Imagine you want to ruin a chef's dinner service, but you've never seen the menu. You don't know what dishes are being prepared or what 'good' tastes like. Instead, you watch the kitchen through a window, note what the chef does when left alone, and then figure out exactly which ingredient to swap at the pass to make every plate worse. You never need to know the recipes — the chef's own unperturbed behavior is your reference. That's ENDOPROMPT. The committed claim: you can learn a generator that produces per-request prompt-injection prefixes degrading an instruction-tuned LLM's utility by a mean of 26.8 percentage points, without any task labels, benchmark answers, or prescribed failure modes. The method needs only the victim model's own clean continuations as pseudo-references. This is not the first prompt-injection attack, but it is a structurally distinct one — it removes the attacker's dependence on knowing what correct output looks like, which has been a quiet prerequisite in most prior utility-degradation work. The architecture is a three-stage white-box pipeline. Stage one: local search over token prefixes to find candidates that reduce the victim's continuation likelihood on unlabeled instructions. Stage two: preference fitting — for each instruction, the method compares prefix-injected outputs against clean continuations and trains a generator to prefer the degrading ones. Stage three: reward refinement distills this preference signal further. At deployment, the generator is a single forward pass per request — no search required. The method lives in the gradient-based, white-box adversarial family, closer to GCG-style token optimization than to social-engineering-style prompt injections, but distinguished by its self-supervised supervision signal. The evaluation surface is wide: four instruction-tuned models, seven complete benchmark splits, yielding 28 model×benchmark cells. 27 of 28 show negative utility change. The mean drop is -26.8 percentage points. That's a real number on real benchmarks, not a cherry-picked demo. But the authors are honest about what doesn't work: the controls do not establish that request-matching (generating a different prefix per request rather than reusing a single universal one) actually improves degradation. Output expansion is a failure mode — the model sometimes just gets verbose rather than wrong. These are meaningful caveats that weaken the 'learned personalization' story. Integrity is mixed. The benchmarks are standard community benchmarks (seven of them, complete splits), and the evaluation is systematic — 28 cells is disciplined. But this is entirely same-team simulation. No independent replication, no pre-registration, and the code is promised upon acceptance rather than released at submission. The white-box access assumption is strong: the attacker needs full gradient access to the victim model's weights. This is realistic for open-weight models (Llama, Mistral) but irrelevant for closed APIs. The paper doesn't compare against the strongest existing utility-degradation baselines by name with numbers in the abstract; the ladder positioning requires reading the full paper. The milestone question is about scaling to black-box transfer. Right now this works with white-box access to open-weight models. The next real unlock is whether the learned generator transfers to black-box APIs — if prefixes trained on Llama-3 degrade GPT-4o by even 10 points, that changes the threat model from 'academic exercise on open models' to 'deployable attack surface.' The gap is probably 1-2 papers away, not a hardware wall. The obvious experiment not run: black-box transfer evaluation. Train the generator on an open-weight victim, test on a closed API. The authors almost certainly didn't run this because (a) API costs for systematic evaluation across seven benchmarks are non-trivial, and (b) the results might be weak, undermining the paper's narrative. My honest read is option (a) plus strategic deferral — this is the obvious next paper.
