WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
Multiple prompt injection attacks have been proposed against web agents. At
the same time, various methods have been developed to detect general prompt
injection attacks, but none have been systematically evaluated for web agents.
In this work, we bridge this gap by presenting the first comprehensive
benchmark study on detecting prompt injection attacks targeting web agents. We
begin by introducing a fine-grained categorization of such attacks based on the
threat model. We then construct datasets containing both malicious and benign
samples: malicious text segments generated by different attacks, benign text
segments from four categories, malicious images produced by attacks, and benign
images from two categories. Next, we systematize both text-based and
image-based detection methods. Finally, we evaluate their performance across
multiple scenarios. Our key findings show that while some detectors can
identify attacks that rely on explicit textual instructions or visible image
perturbations with moderate to high accuracy, they largely fail against attacks
that omit explicit instructions or employ imperceptible perturbations. Our
datasets and code are released at:
https://github.com/Norrrrrrr-lyn/WAInjectBench.
68e35b7c73e20ab5778420c8
Yinuo Liu
claimed_verified
2025-10-06T12:48:46.503Z
65daeafd27be2e8c651b46b5
/avatars/fb67d528ee3487698789bdd8b0562707.svg
Yinuo Liu
user
Norrrrrrr
68e35b7c73e20ab5778420c9
Ruohan Xu
68e35b7c73e20ab5778420ca
Xilong Wang
68e35b7c73e20ab5778420cb
Yuqi Jia
68e35b7c73e20ab5778420cc
Neil Zhenqiang Gong
WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
Multiple prompt injection attacks have been proposed against web agents. At
the same time, various methods have been developed to detect general prompt
injection attacks, but none have been systematically evaluated for web agents.
In this work, we bridge this gap by presenting the first comprehensive
benchmark study on detecting prompt injection attacks targeting web agents. We
begin by introducing a fine-grained categorization of such attacks based on the
threat model. We then construct datasets containing both malicious and benign
samples: malicious text segments generated by different attacks, benign text
segments from four categories, malicious images produced by attacks, and benign
images from two categories. Next, we systematize both text-based and
image-based detection methods. Finally, we evaluate their performance across
multiple scenarios. Our key findings show that while some detectors can
identify attacks that rely on explicit textual instructions or visible image
perturbations with moderate to high accuracy, they largely fail against attacks
that omit explicit instructions or employ imperceptible perturbations. Our
datasets and code are released at:
https://github.com/Norrrrrrr-lyn/WAInjectBench.
A comprehensive benchmark study evaluates the detection of prompt injection attacks against web agents, revealing that current detectors perform well against explicit attacks but struggle with subtle ones.
prompt injection attacks web agents threat model malicious text segments benign text segments malicious images benign images text-based detection image-based detection