Skip to content

EIA: ENVIRONMENTAL INJECTION ATTACK ON GENERALIST WEB AGENTS FOR PRIVACY LEAKAGE

🕒 Published (v1): 2025-01-01 · Source: ICLR · Venue: ICLR 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

EIA (Environmental Injection Attack) is an indirect prompt injection attack that injects malicious, invisible HTML elements into webpages to exfiltrate users' PII via generalist web agents. Tested against the SeeAct two-stage agentic framework, EIA achieves up to 70% attack success rate (ASR) for stealing specific PII and 16% ASR for stealing full user requests. The attack exploits the architectural split between action generation (screenshot-only) and action grounding (HTML+screenshot) stages.

Problem

Generalist web agents handle sensitive personally identifiable information (PII) on behalf of users, yet the privacy risks of deploying such agents on adversarially compromised websites had not been systematically studied. Existing prompt injection work targets LLM guardrails or retrieval-augmented systems, not multi-stage agentic frameworks performing state-changing actions on real websites.

Method

EIA modifies benign webpage HTML \(h\) into \(h^* = E(h, \text{PI}, \alpha, \beta)\) by inserting persuasive instructions (PI) at injection position \(\beta\) relative to the legitimate target element \(P_0\), with CSS opacity \(\alpha \in [0,1]\) controlling visibility.

Two injection strategies: - Form Injection (FI): inserts a new hidden HTML form with PI embedded in text content or aria-label attributes. - Mirror Injection (MI): replicates the legitimate target element verbatim, appending PI only in auxiliary attributes (e.g., aria-label), making it structurally indistinguishable from the original.

A JavaScript auto-submission snippet monitors typing on the injected element and exfiltrates data after a 1-second idle timeout, then removes the injected element from the DOM to preserve agent task continuity. For full-request leakage, Relaxed-EIA sets \(\alpha > 0\) (low but non-zero opacity) so the injected element appears in screenshots and contaminates the action generation stage as well as action grounding.

Evaluated using SeeAct (GPT-4V, LlavaMistral7B, LlavaQwen72B) on 177 PII-involving action steps drawn from the Mind2Web dataset across 137 real websites.

Key Contributions

  • First systematic study of privacy risks for generalist web agents under adversarial environments.
  • Novel threat model with two adversarial targets (specific PII leakage; full user-request leakage) and two realistic attack scenarios (contaminated dev libraries; malicious developers).
  • EIA attack formulation with Form Injection and Mirror Injection strategies and an auto-submission mechanism.
  • Relaxed-EIA variant that bridges the action generation / action grounding architectural gap.
  • Detectability analysis and evaluation of defensive system prompts (both shown to be largely ineffective).

Results

  • Specific PII leakage (α=0): MI at position \(P_{+1}\) achieves 70% ASR against GPT-4V; FI (text) at \(P_{+1}\) achieves 67% ASR against GPT-4V.
  • Cross-backbone: ASR remains meaningful even against weaker models (e.g., LlavaQwen72B FI(text) at \(P_{+1}\): 49%); higher task-completion capability correlates with higher attack susceptibility.
  • Position sensitivity: Injections near the target (\(P_{+1}\), \(P_{+2}\)) consistently outperform distant positions (\(P_{\pm\infty}\)); \(P_{+1}\) yields the highest average ASR (39%) across all settings.
  • Full request leakage: Standard EIA (α=0): 0% ASR; Relaxed-EIA with GPT-4V: 16% ASR.
  • Defensive system prompt: Tested defensive prompts fail to meaningfully reduce ASR.
  • Detection: Traditional malware scanners and functional-integrity checks do not reliably flag EIA; only close human visual inspection of non-adapted injections provides partial detection.

Limitations

  • Evaluation confined to SeeAct; generalization to other agentic frameworks (one-stage, Set-of-Mark, etc.) is assumed but not directly measured.
  • Automated injection script sacrifices adaptation quality (e.g., introduces whitespace), underestimating real-world attacker capability.
  • Relaxed-EIA requires non-zero opacity, slightly increasing visual detectability.
  • Dataset of 177 action steps; breadth across all PII categories and website types is limited.
  • No end-to-end multi-step attack evaluation; ASR is measured per action step, not per full task completion.

Relevance to Harnesses / Meta-Harnesses

EIA directly exploits the internal architecture of a web-agent harness: it weaponizes the fact that SeeAct's action grounding stage consumes raw HTML while the action generation stage sees only the rendered screenshot, creating an observable trust-boundary gap that an adversary can target selectively. For harness designers, this demonstrates that multi-stage orchestration pipelines must treat each stage's input surface as an independent attack vector, not just the final output. The auto-submission mechanism and stealth-by-opacity design show that environment-mediated harnesses (those that interact with external, untrusted HTML/DOM) require sandboxing or input-sanitization layers between environment observations and LLM stages. This work is a concrete security case study for any meta-harness that routes agent observations through web or document environments before tool execution.