An Oct. 6 preprint reports that training raised a 4-billion-parameter web agent’s model-judged completion rate from 23.00% to 30.72% when an attacker excluded from training inserted an instruction into a simulated page. The benchmark covered 150 form-filling tasks.
A web agent must read pages to complete a user’s request, but third-party page text can also try to redirect it. The paper calls this an indirect prompt injection. Ignoring all page text is not an answer: the agent needs the page’s values and controls to do the requested task.
AdvSim2Real leaves WebWorld-14B, a model that simulates webpage changes after browser actions, frozen. It trains three separate components against that fixed simulator: Qwen3.5-4B, the form-filling agent; a task proposer that selects tasks the agent currently completes about half the time; and an attacker that tries to insert one timed instruction on a page. The attacker earns credit only when its injection turns a clean run accepted by the judge into a judged failure. The agent trains on clean tasks, new attacks and attacks from earlier rounds.
On the fixed benchmark, the agent’s clean judged completion rate rose from 74.89% to 81.33%. Its average completion across the three learned adversaries rose from 48.07% to 57.48%. Against Kimi-K3, a hosted attacker model kept out of training, judged completion increased from 23.00% to 30.72%, a gain of 7.72 percentage points. The paper averages the learned-adversary results across three rollout seeds and the Kimi-K3 comparison across two.
A separate clean Chromium test found strict form-submission success rose from 25.56% to 44.44% for a Stage 1 capability checkpoint, before adversarial training. It was not an attack test: attacked outcomes were judged by frozen Qwen3.8-27B inside WebWorld-14B, which read the same page as the executor, and the study did not verify whether each task remained feasible after injection. The result supports a gain on this simulated benchmark; performance against live-site attacks remains unknown.
Sources
- AdvSim2Real preprint, submitted Oct. 6
- Full paper: method, evaluation and limitations
- Authors’ project page, benchmark and code
- Image: AdvSim2Real overview by its authors, used unmodified under CC BY 4.0.