Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Junliang Liu, Ruoyu Li, Wenxin Tang, Jingyu Xiao, Zhenyu Liu, Jingheng Xu, Laizhong Cui
• Venue: arXiv: cs.CR
• Published: 2026-08-12
• Collected: 2026-08-13
• URL: http://arxiv.org/abs/2608.12273v1
• PDF: https://arxiv.org/pdf/2608.12273v1
• DOI: UNKNOWN
• Registry group: academic_apis_and_preprints
• Evidence role: canonical_academic_index
• Language: en
• Country / region: UNKNOWN

Plain-Language Brief

Researchers introduce Convergent Detour Hijacking (CDH), a technique that manipulates Language Learning Model (LLM) agents by using natural language descriptions and instruction bodies to steer the agents onto more costly and time-consuming trajectories. This technique can be used to attract an attacker-controlled coordinator, recruit unnecessary skills, and increase token consumption and execution time without significantly affecting task completion.

What the Document Says

• The text discusses a new technique called Convergent Detour Hijacking (CDH).
• CDH is used to manipulate Language Learning Model (LLM) agents by using natural language descriptions and instruction bodies.
• The goal of CDH is to steer the agents onto more costly and time-consuming trajectories.
• CDH can attract an attacker-controlled coordinator, recruit unnecessary skills, and increase token consumption and execution time.
• The researchers evaluate CDH across multiple LLM backends and 491 tasks under single-task and multi-turn conditions.

Key Concepts Mentioned

• Convergent Detour Hijacking (CDH)
• Language Learning Model (LLM) agents
• natural language descriptions
• instruction bodies
• costly trajectories
• token consumption
• execution time

Claims Made by the Document

• CDH is a technique to manipulate LLM agents.
• CDH can attract an attacker-controlled coordinator.
• CDH can recruit unnecessary skills.
• CDH increases token consumption and execution time.

Evidence Used

• The text states that CDH is introduced and describes how it works.
• The text provides statistics on the selection of the matched coordinator, increase in token consumption, and execution time.

Methods / Approach

• Evaluating CDH across multiple LLM backends and 491 tasks under single-task and multi-turn conditions

Limitations Stated by the Authors

Not stated in source

Limitations Noted by the Agent

Agent interpretation — not from the source.

The agent may not be able to determine the effectiveness of CDH outside the provided evaluation.

Open Questions

• What is the impact of CDH on other types of models beyond LLM agents?
• How can defenses be developed against CDH?

Notes for Future Q&A

May include interpretation. Labeled where it does.

The text does not provide information about the specific LLM backends used in the evaluation.

Raw Abstract / Excerpt

LLM agents increasingly rely on third-party skills, using natural-language descriptions for selection and instruction bodies for planning. This progressive-disclosure design exposes two sequential control points to untrusted publishers: a static skill may steer an otherwise correct task onto an unnecessarily costly trajectory. Prior work studies selection manipulation, malicious skill instructions, and tool-chain resource amplification largely separately, leaving their end-to-end composition unclear. We introduce Convergent Detour Hijacking (CDH), a text-only, runtime-independent attack that couples these stages. Under shared semantic cover, a description establishes relevance during selection, while an aligned body reuses that rationale to fabricate plausible dependencies during planning. CDH attracts an attacker-controlled coordinator alongside legitimate skills, recruits unnecessary benign skills into a bounded detour, and then re-enters the original route to preserve task completion. We evaluate it across multiple LLM backends and 491 held-out tasks under single-task and multi-turn conditions. On DeepSeek-V4-Pro, the matched coordinator is selected in 80.02% of tasks; among coordinator-hit runs that complete tasks, token consumption and end-to-end execution time increase by 66.91% and 92.45%, respectively, while aggregate task completion remains comparable. Thus, correct outcomes do not guarantee trajectory integrity or cost safety.