{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/udora-a-unified-red-teaming-framework-against","title":"UDora: A Unified Red Teaming Framework against LLM Agents by Dynamically Hijacking Their Own Reasoning","arxiv_id":"2503.01908","date":"2025-02-28","proceeding":null,"authors":["Jiawei Zhang","Shuang Yang","Bo Li"],"abstract":"Large Language Model (LLM) agents equipped with external tools have become increasingly powerful for complex tasks such as web shopping, automated email replies, and financial trading. However, these advancements amplify the risks of adversarial attacks, especially when agents can access sensitive external functionalities. Nevertheless, manipulating LLM agents into performing targeted malicious actions or invoking specific tools remains challenging, as these agents extensively reason or plan before executing final actions. In this work, we present UDora, a unified red teaming framework designed for LLM agents that dynamically hijacks the agent's reasoning processes to compel malicious behavior. Specifically, UDora first generates the model's reasoning trace for the given task, then automatically identifies optimal points within this trace to insert targeted perturbations. The resulting perturbed reasoning is then used as a surrogate response for optimization. By iteratively applying this process, the LLM agent will then be induced to undertake designated malicious actions or to invoke specific malicious tools. Our approach demonstrates superior effectiveness compared to existing methods across three LLM agent datasets. The code is available at https://github.com/AI-secure/UDora.","url_abs":"https://arxiv.org/abs/2503.01908v2","url_pdf":"https://arxiv.org/pdf/2503.01908v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"udora-a-unified-red-teaming-framework-against","repo_url":"https://github.com/ai-secure/udora","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"large-language-model","task_name":"Large Language Model"},{"task_slug":"red-teaming","task_name":"Red Teaming"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2503.01908","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2503.01908"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ai-secure/udora","reach":null}],"summary":{"ran_draft_wrong":4,"unverified":1},"by_repo_kind":{"official":{"samples":5,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":5,"samples":[{"code_sha256_prefix":"348aa957ac0c8a68","entry":"get_data_path","repo":"ai-secure/udora","repo_kind":"official","path":"webshop.py","file_url":"https://github.com/ai-secure/udora/blob/HEAD/webshop.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"348aa957ac0c8a68"}},{"code_sha256_prefix":"d8c900061e3b0aec","entry":"prepare_data","repo":"ai-secure/udora","repo_kind":"official","path":"webshop.py","file_url":"https://github.com/ai-secure/udora/blob/HEAD/webshop.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d8c900061e3b0aec"}},{"code_sha256_prefix":"d33daec47607ecda","entry":"sample_ids_from_grad","repo":"ai-secure/udora","repo_kind":"official","path":"udora/attack.py","file_url":"https://github.com/ai-secure/udora/blob/HEAD/udora/attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d33daec47607ecda"}},{"code_sha256_prefix":"b9febc4a88618547","entry":"sample_ids_from_grad_readable","repo":"ai-secure/udora","repo_kind":"official","path":"udora/attack.py","file_url":"https://github.com/ai-secure/udora/blob/HEAD/udora/attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b9febc4a88618547"}},{"code_sha256_prefix":"01c0fc2465ff26e4","entry":"generate_output_path","repo":"ai-secure/udora","repo_kind":"official","path":"webshop.py","file_url":"https://github.com/ai-secure/udora/blob/HEAD/webshop.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"01c0fc2465ff26e4"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}