adversarial attacks, leading to erroneous answers [614; 605; 615]. This phenomenon is widely
observed even in LLMs, posing significant challenges to the development of LLM-based agents
[616; 617]. There are also some relevant attack methods such as dataset poisoning [618], backdoor
attacks [619; 620], and prompt-specific attacks [621; 622], with the potential to induce LLMs to
generate toxic content [623; 624; 625]. While the impact of adversarial attacks on LLMs is confined
to textual errors, for LLM-based agents with a broader range of actions, adversarial attacks could
potentially drive them to take genuinely destructive actions, resulting in substantial societal harm. For
the perception module of LLM-based agents, if it receives adversarial inputs from other modalities
such as images [601] or audio [626], LLM-based agents can also be deceived, leading to incorrect
or destructive outputs. Similarly, the Action module can also be targeted by adversarial attacks.
TheRiseandPotentialofLargeLanguageModel BasedAgents