Systematic evaluation of black-box transferability

Establish the transferability of the indirect prompt-injection evaluation framework from white-box settings, in which the environment is visible to the attacker, to black-box settings, including a systematic evaluation of the associated larger computational cost.

Background

The paper formulates indirect prompt injection as test-time search over an attack surface induced by the environment and user task, and evaluates this formulation in a white-box setting where the attacker can see the environment. The authors state that transfer to black-box settings is expected to be possible but computationally more expensive.

A systematic assessment of black-box transferability is therefore left unresolved. Such an evaluation would determine whether the reported attack-search behavior and scaling trends persist when the attacker cannot directly inspect the target environment, and would quantify the additional computational cost required under restricted access.