Don't Refuse, Misdirect: Bounding Jailbreak ASR for On-Chain AI Agents

For any on-chain AI agent with a natural-language interface—a DeFi router, a DAO treasury bot, a TEE-based oracle—the standard defense against prompt injection is a blunt refusal. That approach is asymptotically doomed. A new analysis shows that conventional detect-and-block defenses let attacker success rate (ASR) approach one as the query budget grows, because predictable refusals give useful feedback to automated search [^claim_196]. An attacker with enough queries can iteratively refine prompts until the guardrail cracks.

The alternative is detect-and-misdirect. Instead of saying “I cannot help,” the system returns controlled, non-operational responses designed to induce false-positive errors in the attacker’s automated judge [^claim_202]. This lowers the positive predictive value of attacker-selected candidates and yields a bounded asymptotic ASR [^claim_197]. The attacker’s own evaluation loop becomes the bottleneck: it can’t tell whether a probe landed or not, so it wastes budget on dead ends.

The paper concretizes this strategy with Contextual Misdirection via Progressive Engagement (CMPE)—a lightweight conversational misdirection method that replaces predictable refusal text with safe but strategically misleading responses in automated jailbreak settings [^claim_198]. On jailbreak benchmarks, CMPE reduces estimated ASR upper bounds by up to two orders of magnitude [^claim_199]. In end-to-end runs against state-of-the-art automated jailbreak frameworks PAIR and GPTFuzz, CMPE nearly eliminates verified attack success [^claim_200].

Crucially, the analysis isn’t just empirical. The paper models the attack-defense setting through a probabilistic model of a target system, its defense mechanism, and the attacker’s automated judge [^claim_201]. This formalization lets designers reason about asymptotic behavior instead of relying on spot checks—a critical capability when the adversary can run thousands of queries against an on-chain agent.

For crypto, the implication is direct. Any autonomous agent with tool-calling privileges—a MEV searcher using an LLM to craft bundles, a cross-chain bridge agent that accepts user intents, a TEE-enclave agent managing private keys—that uses detect-and-block will eventually be jailbroken given enough queries. Adopting CMPE-style misdirection cuts that risk by ~99% and, more importantly, provides a provable bound on worst-case success. Protocols like LangChain-based wallet agents or intent-solver networks should treat misdirection as a security primitive, not a nice-to-have.

The bottom line: on-chain AI agents must stop saying “no” and start saying “sure, here’s something harmless.” The attacker’s judge is the weakest link—exploit it.