LLM Web Agent Security for Indirect Prompt Injection Analysis through Action-Level Evaluation

• We formalize two measurable quantities – the Action-Silent
Compliance Gap (δAS ) and the Context Contamination
Probability (γCS ) – that decouple textual compliance from
tool-invocation compliance at each trajectory step.
• We introduce ALEF, a five-stage measurement pipeline that
maps IPI objectives to tool-invocation goals, varies structural
page representation, executes stateful five-page trajectories,
audits both text and action layers, and evaluates execution-
layer defenses.
• We report a large-scale study (300 payloads, 8 LLMs, 5 rep-
resentations, N = 47,812 valid runs) showing action-level
compliance systematically exceeds text-level compliance for
high-stakes tasks, that the gap is largest for state-of-the-art
(SOTA) closed models, and that representations suppressing
textual compliance do not proportionally suppress action
compliance.
• We quantify cross-page context contamination, including
delayed action hijacking on clean downstream pages, and
empirically evaluate three execution-layer defenses.