`, long text uses `
`/`
`. 3. Lists use `
- `, quotes use `
`, code uses `
`, important sentences use ``.
4. Preserve all original information, no additions/deals/changes.
5. No ``, ``, `` tags.
* Input Text: A paragraph about LLM agents, prompt injections, runtime monitors, benchmarks, and their findings regarding "thinking" in models.
2. Analyze the Input Text:
* *Paragraph 1:* "LLM agents that read untrusted content can be hijacked by prompt injections. Runtime monitors that try to catch a hijack before the agent acts, and benchmarks that score each task with a single run, share an assumption: whether an agent follows an injection is settled when the injection is read."
* *Paragraph 2:* "We test this assumption with branching rollouts that replay an episode exactly up to the step at which the agent reads an injection and then resample the rest of the episode many times, splitting the outcome variance into a part fixed at read time and a part decided afterwards."
* *Paragraph 3:* "Across four AgentDojo suites, a Qwen3 agent without thinking is largely decided at read time (0.91 of the outcome variance lies between states); with thinking on, this share drops to 0.62 (95% CI of the drop [-0.38, -0.22]), in the same direction for three attack templates and two success labels."
* *Paragraph 4:* "How much is fixed at read time is a property of the model that the same measurement reveals, and thinking lowers the attack success rate of Qwen3 but raises it for two other models."
* *Paragraph 5:* "Resampling from reasoning prefixes shows that the decision forms gradually as the agent reasons."
* *Paragraph 6:* "Zero-shot chain-of-thought monitors built on cheaper models miss much of what is already decided, whereas stronger monitors, and a lookahead monitor that judges simulated next actions, come close to what the prefix determines."
* *Paragraph 7:* "Finally, single-run labels of thinking agents disagree with a rerun up to 35% of the time, so benchmarks need repeated runs per task."
3. Determine Structure & Semantic Elements:
* The text is a continuous argument/findings section from a research paper. It naturally breaks down into logical subsections.
* *Subsection 1 (Introduction/Assumption):* Paragraphs 1 & 2. Can be grouped under an `` like "Assumption and Methodology".
* *Subsection 2 (Results - Qwen3 & Variance):* Paragraphs 3 & 4. Can be an `
` like "Impact of Thinking on Decision Stability".
* *Subsection 3 (Results - Monitors):* Paragraphs 5 & 6. Can be an `
` like "Monitor Effectiveness".
* *Subsection 4 (Conclusion/Benchmarking):* Paragraph 7. Can be an `
` like "Benchmark Reliability".
* Wait, the prompt says "长文用
/
划分小节" (long text divided into sections using h2/h3). Let's structure it logically.
* Actually, let's look at the flow.
* `
Assumption and Testing Approach
` -> P1, P2
* `Impact of Thinking on Decision Variance
` -> P3, P4
* `Monitor Performance
` -> P5, P6
* `Benchmark Reliability
` -> P7
* Let's check for `` usage. Important sentences: "whether an agent follows an injection is settled when the injection is read." (P1), "this share drops to 0.62", "so benchmarks need repeated runs per task." (P7). I'll bold key findings or crucial assumptions.
* Let's check for ``. None in the text.
* Let's check for ``. None in the text.
* Let's check for `- `. None in the text.
4. Drafting the HTML:
```html
Assumption and Testing Approach
LLM agents that read untrusted content can be hijacked by prompt injections. Runtime monitors that try to catch a hijack before the agent acts, and benchmarks that score each task with a single run, share an assumption: whether an agent follows an injection is settled when the injection is read.
We test this assumption with branching rollouts that replay an episode exactly up to the step at which the agent reads an injection and then resample the rest of the episode many times, splitting the outcome variance into a part fixed at read time and a part decided afterwards.
Impact of Thinking on Decision Variance
Across four AgentDojo suites, a Qwen3 agent without thinking is largely decided at read time (0.91 of the outcome variance); with thinking on, this share drops to 0.62 (95% CI of the drop [-0.38, -0.22]), in the same direction for three attack templates and two success labels.
How much is fixed at read time is a property of the model that the same measurement reveals, and thinking lowers the attack success rate of Qwen3 but raises it for two other models.
Monitor Effectiveness
Resampling from reasoning prefixes shows that the decision forms gradually as the agent reasons.
Zero-shot chain-of-thought monitors built on cheaper models miss much of what is already decided, whereas stronger monitors, and a lookahead monitor that judges simulated next actions, come close to what the prefix determines.
Benchmark Relability
Finally, single-run labels of thinking agents disagree with a rerun up to 35% of the time, so benchmarks need repeated runs per task.
```
5. Refining and Checking Constraints:
* Rule 1: Only output HTML fragment, no markdown fences, no explanation. (Check)
* Rule 2: Paragraphs use ``, long text uses `
/
`. (Check)
* Rule 3: Lists `- `, quotes `
`, code `
`, strong ``. Used `` appropriately. No lists/quotes/code in source, so just applying where applicable.
* Rule 4: Preserve all info, no add/delete/modify. (Check)
* Rule 5: No `//`. (Check)
6. Final Polish of HTML Structure:
Make sure the headings accurately reflect the content transitions.
- P1: Intro / Assumption
- P2: Methodology
- P3-P4: Results on thinking
- P5-P6: Monitor results
- P7: Conclusion on benchmarking
Let's refine the heading hierarchy to be more natural for a research abstract/paper excerpt.
`` for main themes.
Theme 1: The Assumption & Methodology
Theme 2: Impact of "Thinking" on Variance and Success Rates
Theme 3: Monitor Capabilities
Theme 4: Benchmark Reliability
Let's double check the exact wording for ``:
- "prompt injections" is a key term.
- "0.91 of the outcome variance"
- "0.62"
- "95% CI of the drop [-0.38, -0.22]"
- "so benchmarks need repeated runs per task." -> maybe not strong, just a concluding sentence. Let's keep strong on the quantitative results as they are the core findings.
Wait, is there any list? No. Quote? No. Code? No. So I only use `` and `
` and ``. Let's review the exact text to ensure zero alteration: "
`, code uses ``, important sentences use ``. 4. Preserve all original information, no additions/deals/changes. 5. No ``, ``, `` tags. * Input Text: A paragraph about LLM agents, prompt injections, runtime monitors, benchmarks, and their findings regarding "thinking" in models. 2. Analyze the Input Text: * *Paragraph 1:* "LLM agents that read untrusted content can be hijacked by prompt injections. Runtime monitors that try to catch a hijack before the agent acts, and benchmarks that score each task with a single run, share an assumption: whether an agent follows an injection is settled when the injection is read." * *Paragraph 2:* "We test this assumption with branching rollouts that replay an episode exactly up to the step at which the agent reads an injection and then resample the rest of the episode many times, splitting the outcome variance into a part fixed at read time and a part decided afterwards." * *Paragraph 3:* "Across four AgentDojo suites, a Qwen3 agent without thinking is largely decided at read time (0.91 of the outcome variance lies between states); with thinking on, this share drops to 0.62 (95% CI of the drop [-0.38, -0.22]), in the same direction for three attack templates and two success labels." * *Paragraph 4:* "How much is fixed at read time is a property of the model that the same measurement reveals, and thinking lowers the attack success rate of Qwen3 but raises it for two other models." * *Paragraph 5:* "Resampling from reasoning prefixes shows that the decision forms gradually as the agent reasons." * *Paragraph 6:* "Zero-shot chain-of-thought monitors built on cheaper models miss much of what is already decided, whereas stronger monitors, and a lookahead monitor that judges simulated next actions, come close to what the prefix determines." * *Paragraph 7:* "Finally, single-run labels of thinking agents disagree with a rerun up to 35% of the time, so benchmarks need repeated runs per task." 3. Determine Structure & Semantic Elements: * The text is a continuous argument/findings section from a research paper. It naturally breaks down into logical subsections. * *Subsection 1 (Introduction/Assumption):* Paragraphs 1 & 2. Can be grouped under an `` like "Assumption and Methodology". * *Subsection 2 (Results - Qwen3 & Variance):* Paragraphs 3 & 4. Can be an `
` like "Impact of Thinking on Decision Stability". * *Subsection 3 (Results - Monitors):* Paragraphs 5 & 6. Can be an `
` like "Monitor Effectiveness". * *Subsection 4 (Conclusion/Benchmarking):* Paragraph 7. Can be an `
` like "Benchmark Reliability". * Wait, the prompt says "长文用
/
划分小节" (long text divided into sections using h2/h3). Let's structure it logically. * Actually, let's look at the flow. * `
Assumption and Testing Approach
` -> P1, P2 * `Impact of Thinking on Decision Variance
` -> P3, P4 * `Monitor Performance
` -> P5, P6 * `Benchmark Reliability
` -> P7 * Let's check for `` usage. Important sentences: "whether an agent follows an injection is settled when the injection is read." (P1), "this share drops to 0.62", "so benchmarks need repeated runs per task." (P7). I'll bold key findings or crucial assumptions. * Let's check for ``. None in the text. * Let's check for ``. None in the text. * Let's check for `
- `. None in the text. 4. Drafting the HTML: ```html
Assumption and Testing Approach
LLM agents that read untrusted content can be hijacked by prompt injections. Runtime monitors that try to catch a hijack before the agent acts, and benchmarks that score each task with a single run, share an assumption: whether an agent follows an injection is settled when the injection is read.
We test this assumption with branching rollouts that replay an episode exactly up to the step at which the agent reads an injection and then resample the rest of the episode many times, splitting the outcome variance into a part fixed at read time and a part decided afterwards.
Impact of Thinking on Decision Variance
Across four AgentDojo suites, a Qwen3 agent without thinking is largely decided at read time (0.91 of the outcome variance); with thinking on, this share drops to 0.62 (95% CI of the drop [-0.38, -0.22]), in the same direction for three attack templates and two success labels.
How much is fixed at read time is a property of the model that the same measurement reveals, and thinking lowers the attack success rate of Qwen3 but raises it for two other models.
Monitor Effectiveness
Resampling from reasoning prefixes shows that the decision forms gradually as the agent reasons.
Zero-shot chain-of-thought monitors built on cheaper models miss much of what is already decided, whereas stronger monitors, and a lookahead monitor that judges simulated next actions, come close to what the prefix determines.
Benchmark Relability
Finally, single-run labels of thinking agents disagree with a rerun up to 35% of the time, so benchmarks need repeated runs per task.
``` 5. Refining and Checking Constraints: * Rule 1: Only output HTML fragment, no markdown fences, no explanation. (Check) * Rule 2: Paragraphs use ``, long text uses `
/
`. (Check) * Rule 3: Lists `
- `, quotes `
`, code ``, strong ``. Used `` appropriately. No lists/quotes/code in source, so just applying where applicable. * Rule 4: Preserve all info, no add/delete/modify. (Check) * Rule 5: No `//`. (Check) 6. Final Polish of HTML Structure: Make sure the headings accurately reflect the content transitions. - P1: Intro / Assumption - P2: Methodology - P3-P4: Results on thinking - P5-P6: Monitor results - P7: Conclusion on benchmarking Let's refine the heading hierarchy to be more natural for a research abstract/paper excerpt. `` for main themes. Theme 1: The Assumption & Methodology Theme 2: Impact of "Thinking" on Variance and Success Rates Theme 3: Monitor Capabilities Theme 4: Benchmark Reliability Let's double check the exact wording for ``: - "prompt injections" is a key term. - "0.91 of the outcome variance" - "0.62" - "95% CI of the drop [-0.38, -0.22]" - "so benchmarks need repeated runs per task." -> maybe not strong, just a concluding sentence. Let's keep strong on the quantitative results as they are the core findings. Wait, is there any list? No. Quote? No. Code? No. So I only use `
` and `
` and ``. Let's review the exact text to ensure zero alteration: "