{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/llmail-inject-a-dataset-from-a-realistic","title":"LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge","arxiv_id":"2506.09956","date":"2025-06-11","proceeding":null,"authors":["Sahar Abdelnabi","Aideen Fay","Ahmed Salem","Egor Zverev","Kai-Chieh Liao","Chi-Huang Liu","Chun-Chih Kuo","Jannis Weigend","Danyael Manlangit","Alex Apostolov","Haris Umair","João Donato","Masayuki Kawakita","Athar Mahboob","Tran Huu Bach","Tsun-Han Chiang","Myeongjin Cho","Hajin Choi","Byeonghyeon Kim","Hyeonjin Lee","Benjamin Pannell","Conor McCauley","Mark Russinovich","Andrew Paverd","Giovanni Cherubin"],"abstract":"Indirect Prompt Injection attacks exploit the inherent limitation of Large Language Models (LLMs) to distinguish between instructions and data in their inputs. Despite numerous defense proposals, the systematic evaluation against adaptive adversaries remains limited, even when successful attacks can have wide security and privacy implications, and many real-world LLM-based applications remain vulnerable. We present the results of LLMail-Inject, a public challenge simulating a realistic scenario in which participants adaptively attempted to inject malicious instructions into emails in order to trigger unauthorized tool calls in an LLM-based email assistant. The challenge spanned multiple defense strategies, LLM architectures, and retrieval configurations, resulting in a dataset of 208,095 unique attack submissions from 839 participants. We release the challenge code, the full dataset of submissions, and our analysis demonstrating how this data can provide new insights into the instruction-data separation problem. We hope this will serve as a foundation for future research towards practical structural solutions to prompt injection.","url_abs":"https://arxiv.org/abs/2506.09956v1","url_pdf":"https://arxiv.org/pdf/2506.09956v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"llmail-inject-a-dataset-from-a-realistic","repo_url":"https://github.com/microsoft/llmail-inject-challenge","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"llmail-inject-a-dataset-from-a-realistic","repo_url":"https://github.com/microsoft/llmail-inject-challenge-analysis","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2506.09956","atlas_url":"https://app.syntology.ai/?focus=2506.09956","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2506.09956"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/microsoft/llmail-inject-challenge-analysis","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/microsoft/llmail-inject-challenge","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":9},"by_repo_kind":{"official":{"samples":9,"ran":0,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"2d6298bdf681831d","entry":"check_task_tracker_in_defs","repo":"microsoft/llmail-inject-challenge-analysis","repo_kind":"official","path":"defense_eval/task_tracker_utils.py","file_url":"https://github.com/microsoft/llmail-inject-challenge-analysis/blob/HEAD/defense_eval/task_tracker_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2d6298bdf681831d"}},{"code_sha256_prefix":"0350084fc060501b","entry":"get_last_token_activations","repo":"microsoft/llmail-inject-challenge-analysis","repo_kind":"official","path":"defense_eval/task_tracker_utils.py","file_url":"https://github.com/microsoft/llmail-inject-challenge-analysis/blob/HEAD/defense_eval/task_tracker_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0350084fc060501b"}},{"code_sha256_prefix":"b75096d520d20cbf","entry":"load_config","repo":"microsoft/llmail-inject-challenge","repo_kind":"official","path":"src/agent/workloads/data_loader.py","file_url":"https://github.com/microsoft/llmail-inject-challenge/blob/HEAD/src/agent/workloads/data_loader.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b75096d520d20cbf"}},{"code_sha256_prefix":"14a12913bc921427","entry":"load_emails","repo":"microsoft/llmail-inject-challenge","repo_kind":"official","path":"src/agent/workloads/data_loader.py","file_url":"https://github.com/microsoft/llmail-inject-challenge/blob/HEAD/src/agent/workloads/data_loader.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"14a12913bc921427"}},{"code_sha256_prefix":"4783ddf7c412ee05","entry":"load_emails","repo":"microsoft/llmail-inject-challenge-analysis","repo_kind":"official","path":"defense_eval/data_loader.py","file_url":"https://github.com/microsoft/llmail-inject-challenge-analysis/blob/HEAD/defense_eval/data_loader.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4783ddf7c412ee05"}},{"code_sha256_prefix":"8f2f458d60bbc7ba","entry":"load_emails_from_scenario","repo":"microsoft/llmail-inject-challenge","repo_kind":"official","path":"src/agent/workloads/data_loader.py","file_url":"https://github.com/microsoft/llmail-inject-challenge/blob/HEAD/src/agent/workloads/data_loader.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8f2f458d60bbc7ba"}},{"code_sha256_prefix":"5b8e2721544ec17f","entry":"load_emails_from_scenario","repo":"microsoft/llmail-inject-challenge-analysis","repo_kind":"official","path":"defense_eval/data_loader.py","file_url":"https://github.com/microsoft/llmail-inject-challenge-analysis/blob/HEAD/defense_eval/data_loader.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5b8e2721544ec17f"}},{"code_sha256_prefix":"cd9adb1fe7a0a7c0","entry":"remove_task_tracker_from_defs","repo":"microsoft/llmail-inject-challenge-analysis","repo_kind":"official","path":"defense_eval/task_tracker_utils.py","file_url":"https://github.com/microsoft/llmail-inject-challenge-analysis/blob/HEAD/defense_eval/task_tracker_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cd9adb1fe7a0a7c0"}},{"code_sha256_prefix":"6198fedf583a0a0f","entry":"span_formatter","repo":"microsoft/llmail-inject-challenge","repo_kind":"official","path":"src/agent/telemetry.py","file_url":"https://github.com/microsoft/llmail-inject-challenge/blob/HEAD/src/agent/telemetry.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6198fedf583a0a0f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}