Adaptive Attack
Quick Answer
An adaptive attack is an attack crafted or iterated with knowledge of the specific defense it targets, adjusted against the defended system until it succeeds. It contrasts with a static attack — a fixed template or corpus assembled before the defense existed and replayed unchanged. In prompt-injection evaluation, defenses reported at near-zero attack success rate under static benchmarks have been bypassed at over 50% success rates by adaptive, defense-aware attackers.
Adaptive Attack
An adaptive attack is an attack crafted or iterated with knowledge of the specific defense being evaluated, adjusted against the defended system until it succeeds. Also known as a defense-aware attack, it contrasts with a static attack: a fixed template or corpus built before the defense existed and replayed unchanged. The distinction is about the attacker's feedback loop, not the injection channel or payload. In evaluations of defenses against indirect prompt injection, adaptivity is the dominant axis of disagreement between benchmarks — the same class of defenses scores near-zero attack success rate against static corpora and above 50% against adaptive attackers.
One independent evaluation bypassed eight prompt-injection defenses using adaptive attacks, each at over 50% attack success rate. A defense validated only against static benchmarks has been tested against yesterday's attacker.
See also
- Indirect prompt injection — injection delivered through data an agent processes
- Security benchmarks for prompt-injection defenses — measurement audit contrasting static and adaptive evaluation
- Tool-using agent hardening — practical hardening steps for agent deployments