{"id":"2e0c105c-4eb8-46c7-af1e-3abf12df6ee5","arxiv_id":"2608.05430","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A query- and context-aware sentence detector with adversarial training provides a tunable utility-versus-security defense against indirect prompt injection in LLM agents.","lead":"A lightweight sentence-level detector that judges each sentence of a tool's output against the user's request can catch malicious instructions embedded in text read by LLM agents. The paper shows that adversarial training, using either embedding-space perturbations or LLM paraphrases, makes such a detector robust to adaptive attacks while allowing a tunable tradeoff between task utility and security.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"CAD's sentence-level threat model excludes sub-sentence blended injections, a gap the abstract does not caveat; a blended-attack evaluation would settle whether the central claim's scope is too narrow.","rationale":"The reader's weakest assumption is exactly the sentence-level granularity limitation, and I agree that it is the most fragile premise for the central claim. The central claim is that CAD is a robust, lightweight IPI defense that outperforms SOTA baselines; the mechanism is sentence-level segmentation. If the attack model were extended to sub-sentence blending, the central mechanism would fail in a way that neither base CAD nor the AT variants (which also operate on whole-sentence representations) can address. The conclusion explicitly acknowledges this, so the paper is internally consistent, but the abstract presents the claim without that caveat. The proposed blended-attack test would directly probe whether this limitation is practically severe: if CAD's ASR on blended injections approaches the no-defense level, the claim 'outperforms SOTA IPI defense baselines' is only valid for a narrow threat model. This is more load-bearing than the reader's secondary concerns about in-domain evaluation or missing baseline confidence intervals, because those affect the strength of the empirical evidence but not the fundamental scope of the approach. I therefore recommend keeping the CONDITIONAL verdict, with the condition that the authors either empirically evaluate blended sub-sentence attacks and report the resulting degradation, or explicitly scope the central claim to standalone-sentence injections in the abstract.","tokens_in":37164,"tokens_out":15550,"duration_ms":138276,"concrete_test":"Construct a 'blended' attack variant from the static injection sets of AgentDojo and AgentDyn by merging each malicious instruction into a benign sentence as a subordinate clause (or via punctuation), preserving the attack goal and making the injection non-standalone. Run base CAD and its best AT(alpha) configuration on these documents and measure ASR and UA against the original whole-sentence attacks. If ASR rises substantially (e.g., above 25%) or UA drops to near the no-defense level, the limitation is confirmed as load-bearing, and the abstract should explicitly scope the claim to standalone-sentence injections.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing concern is the sentence-level segmentation premise. The abstract claims CAD 'outperforms state-of-the-art IPI defense baselines' and that its AT variants provide high utility and low ASR, without stating the structural scope: the detector classifies whole sentences and cannot isolate an instruction blended into an otherwise benign sentence, as the conclusion admits. The architecture (sentence-level classification, marginal-impact representation computed by removing whole sentences), the training data (injections inserted at sentence boundaries), and both AT variants (feature-space perturbations of whole-sentence representations and LLM paraphrases that replace the entire injection sentence) all assume malicious instructions are standalone sentences. In real IPI, blending an instruction into a benign sentence is a natural evasive move, and the evaluated benchmarks do not include this case. If an attacker exploits this gap, CAD must either remove the entire sentence (destroying utility) or leave the instruction in place (failing security). This limitation is not an edge case; it determines whether the central claim holds for a broad class of realizable attacks. The paper's own disclosure is honest, but the abstract's unqualified claim overstates the defense's applicability.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CAD, a lightweight sentence-level detector for malicious instructions in text, aimed at indirect prompt injection (IPI) defense in LLM agents. CAD represents each sentence as the concatenation of its isolated embedding and the marginal impact of the sentence on the embedding of the combined user-query-plus-document text, and classifies with a small MLP on a frozen encoder. To improve evasion robustness, the authors introduce two adversarial training variants—feature-space perturbations computed by a random-start FGSM-like step in embedding space, and realizable LLM paraphrasing attacks—both controlled by a mixing parameter alpha that induces a utility-security tradeoff. The detector is trained on LLM-synthesized data derived from AgentDojo examples and evaluated on AgentDojo and AgentDyn under static attacks and AutoDojo adaptive attacks, using GPT-4o-mini, Gemini-Flash-2.5, and Qwen3-235B as agent LLMs, and compared with eight baselines. The main claims are that CAD outperforms state-of-the-art IPI defenses under static attacks, and that the alpha-parametrized AT variants achieve lower adaptive attack success rate at some utility cost, with the optimal alpha varying by application domain.","tokens_in":37329,"tokens_out":14014,"duration_ms":116369,"significance":"If the results hold, this is a practically valuable contribution: CAD requires no LLM calls at inference, has negligible runtime overhead, does not need access to the protected agent, and can wrap any agentic framework. The evaluation is unusually extensive for this area, covering two benchmarks, static and adaptive attacks, three agent LLMs, representation ablations, seed statistics, runtime overhead, and a public code release. The finding that conventional feature-space adversarial training transfers to realizable LLM-adaptive attacks is a scientifically interesting result for the adversarial-machine-learning community. The main limitation, acknowledged by the authors, is that the method operates at the whole-sentence level and cannot isolate sub-sentence blended injections; this scope needs to be stated precisely in the central claims.","major_comments":[{"comment":"The threat model in Section 3 assumes that the attacker inserts malicious sentences into the clean document, and the data generation prompts in Appendix E ('plain imperative instruction without wrapper or boundary text') and Appendix F ('Do NOT add surrounding filler, framing, or benign-looking sentences') enforce that training and AT examples are standalone sentences. The Conclusion then concedes that 'CAD classifies whole sentences, so it cannot isolate an instruction blended into an otherwise benign one.' This is a load-bearing scope limitation, because sub-sentence blended injections are a natural and realizable evasive move, and the architecture, training data, and both AT variants are all incompatible with that attack class. The abstract and title claim detection of 'malicious instructions in text' without this caveat, which overstates the applicability of the method. I request either an explicit evaluation with blended injections (e.g., instructions embedded as clauses inside otherwise benign sentences) or a clear qualification in the abstract and introduction that CAD operates at sentence granularity and does not address sub-sentence blending.","section":"Section 3, Appendix E/F, Conclusion"},{"comment":"The text states that on AgentDyn, AT 'still reaches below 10% ASR while retaining relatively high CU and UA.' Table 7 shows that to reach an adaptive ASR below 10% on AgentDyn one must use at least alpha=0.01, which yields CU=26.11% and UA=20.78%, compared with 46.7% and 35.7% for no defense; at alpha>=0.05, CU is at most 7%. The 'relatively high utility' characterization is thus accurate only relative to the system-level baselines (e.g., Progent CU=6.7, DRIFT CU=18.3), not relative to an unprotected agent. Since the abstract emphasizes 'significantly higher utility' for the AT variants, the utility cost should be explicitly quantified against the no-defense baseline in the narrative, rather than only visible in the tables.","section":"Section 5, 'Evasion-Robust Detection', Table 7"}],"minor_comments":[{"comment":"The paper notes that the AgentDojo suites used at evaluation seed the training-data generation, making the AgentDojo results in-domain for CAD while the baselines are used out of the box. The out-of-domain AgentDyn results are the fairer comparison, and the abstract should not present the AgentDojo results as if they are a like-for-like comparison with untrained baselines.","section":"Section 4, Data Generation"},{"comment":"The reported seed statistics show substantial variance on several headline metrics (e.g., AgentDyn static ASR for base CAD is 3.5 with a 95% CI half-width of 4.85). The paper should avoid drawing conclusions from small absolute differences on such metrics, and ideally report variance for the baseline defenses as well.","section":"Appendix D, Table 9"},{"comment":"The tradeoff is described as 'smooth,' but the underlying sweeps show sharp discontinuities (e.g., AgentDyn CU for LLM-paraphrasing AT drops from 26.11% at alpha=0.01 to 3.33% at alpha=0.05 in Table 7). The curves in Figure 1 are monotone because they connect Pareto-optimal points; consider describing the tradeoff as 'parametric' or 'Pareto-monotone' rather than 'smooth.'","section":"Abstract and Section 4, AT(alpha)"},{"comment":"The feature-space perturbation radius epsilon_b is fixed at 25% of the mean absolute feature value for each block. Since the effectiveness of feature-space AT is a central scientific claim, a sensitivity analysis over epsilon_b would meaningfully strengthen the result.","section":"Appendix C, Table 5"},{"comment":"The email for the second author, 'm.owen@wustl.edu,' appears inconsistent with the stated name Xinhang Ma; please verify the contact address.","section":"Author information"},{"comment":"The references for DeepSeek-AI et al. and Gemini Team et al. use a nonstandard 'et al.' formatting in the author lists; please ensure consistency with the venue style.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"This is a solid empirical paper with a clear contribution. The main risk is the sentence-level threat model, which is honestly disclosed but should be either evaluated or explicitly scoped in the central claims. If the authors add a blended-attack experiment or qualify the abstract and title accordingly, I would be happy to see it accepted. No issues with citation or novelty disclosure."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a solid paper and deserves a serious referee. The genuinely new piece is the query-relative segment representation (Eq. 1) — the marginal impact of each sentence on the query-response embedding, concatenated with the isolated sentence embedding. That is not in any of the cited baselines, and the ablations show it earns its keep, especially on AgentDyn, where dropping query or context cuts clean utility roughly in half. The two AT variants, feature-space FGSM and LLM paraphrase, are parametrized by alpha and trace a clean utility/ASR tradeoff across three agent LLMs and three benchmarks. They also report runtime overhead, seed-level stats for CAD, and release code. That is a well-executed empirical study, and the evidence that feature-space AT transfers to realizable paraphrase attacks is interesting in its own right.\n\nThe soft spots are not fatal, but one is structural. The detector classifies whole sentences; it cannot isolate an instruction blended into an otherwise benign sentence. The conclusion says this plainly, but the abstract's performance claims are unqualified, and the training data, representation, and AT variants all assume standalone injection sentences. An adaptive attacker who blends the instruction sub-sentence forces CAD to either drop the whole sentence (utility loss) or leave the attack in. A blended-attack experiment would settle how wide that gap is; as it stands, the paper's scope is narrower than the abstract suggests. That is a caveat, not a refutation — most benchmarked IPI attacks are standalone sentences, and the authors are honest about the limit.\n\nSmaller issues: the AgentDojo evaluation is partly in-domain (AgentDyn transfer mitigates this), and baselines are reported without confidence intervals, so some headline gaps over system-level defenses hinge on single-point comparisons. Epsilon_b is hand-set, but the tradeoff curves are smooth across alpha, so that looks minor. The citation pattern is sound, grounded in the relevant benchmarks and adversarial-ML literature.\n\nWho it is for: anyone building lightweight filters for LLM-agent pipelines, and adversarial-ML readers interested in whether feature-space AT generalizes to text. I would send it to peer review and ask the authors to caveat the sentence-level scope in the abstract and add a blended-attack experiment. The core result is solid and the contribution is real.","headline":"A solid, well-evaluated sentence-level IPI detector with a genuinely new query-relative representation; the main caveat is a structural scope limit (no sub-sentence blending) that the abstract under-sells but the conclusion honestly discloses.","tokens_in":37897,"tokens_out":3118,"would_cite":true,"duration_ms":26870,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a lightweight, query- and context-aware sentence classifier can beat state-of-the-art defenses against indirect prompt injection, and that parameterized adversarial training makes it resistant to adaptive evasion…","keywords":["indirect prompt injection","sentence-level detection","context-aware embedding","adversarial training","LLM agents","utility-security tradeoff","prompt injection defense","marginal impact representation"],"falsifier":"Rewrite the injections in an agentic benchmark so that each instruction is embedded inside a benign sentence as a subordinate clause or parenthetical (preserving every literal value), run CAD with its published checkpoint under the adaptive AutoDojo evaluation, and compare attack success rate and clean utility against the paper's reported numbers; a large ASR increase with stable utility would show that the whole-sentence segmentation premise fails.","tokens_in":36916,"feed_emoji":"🛡️","tokens_out":8423,"duration_ms":66820,"temperature":0.7,"pith_summary":"This paper proposes CAD, a lightweight sentence-level detector for indirect prompt injection in LLM-agent workflows. The central claim is that judging each sentence relative to the user's query and the surrounding document, rather than in isolation, lets a frozen text encoder plus a small MLP match or beat far heavier defenses. The paper further claims that adversarial training, via either embedding-space perturbations or LLM paraphrases, reduces adaptive attack success at a tunable cost to utility, and that both variants trace nearly the same utility-security curve. If these claims hold, robust malicious-instruction filtering can become a cheap pre-processing wrapper around any agent.","feed_headline":"A small context-aware filter cuts prompt-injection success to 0 percent","feed_subtitle":"CAD scores each sentence against the user query and context, then hardens itself against adaptive paraphrased attacks.","key_machinery":"The central object is the CAD representation $x_j(q,s) = \\phi(s_j) \\,||\\, [\\phi([q;s]) - \\phi([q;s_{-j}])]$, where $\\phi$ is a frozen text encoder, $s_{-j}$ is the document with the target sentence removed, and $||$ denotes vector concatenation. The first block is the sentence in isolation; the second is the marginal impact of the sentence on the embedding of the entire query-response pair, and it is the mechanism that carries query and context dependence into the classifier. The classifier itself is a two-hidden-layer MLP trained with class-balanced cross-entropy. Resilience is carried by the adversarial-training objective $\\alpha \\mathcal{L}_{\\mathrm{adv}} + (1-\\alpha) \\mathcal{L}_{\\mathrm{orig}}$, where $\\mathcal{L}_{\\mathrm{adv}}$ is computed on either random-start signed-gradient (FGSM-style) perturbations in embedding space or on LLM-paraphrased injections, and the mixture weight $\\alpha \\in [0,1]$ traces the utility-security tradeoff.","core_discovery":"On the paper's own terms, the discovery is that malicious-instruction detection in agentic settings is best treated as query- and context-aware sentence classification, and that a frozen encoder suffices when each sentence is represented by its isolated embedding concatenated with the marginal change it causes in the embedding of the query-plus-response pair. On AgentDojo this CAD classifier achieves 0 percent static attack success while preserving utility, and on AgentDyn it retains utility where system-level defenses over-defend. Under AutoDojo adaptive attacks, adversarial training with either feature-space perturbations or LLM paraphrases pushes attack success down to low single digits on AgentDojo and below 10 percent on AgentDyn at a utility cost that varies by suite, with LLM paraphrasing typically preserving slightly more utility. The paper also reports that feature-space adversarial training, whose perturbations need not correspond to any real text, transfers to realizable paraphrased and adaptive attacks.","pith_inferences":["The same marginal-impact representation could be reused to detect off-topic, hallucinated, or contradictory sentences in retrieved documents, since it measures how much a sentence shifts the embedding of the query-response pair; the paper does not test this broader use.","Because CAD labels whole sentences, an attacker who merges the instruction into a longer benign sentence should defeat it; the paper acknowledges this, and a sub-sentence segmentation variant is the natural next test.","The suite dependence of alpha suggests an online controller that adjusts the detector's threshold or alpha from observed ASR and utility could replace fixed per-domain calibration; the paper does not explore this.","Since only the MLP is trained and the encoder stays frozen, CAD could be quickly re-targeted to new domains or attack styles from a small labeled sample; continual adaptation is an untested but plausible extension."],"forward_implications":["CAD can serve as a universal pre-processing defense: it adds roughly 1x mean runtime overhead relative to no defense, while system-level and LLM-based filters cost 2-3x on the harder benchmark.","The adversarial-data ratio alpha gives practitioners an explicit dial between utility and attack success, with the shape of the tradeoff varying by application suite.","Feature-space adversarial training, despite using perturbations that need not correspond to real text, transfers to realizable LLM-paraphrase attacks and adaptive AutoDojo attacks, so conventional adversarial ML methods may apply to IPI defense.","Static AgentDojo attacks are neutralized outright (0 percent ASR) by CAD, while adaptive attacks are contained by AT variants that retain utility where system-level defenses over-defend."],"supporting_citations":[{"why":"Supplies the AgentDojo benchmark and the three suites (Banking, Slack, Travel) that seed CAD's synthetic training data and its static evaluation.","marker":"Debenedetti et al. 2024"},{"why":"Supplies AgentDyn, the harder benchmark with longer workflows used to measure transfer to unseen tools, tasks, and attack goals.","marker":"Li et al. 2026"},{"why":"Supplies AutoDojo, the adaptive black-box attack generator that produces the adaptive ASR and utility numbers.","marker":"Ma et al. 2026"},{"why":"Provides the frozen jina-embeddings-v3 encoder that computes the isolated and marginal-impact embeddings used by CAD.","marker":"Sturua et al. 2024"},{"why":"Covers the signed-gradient attack idea underlying the FGSM-style feature-space perturbations in the first AT variant.","marker":"Goodfellow, Shlens, and Szegedy 2015"},{"why":"Provides the random-start fast adversarial-training recipe that the feature-space AT procedure follows.","marker":"Wong, Rice, and Kolter 2020"},{"why":"Offers prior evidence that feature-space training can transfer to realizable attacks when appropriately constrained, motivating the paper's feature-space AT hypothesis.","marker":"Tong et al. 2019"},{"why":"Establishes that adaptive attacks bypass existing defenses, motivating the requirement that AT variants generalize beyond the training attack.","marker":"Nasr et al. 2025"}],"fun_headline_variants":["Context-aware filter blocks prompt injection with 0% success","Query-aware detector hits zero static prompt-injection success","CAD stops indirect injection: 0% static, low adaptive","New classifier: 0% attack success on static IPI, robust to evasion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on the assumption that a malicious instruction occupies a sentence of its own, so removing whole predicted-malicious sentences from the document removes the attack; if an attacker blends an instruction into an otherwise benign sentence, CAD cannot isolate it, a limitation the paper itself states in its conclusion.","fun_headline_variants_meta":{"raw":{"variants":["Context-aware filter blocks prompt injection with 0% success","Query-aware detector hits zero static prompt-injection success","CAD stops indirect injection: 0% static, low adaptive","New classifier: 0% attack success on static IPI, robust to evasion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000183,"raw_usage":{"total_tokens":1359,"prompt_tokens":1038,"completion_tokens":321,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":654,"completion_tokens_details":{"reasoning_tokens":249}},"tokens_in":654,"tokens_out":321,"duration_ms":3492,"temperature":1.0,"reasoning_tokens":249,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T13:12:47.984879+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Rewrite the injections in an agentic benchmark so that each instruction is embedded inside a benign sentence as a subordinate clause or parenthetical (preserving every literal value), run CAD with its published checkpoint under the adaptive AutoDojo evaluation, and compare attack success rate and clean utility against the paper's reported numbers; a large ASR increase with stable utility would show that the whole-sentence segmentation premise fails.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the AgentDojo benchmark and the three suites (Banking, Slack, Travel) that seed CAD's synthetic training data and its static evaluation."},{"cited_title":"J.; Shlens, J.; and Szegedy, C","cited_arxiv_id":null,"evidence_quote":"Covers the signed-gradient attack idea underlying the FGSM-style feature-space perturbations in the first AT variant."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the random-start fast adversarial-training recipe that the feature-space AT procedure follows."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Offers prior evidence that feature-space training can transfer to realizable attacks when appropriately constrained, motivating the paper's feature-space AT hypothesis."}],"review_version":1}