{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent looks good in demos, but you cannot tell which product tasks it fails.",
    "change": "Use the study's evaluation idea to inspect a small set of tasks with human-checked answers.",
    "baseline": "Your current evaluator and a manually reviewed reference set.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Agreement with human review, missed failures, false alarms, and evaluation cost per task.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.23254",
  "title": "Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents",
  "summary": "Replaces reporting only attack success rate (ASR) in indirect prompt-injection evaluation with a failure-mode decomposition (refused vs. ignored vs. task-not-completed) using the paper's Attack-Task Outcome Matrix and a label-blind LLM judge, whose prompt and code are released. Cost is one judge pass over agent trajectories plus the labeled corpus, feasible on a single GPU or via API, with no changes to the production agent required. It can fail if the LLM judge misclassifies refusal versus ignoring at scale, and the findings are specific to small open-weight agents (2-14B) on InjecAgent and AgentDojo, so results may not transfer to other models or benchmarks.",
  "rationale": "The reader deploying tool-using agents needs a security metric that distinguishes silent ignoring from genuine refusal and checks task completion, and the released judge and corpus make this adoptable immediately at negligible infrastructure cost.",
  "technique": "Attack-failure-mode auditing for IPI benchmarks",
  "family": "avaliacao_de_agente",
  "recommendation": "adotar",
  "published": "2026-10-16",
  "as_of": "2026-10-19",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.23254",
  "independent_implementations": 2,
  "total_implementations": 3,
  "stars": 15,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "Replaces reporting only attack success rate (ASR) in indirect prompt-injection evaluation with a failure-mode decomposition (refused vs. ignored vs. task-not-completed) using the paper's Attack-Task Outcome Matrix and a label-blind LLM judge, whose prompt and code are released. Cost is one judge pass over agent trajectories plus the labeled corpus, feasible on a single GPU or via API, with no changes to the production agent required. It can fail if the LLM judge misclassifies refusal versus ignoring at scale, and the findings are specific to small open-weight agents (2-14B) on InjecAgent and AgentDojo, so results may not transfer to other models or benchmarks.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.23254",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}