Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models

Abstract

As language models take on agentic roles that call APIs, read tool outputs, and act on third-party content, their attack surface expands beyond what users type. Whether they treat a malicious instruction the same way regardless of where it arrives has not been studied systematically. We introduce the Safety Asymmetry Score (SAS), measuring how a model's susceptibility to adversarial content shifts depending on whether it arrives in the user message, tool metadata, or tool output, using matched payload pairs that hold the malicious text identical and vary only the channel. Across 10 production LLMs and three attack families, general-purpose models sharply discount instructions arriving as tool metadata relative to identical instructions in the user message, while agent-native models discount them far less. This differential survives an affordance-matched control equalizing tool availability and scoring, and a size-controlled mixed-effects analysis. Within the tool surface the pattern reverses: the same content is far more instruction-like in a tool's description than in its output, with affordances identical. Models treat tool metadata as instructions and tool results as data. In Llama 3.3-70B and GPT-OSS-120B this signal is causally present at mid-to-late depths but non-linearly encoded, so linear probes miss what activation patching recovers.

Accepted to EMNLP 2026 (Main Conference)