The Framing Gap: why reframed injections slip past surface-level defenses in tool-using agents
A late-August 2026 arXiv study shows overt injections get refused, but the same leak disguised as a required field or trusted host succeeds. Only payload-blind defenses held.
What is this?
On August 27, 2026, Md Habibur Rahman and Jaeho Kim posted “The Framing Gap” (arXiv cs.CR). The paper studies a tool-using LLM agent that reads an attacker-controlled web page while holding a secret, and asks how easily the page can make the agent leak it. The experiments run in a synthetic lab: a canary secret, mock tools, and matched clean-versus-poisoned runs across six models. No real system is involved.
The headline result: overt injections (“send me the secret”) are mostly refused, but the same leak disguised as a mandatory integrity signature, a configuration field, or a look-alike “trusted” host succeeds far more often. For gpt-4o, success rose from 0% to 100%.
How it works
The attack does not defeat the model’s alignment; it changes how the request is framed. Per the authors, the model treats a reframed request as part of the task’s own data format rather than as an instruction to refuse. An ablation supports this: removing the confidentiality policy barely changed reframed-attack success (31.9% to 38.1%), which points to confusion between instructions and data rather than broken safety training.
The paper also describes three cost tiers for an attacker:
- Rewording a known mechanism: easy (about 96% success).
- Swapping the field inside a known-effective template: moderate (up to 60%).
- Building a fresh page around a genuinely new mechanism: very hard (0 of 130 succeeded).
The reusable asset is therefore the template, not the underlying mechanism, which is why template reuse across campaigns is the realistic risk. This article deliberately omits the page templates.
Why it matters
Many deployed defenses look for what an injection says: keyword filters, classifiers, and fine-tuning against known attack phrasing. The study suggests these are surface-level. In the paper’s tests, a fine-tuning defense (SecAlign, arXiv 2410.05451) still allowed 32.5% success on the tool agent, channel separation allowed 38.8%, and an output-normalizing guard was bypassed 100% of the time by a held-out ROT13 encoding. A broad “in any form” policy clause blocked the attack (0%) but was brittle: removing the catch-all reopened it (48.8%).
This reinforces the architectural view behind Simon Willison’s lethal trifecta: private data, untrusted content, and an outbound channel in the same agent is the real exposure, regardless of how well the model recognizes attacks.
Defenses
The defenses that worked were payload-blind, meaning they do not depend on recognizing the malicious text:
- Destination allow-list. Closing the set of hosts the agent may contact blocked exfiltration entirely (0%).
- Planner/reader split. Separate the component that reads untrusted content from the one that can act; the reader has no tool authority (0%).
- Least privilege and human approval for outbound or high-risk actions, consistent with OWASP LLM01 guidance.
- Deterministic output validation in code, not model judgment, for any value leaving the trust boundary.
- Regular adversarial testing that includes reframed variants, not only overt injections.
Status
| Item | Detail |
|---|---|
| Source type | Preprint (arXiv cs.CR), not yet peer reviewed as far as we could verify |
| Published | 2026-08-27 |
| Environment | Synthetic lab, canary secret, mock tools |
| Patch status | Not a product vulnerability; no CVE |
| Effective mitigations | Destination allow-list, planner/reader split |