0% end-to-end success, depending on the retriever). We then show that a corroboration requirement added to the agent's instructions removes roughly 95% of the exposure against a non-adaptive attacker without retraining. With the requirement in place, the agent still reads the planted hazard and no longer acts on it.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_7237e2d0b4b79e8f1f3566c4