The authors used branching rollouts on AgentDojo episodes, replaying each episode identically until the agent reads a tool output containing the injection (the exposure state), then resampled the agent's continuations from that state many times.
LLM agents decide to follow prompt injections during reasoning, not at injection time
Branching rollout experiments across four AgentDojo suites show that for thinking models, outcome variance shifts from the read step into reasoning, altering assumptions for monitors and benchmarks.
Top University
Haoxuan Jia · Yang Liu · Bin Chong · Yingguang Yang · Yancheng Chen · Jiayu Liang · +10 more
Fullive-AI · Nanyang Technological University · JD.com · Peking University · University of Chinese Academy of Sciences
Research Digest··3 min read
Jia et al.
§