Task-Tampering Prompt Injection benchmark
by Amazon Science (Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee, Vanessa Murdock)
What is Task-Tampering Prompt Injection benchmark? Task-Tampering Prompt Injection benchmark is a safety & factuality eval made by Amazon Science (Rongting Zhang, Martin Bertran, Sandeep Avula, Chia-Jung Lee, Vanessa Murdock). An indirect prompt-injection benchmark where the planted content does not hijack the agent into a different task, but bends a decision inside the task it is already doing (for example, a fake refund policy cited in a buyer's dispute). It has 90 validated cases across three tool-use environments with 1,433 injection variants, each aimed at a different part of the agent's decision making, such as its rules, available actions or beliefs about state. The paper finds that defenses tuned to objective-hijacking attacks leave these attacks noticeably more successful. Runs go through inspect_ai; the release is for research reproducibility and is non-commercial.
Editor note
An indirect prompt-injection benchmark where the planted content does not hijack the agent into a different task, but bends a decision inside the task it is already doing (for example, a fake refund policy cited in a buyer's dispute). It has 90 validated cases across three tool-use environments with 1,433 injection variants, each aimed at a different part of the agent's decision making, such as its rules, available actions or beliefs about state. The paper finds that defenses tuned to objective-hijacking attacks leave these attacks noticeably more successful. Runs go through inspect_ai; the release is for research reproducibility and is non-commercial.
- What it tests
- Whether tool-using agents can be manipulated into a wrong outcome by untrusted content without changing the task, and how well defenses catch it.
- Original source
- github.com/amazon-science/task-tampering-prompt-injection
- Last updated
- Repo last push 2026-11-06; arXiv v1 2026-11-05
- License
- CC BY-NC 4.0
Related safety & factuality evals
- HarmBench — Robustness to jailbreaks and harmful requests.
- TruthfulQA — Truthfulness versus imitating human misconceptions.
- StrongREJECT — Real effectiveness of jailbreak attacks.
- SimpleQA — Short-form factuality and calibration.
Discussion
No one has discussed Task-Tampering Prompt Injection benchmark yet. Have you run it? Share what it caught, what it missed or how you set it up.