Title: Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools
Venue: NeurIPS 2025
Accepted: yes
Keywords: Attractive Metadata Attack

Tool Metadata Manipulation

LLM Agent Security
Abstract: Large language model (LLM) agents have demonstrated remarkable capabilities in complex reasoning and decision-making by leveraging external tools. However, this tool-centric paradigm introduces a previously underexplored attack surface, where adversaries can manipulate tool metadata---such as names, descriptions, and parameter schemas---to influence agent behavior. We identify this as a new and stealthy threat surface that allows malicious tools to be preferentially selected by LLM agents, without requiring prompt injection or access to model internals. To demonstrate and exploit this vulnerability, we propose the Attractive Metadata Attack (AMA), a black-box in-context learning framework that generates highly attractive but syntactically and semantically valid tool metadata through iterative optimization. The proposed attack integrates seamlessly into standard tool ecosystems and requires no modification to the agent’s execution framework. 
Extensive experiments across ten realistic, simulated tool-use scenarios and a range of popular LLM agents demonstrate consistently high attack success rates (81\%-95\%) and significant privacy leakage, with negligible impact on primary task execution. Moreover, the attack remains effective even against prompt-level defenses, auditor-based detection, and structured tool-selection protocols such as the Model Context Protocol, revealing systemic vulnerabilities in current agent architectures.
These findings reveal that metadata manipulation constitutes a potent and stealthy attack surface. 
Notably, AMA is orthogonal to injection attacks and can be combined with them to achieve stronger attack efficacy, highlighting the need for execution-level defenses beyond prompt-level and auditor-based mechanisms.
Code is available at \url{https://github.com/SEAIC-M/AMA}.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces the \"Attractive Metadata Attack\" (AMA), a novel method to compromise LLM agents by manipulating tool metadata (e.g., name, description). The authors formalize the generation of deceptive metadata as a state-action-value optimization problem, using an LLM to iteratively create metadata that entices agents into invoking malicious tools. Through extensive experiments, the paper demonstrates AMA's high success rate, its ability to cause privacy leakage, and its resilience against existing prompt-level defenses, revealing a systemic vulnerability in current agent architectures.\n\nSTRENGTHS AND WEAKNESSES:\nStrength  \n1.\tClear Methodological Exposition: The proposed AMA framework is well-structured and clearly explained. The use of a state-action-value formalism, along with the accompanying algorithm and figures.  \n2.\tGood Presentation: The paper is well-written, with high-quality figures that make the core concepts intuitive and easy to grasp.\n\nWeakness  \n\n1.\tFlawed Threat Model: The threat model appears inconsistent and potentially unrealistic. The paper assumes the attacker cannot access the full platform tool inventory, yet the proposed attack relies on and is evaluated against the specific set of tools available to the target agent. This raises a critical question about the attack's practicality: is it feasible for an attacker to possess such detailed knowledge of a target agent's tool configuration in a real-world scenario? Evaluating the attack's success using the same data it was optimized on also calls the fairness of the evaluation into question.  \n\n2.\tLimited End-to-End Attack Validity: The paper only addresses a fraction of the full attack chain. It focuses on inducing an agent to select a malicious tool from a candidate list but fails to address the critical preceding step: how the malicious tool becomes a candidate in the first place, which significantly limits its real-world impact.  \n\n3.\tInsufficient Evidence for Method Effectiveness: The empirical support for the method is lacking in two key areas:  \no\tLimited Data Scale: The evaluation is conducted on a very small dataset (10 scenarios with 5 user inputs each, totaling 50 data points), which is inadequate for drawing robust and generalizable conclusions about the attack's effectiveness.    \no\tQuestionable Iterative Optimization: In Figure 6, performance gains almost entirely saturate after the first iteration. This undermines the claimed necessity of the iterative optimization process and suggests that the observed improvement may simply stem from overcoming a weak random initialization rather than a sophisticated refinement.\n\n4.\tUnclear Baselines and Flawed Defense Evaluation: The experimental comparisons are poorly described and potentially invalid.  \no\tVague Baselines: Implementation details for the baselines are missing. The paper provides no specific setup for the Prompt Attack. For the Injected Attack, it cites a paper from a non-agent context without explaining the adaptation, and a preliminary code review suggests a potential mismatch between the paper's claims and the actual implementation.  \no\tIrrelevant Defenses: The defense mechanisms are not only unclear but seem misapplied. The paper fails to describe the setup for Refuge. More critically, the Rewrite defense appears to modify the user's task_input, making it a defense against malicious user prompts. This is entirely irrelevant to the paper's threat model of a malicious tool provider, calling the validity of this entire defensive evaluation into serious question.  \n\n5.\tOverstated Novelty and Unsubstantiated Claims:\no\tIncremental Novelty: The paper's emphasis on metadata manipulation (name, description, parameters) is not entirely new, as prior work has exploited these same fields. The primary novelty is in the generation process, not the attack surface itself, making the contribution more incremental than claimed.  \no\tUnsupported Stealthiness: The paper claims \"stealthiness\" but includes no specific mechanism in the AMA framework designed to optimize for it. The observed stealth may simply be an emergent property of generating metadata from existing tools, rather than a deliberate achievement of the proposed method.\n\nQUESTIONS:\n1. Could you explain more about the Threat Model?\n\n2. Could you provide more evidence about the method effectiveness?\n\nLIMITATIONS:\nThe scope of the work is limited to the tool-selection phase and does not address the prerequisite challenge of tool injection. The paper should clarify that it assumes the malicious tool has already been successfully placed in the agent's environment, which is a significant unresolved problem for this attack vector.", "TITLE": "Official Review", "RECOMMENDATION": 2, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-19"}

comments: SUMMARY:
This paper introduces the Attractive Metadata Attack (AMA), which tricks LLM agents into calling malicious tools by cleverly manipulating the tool metadata (like names and descriptions). Unlike prompt injection, this approach works by making bad tools look especially “appealing” to the agent, leading to privacy leaks and other issues. The paper presents a framework for automatically generating attractive metadata and shows the attack works well across multiple LLMs and scenarios, even when common defenses are used.

STRENGTHS AND WEAKNESSES:
Strengths:
1. The idea is original—metadata as an attack vector hasn’t been much explored.
2. The paper is very clear and well-organized, with good figures and tables.
3. Evaluation is thorough, with strong baselines, several LLMs, and various settings.

Weaknesses:
1. It’s not fully clear how generalizable the attack is to LLM agents that use very different architectures, tool-selection mechanisms, or that integrate additional trust signals. Some discussion or experiments on broader generalizability would strengthen the work.
2. The defenses are only briefly discussed. For example, if the LLM checks by itself whether a tool is safe to use before execution, will the attack be defended?

QUESTIONS:
1. What is the performance of AMA when generalized to another LLM? 
2. Can we use the optimized tool description (for tool A) in another tool (tool B) such that the tool B is also preferred by the model?

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-03

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces Attractive Metadata Attack (AMA), a stealthy, black-box attack method that corrupts an LLM agent’s tool-selection process.\nIt works by crafting “irresistible” metadata for a malicious tool. AMA frames metadata generation as a state-action-value optimization driven by ICL and speeds convergence with three practical mechanisms (traceability, weighted value, batch generation). \nExtensive experiments over ten realistic workflows and four popular agents show that AMA achieves high ASR with negligible task degradation.\nIt is able to bypasses prompt-level defenses and the Model Context Protocol.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. Good motivation. This paper highlights a novel privacy risk in personal LLM-agent ecosystems: metadata abuse. This goes beyond the classical prompt injection paradigm.\n2. Clear presentation. The threat model, algorithm, and figures are easy to follow, making the contribution accessible.\n3. The experiments and evaluation are thorough. It covers targeted vs. untargeted settings, multiple models & tasks, prompt-level defenses and MCP, plus ablations on parameter counts and convergence.\n4. Authors provide open-source codes for the propsed framework.\n\nWeaknesses:\n1. The threat model is slightly questionable. It presumes marketplaces let any adversary publish tools without reputation checks, while actual platforms may enforce verification, so threat severity may vary.\n2. Cost analysis is missing. Iterative LLM-driven search might be expensive for attackers.\n3. There are some typos in the paper. For example, symbols in Figure 2 fail to render correctly, hurting readability.\n\nQUESTIONS:\n1. Could you please provide concrete evidence of unvetted tool marketplaces, or describe how AMA could bypass typical verification, so that the threat model’s realism is clearer?\n2. Is a brief cost analysis (time and API dollars) needed to show how attack success changes when the token budget is halved?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes the Attractive Metadata Attack (AMA), which manipulates the metadata of tools (e.g., name, description, parameters) to induce LLM-based agents to prefer and invoke malicious tools over benign alternatives. The paper introduces an iterative metadata generation framework and claims to optimize tool invocation likelihood through value-based scoring and prompt-guided sampling. The attack is evaluated across several LLM agent platforms and remains effective even under structured protocols like MCP and prompt-level defenses.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. Novel Attack. The paper identifies a previously underexplored and realistic vulnerability in LLM-based agent systems—namely, the manipulation of tool metadata to influence agent behavior. This direction may be of interest to the LLM security and safety communities.\n\n2. Comprehensive Evaluation. The empirical evaluation is broad, covering multiple agent platforms, task domains, and defense settings. The authors report strong attack success rates across diverse configurations, supporting the generality of the threat model.\n\nWeakness:\n1. Clarity and Use of Formalism: The paper introduces several formal notations, such as an argmax formulation over an implicit score function (e.g., Equation 3), which are not concretely operationalized. These expressions are presented without clarification of how they are computed, estimated, or optimized. As a result, the formalism adds a layer of complexity that is not matched by the analytical depth that is typically expected in a machine learning paper. In practice, the approach appears to rely entirely on LLM-based sampling and heuristic scoring based on later sections. The use of these symbolic expressions is not only unnecessary but also detracts from the clarity of the core contributions.\n\n2. Validity. According to the algorithm’s initialization phase, the method begins by sampling metadata from a powerful LLM to generate malicious tools that are already capable of inducing tool invocation. If this initial sampling step reliably yields successful adversarial metadata, it is unclear what value the subsequent optimization or scoring loop provides. In this sense, the problem appears to be solved at the point of initialization, making the remainder of the method redundant.\n\n3. Relevance. While the paper introduces a novel attack vector targeting tool metadata, its primary contribution lies in the novel threat modeling rather than in advancing core machine learning methodology. The focus on attacker assumptions, capabilities, and threat scenarios aligns more closely with the objectives of security venues and might not be relevant to the broad NeurIPS audience.\n\nQUESTIONS:\nCould the authors provide a clear, plain-language overview of the core algorithm? The current use of formal notation does not correspond to a concrete mathematical derivation or optimization process. Presenting a high-level description of the method before introducing formalism would improve accessibility and reader understanding. As it stands, the algorithm appears to lack the analytical depth typically expected in a machine learning paper, with the main contribution being the proposed threat model.\n\nLIMITATIONS:\nYes, the authors have included a Limitations and Broader Impact section in the appendix.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-06"}