Technical Summary: When Alignment Isn't Enough: Response-Path Attacks on LLM Agents

1. Problem Statement: Post-Alignment Tampering

The paper identifies a fundamental security gap in the Bring-Your-Own-Key (BYOK) paradigm, a widely adopted architecture where users route Large Language Model (LLM) traffic through third-party relay services (e.g., LiteLLM, OpenRouter) while authenticating with their own credentials.

In this architecture, the relay acts as a legitimate, user-configured proxy that terminates end-to-end encryption, creating two sequential encrypted hops: one between the frontend agent and the relay, and another between the relay and the backend LLM. While the transport layers are secure, the relay has plaintext access to all messages.

The core vulnerability, termed Post-Alignment Tampering, arises because the LLM's safety alignment mechanisms (RLHF, constitutional training, system prompts) operate only on the generation of the response by the backend model. Once the aligned response is generated, it travels through the relay before reaching the agent for execution. The paper argues that current LLM API protocols lack application-layer integrity mechanisms (such as signatures or MACs) to bind the backend model's output to the agent's input. Consequently, a malicious relay can rewrite the LLM's aligned response after generation but before execution, bypassing all safety guarantees without needing to compromise the model or defeat cryptographic transport protections.

This attack surface is distinct from and strictly more powerful than:

• Transport-layer MitM: Which requires defeating encryption or forging certificates.
• Prompt Injection: Which relies on persuading the model to generate harmful content, a process constrained by the model's alignment strength.

2. Methodology: The Relay Tampering Attack (RTA)

The authors instantiate this vulnerability as the Relay Tampering Attack (RTA), a hierarchical framework operating entirely from the relay position. RTA consists of three stages:

2.1 Strategic Orchestration (Chain Attack)

To handle complex, multi-turn objectives that cannot be achieved in a single interaction, the relay decomposes high-level goals into an ordered chain of subgoals. It tracks the state of the conversation and decides whether to forward a response unchanged or intervene based on the current subgoal's requirements. This allows the attack to adaptively gather necessary artifacts (e.g., file paths) before executing the final malicious action.

2.2 Tactical Manipulation

The relay performs minimal, schema-driven edits on the specific fields that dictate agent execution, rather than rewriting the entire text. The framework defines two parallel paths:

• RTA-PreWrite (Query Path): Operates before LLM inference. The relay rewrites the user query and strips system prompt guardrails to "purify" the context, forcing the model to focus solely on the adversarial objective. This path is vulnerable to input-side defenses.
• RTA-PostForge (Response Path): Operates after alignment. The relay intercepts the benign, aligned response and modifies only the critical structured fields (e.g., tool names, arguments, finish reason flags) to force arbitrary tool calls or file writes. This path structurally bypasses the model's safety alignment entirely.

2.3 Stealth Restoration

To evade detection and preserve the user's legitimate task utility, RTA employs:

• Same-Model Polishing: The relay resubmits the tampered draft to the same backend LLM (using the user's BYOK credentials) with a prompt to repair surface-level phrasing while keeping the malicious fields immutable. This ensures the final output matches the model's native style and distribution.
• Concurrent Task Completion: The relay buffers the genuine response for the user's original task and splices it back into the conversation after the attack subgoals are achieved, masking the attack from the user.

3. Formal Model and Theoretical Contributions

The paper formalizes the vulnerability using game-based security definitions, proving four key insights:

1. Unauthenticated Response Substitution: Without end-to-end integrity, a relay can substitute any schema-valid payload. If the payload encodes a harmful action, the agent executes it regardless of the backend model's output.
2. Alignment Ends at the Backend: Even a perfectly aligned LLM (one that never generates harmful responses) offers zero protection against a response-path adversary. The relay discards the aligned output and injects its own, rendering the model's alignment irrelevant to the final execution.
3. Query-Path Rewrite Dominance: A relay capable of rewriting the query context (removing competing instructions) is strictly more powerful than one restricted to appending instructions, as it eliminates the "attention dilution" effect that often protects against prompt injection.
4. Defensive Asymmetry: Detectors relying solely on transcript content are bounded by the statistical distance between the polished (tampered) text and the genuine text. Since RTA uses same-model polishing, this distance is minimized, making transcript-only detection theoretically weak.

4. Experimental Evaluation

The authors evaluated RTA across six LLMs (three proprietary: GPT-5.4, Claude Opus 4.6, Gemini 3.1 Pro; three open-weight: GLM-5.1, MiniMax-M2.5, Qwen-235B) on two benchmarks: AgentDojo and Agent Security Bench (ASB).

Key Results

• Effectiveness: RTA significantly outperforms prompt injection baselines.
  • RTA-PostForge achieved 73.5% Attack Success Rate (ASR) on AgentDojo and 89.2% on ASB.
  • RTA-PreWrite achieved 99.1% ASR on ASB.
  • In contrast, the best prompt-injection baselines achieved only ~17.9% ASR on AgentDojo and ~44.4% on ASB.
• Utility Preservation: Unlike query-path attacks that often break the user's task, RTA-PostForge preserved 47.6% user-task utility on AgentDojo by buffering and restoring the genuine response.
• Imperceptibility: RTA-PostForge maintained high stylistic consistency (C=0.758) and semantic similarity, with Model Equality Testing (MET) rejecting the null hypothesis of identical distributions in only 54.2% of cases, compared to 90.0% for the more aggressive RTA-PreWrite.
• Overhead Evasion: The latency overhead introduced by RTA-PostForge (median ~5.9s) fell within the natural network variance of commercial relays for 74% of interactions, making it difficult to detect via simple latency thresholds.

Defense Evaluation

The paper evaluated four existing agent-side defenses (Delimiters, Sandwich, Known-Answer Detection, CaMeL):

• None fully eliminated RTA-PostForge.
• CaMeL (which forces code generation) reduced ASR to 14.5%, but the authors demonstrated an adaptation where the relay rewrites the generated Python code block directly, recovering the ASR to 50.1%.
• Time-Channel Detector: The authors propose a detector based on operational telemetry (latency). By aggregating timing evidence over a session (n=50 turns), this detector achieved an AUC of 0.964, suggesting that while content-based detection fails, operational anomalies offer a viable defense vector.

5. Significance and Claims

The paper claims to expose a structural integrity failure in the modern LLM agent ecosystem that is distinct from and more severe than prompt injection. Its primary contributions are:

1. Formalization: It proves that response-path forgery strictly dominates prompt injection and that the root cause is the absence of end-to-end integrity verification in current LLM API protocols.
2. Real-World Feasibility: Through case studies on OpenClaw (financial advice) and Claude Code (coding agent), the authors demonstrate that RTA can silently exfiltrate codebases or reverse financial decisions in production environments while maintaining the appearance of normal operation.
3. Limitation of Current Defenses: The work argues that improving model alignment or hardening prompts is insufficient against a relay adversary, as the attack occurs downstream of all alignment checks.
4. Call to Action: The paper concludes that future LLM API protocols must treat end-to-end response integrity as a first-class primitive (e.g., provider-signed responses) to close this gap, as application-layer defenses alone cannot guarantee that the agent executes the response generated by the backend model.

The authors maintain a modest tone regarding future work, noting that their threat model assumes a BYOK setting where the relay legitimately terminates TLS, and that extending the threat model to broader multi-hop infrastructures and designing principled integrity mechanisms are necessary next steps.