Utility Under Attack

Utility under attack — also called benign utility under attack — is the benign-task success rate a defended, tool-using LLM agent retains while an adversary is actively attempting indirect prompt injection, paired with the defense's refusal cost: the false positives it triggers on clean inputs. It is one half of the security–utility trade-off for prompt-injection defenses. Attack success rate (ASR) measures whether a defense stops the attacker; utility under attack measures whether it also stops the legitimate user. A defense that drives ASR to zero by refusing every request has zero utility under attack.

The term names a quantity, not an established metric. A measurement audit of prompt-injection defense benchmarks found no artifact in its evidence base that documents measuring benign utility under attack or refusal cost — utility preservation is asserted, not measured.

See also

• Indirect prompt injection — the attack class these defenses are evaluated against
• Tool-use reliability — the benign-performance side of agent behavior
• Tool-using agent hardening — practical hardening context for defense evaluation