Pith. sign in

REVIEW 4 major objections 3 minor 54 references

AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection

T0 review · 4 major / 3 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Prompt-injection defenses miss attacks that obey the stated goal but cross a user's unstated boundary; AgentAntibody learns that boundary across encounters, cutting cumulative attack success from 35.0% to 6.1% over 80 attacks.

desk verdict Adaptive memory across encounters is a real contribution, but the headline margin rests on oracle-quality feedback and single runs; worth refereeing, not unconditional acceptance. read the letter →

arxiv 2608.04053 v1 pith:3NOLQRCD submitted 2026-08-04 cs.CR cs.AI

Shihao Weng , Yang Feng , Xiaofei Xie , Jiongchi Yu This is my paper · ORCID
classification cs.CRcs.AI
keywords promptinjectionLLMagentsadaptiveimmunitylatentuserboundaryantibodylibraryonlinelearningsecurityutilitytaskcompletion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Prompt-injection defenses usually treat each task in isolation, so they miss the attack that does not contradict the user's stated goal but crosses a boundary the user never stated, such as emailing an internal report to an outside address. The paper argues that defending such underspecified tasks requires memory of the user's latent boundary, and proposes AgentAntibody, a training-free defense that stores this memory as a persistent library of antibodies. Each antibody carries a transferable epitope, conditions that place the pattern relative to this user's boundary, and a targeted response such as sanitizing the affected content or asking for confirmation. After each encounter, action-level feedback matures existing antibodies or induces new ones. Across three benchmarks and four backbone LLMs, the paper reports that cold-start AgentAntibody reaches 81.1% macro SU-HM versus 36.6% for the best baseline, with cumulative attack success falling from 35.0% to 6.1% over 80 attacks.

What carries the argument

The load-bearing object is the antibody record $A=(d,\epsilon,H,N,\tau,r,q)$: a synopsis, an epitope, positive and exclusion conditions, a trigger threshold, a response, and maturation metadata. The epitope $\epsilon=(i,m,g)$ splits each behavior-shaping span into intent, mechanism, and goal impact so that structurally similar attacks transfer across paraphrases and new concrete entities. Matching is hierarchical: a fuzzy retrieval pass selects structural neighbors, and a fine judge scores coverage on the three epitope axes while the positive and exclusion predicates decide which side of the user's boundary the instance lies on; a match fires when $C(A,\alpha)=\frac{s_i+s_m+s_g}{3}\,G(A,\alpha)\ge\tau_A$. The matched response is targeted rather than a blanket refusal, and updates are attributed to the antibody that affected the action, checked for abstraction of concrete identifiers, and replayed on the labeled event before being committed.

What would settle it

A reader could rerun the online protocol with the benchmark oracle's labels perturbed, for example flipping 10% of Attack Success and False Positive labels or delaying every label by one encounter; if the cumulative attack success curve no longer falls from 35.0% to 6.1% by the 80th attack, the reported immunity gain depends on perfect immediate feedback rather than on the antibody mechanism itself.

Watch

Extended reading notes

Core claim

AgentAntibody's central claim is that the missing state in prompt-injection defense is not additional task context but a persistent operational model of the user's boundary between acceptable and unacceptable goal-compatible actions. It represents that boundary as a library of antibodies, each recording an abstract behavior pattern and the response that should follow, and it updates the library from attributed action-level outcomes rather than from task-level verdicts. The paper reports that this memory transfers across surface forms: after 80 attacks the cold-start library holds on average only 2.44 antibodies, yet 89.9% of later encounters reuse existing records, and security–utility performance improves on every evaluated benchmark, including a setting where the paper states nearly all prior defenses were insecure or severely over-defensive.

Load-bearing premise

The defense assumes that the user or an oracle supplies accurate, frequent, and stable labels of which actions were attack successes or false positives; if real feedback is sparse, noisy, delayed, or shifts over time, the antibody library will not converge and the reported attack-success reductions will not hold.

Editorial extensions

If this is right

  • If the reported numbers hold, an LLM agent can start with no prior knowledge of a user's boundary and still cut its residual attack success rate to single digits within an 80-task stream, using only a handful of stored patterns.
  • A small pre-seeded vaccine of common attack structures further reduces early exposure, so deployment can choose a trade-off between immediate coverage and adaptation cost.
  • Targeted responses mean that blocking one unsafe action need not destroy the rest of the task; the paper reports task-success preservation where low-ASR baselines sacrifice task completion.
  • The compactness of the learned library (2.44 antibodies on average) suggests the method generalizes by boundary pattern rather than accumulating attack strings, which is what makes transfer across encounters possible.
  • Because the defense is training-free and runs on a fixed low-cost model, the paper's cost measurements indicate the extra protection is compatible with a limited defense budget.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • (editorial inference) The same antibody mechanism could be applied to other latent-preference boundaries, such as data-sharing rules in email or calendar assistants, purchasing limits in shopping agents, or privacy norms in smart-home controllers, wherever action-level approval labels exist.
  • (editorial inference) The paper does not test cross-user transfer of learned antibodies; if boundary patterns are shared across users with similar roles, a library built for one user might bootstrap another, but user-specificity could also limit this.
  • (editorial inference) The authors mention confirmation as a response and as a route to boundary evidence but do not quantify how often the agent asks for confirmation or how quickly those answers accelerate convergence; measuring that cost would clarify real-world usability.
  • (editorial inference) An adaptive attacker who can observe which actions get blocked could try to mimic the benign-exclusion conditions stored in the library; stress-testing the contrastive predicates against such an adversary is a natural next step not addressed in the paper.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper proposes AgentAntibody, a runtime defense for LLM agents against indirect prompt injection. It maintains a persistent, user-specific antibody library that abstracts behavior-shaping spans into epitopes (intent, mechanism, goal impact), matches them through recall-oriented retrieval and contrastive fine matching, and applies targeted responses such as sanitization, action constraints, plan revision, or confirmation requests. Action-level Attack Success / False Positive feedback is attributed to the antibody whose response affected the action, and drives induction of new antibodies or maturation of existing ones, subject to validation, abstraction checks, and replay of the labeled event. Experiments on AgentDojo, AgentDyn, and a new LatentBoundaryBench across four LLM backbones report a macro SU-HM of 81.1% for cold-start AgentAntibody versus 36.6% for the best baseline, with cumulative ASR falling from 35.0% after five attacks to 6.1% after 80 attacks, using only 2.44 stored antibodies on average with 89.9% reuse.

Significance. If the reported results hold, the paper makes a useful contribution by identifying goal-compatible prompt injections that violate unstated user boundaries and by showing that persistent, transferable memory can protect against them while preserving utility. The design is clearly specified in Algorithm 1 and Supplementary A, the test-before-update protocol prevents same-episode credit, the ablations in Table 2 isolate the epitope and response components, and the AgentDojo/AgentDyn evaluations provide grounding outside the authors' own benchmark. I do not see a circularity problem: the update rules are a proposed mechanism rather than a fit to the evaluation metric. The main caveat is that the learning loop is evaluated under oracle-provided feedback, and all quantitative claims rest on single-run measurements; the magnitude of the reported advantage over non-adaptive baselines is therefore conditional on an idealized feedback channel.

major comments (4)
  1. [Supplementary E.2; §3.3] The headline learning result is conditional on oracle-quality labels. Supplementary E.2 states that the benchmark oracle provides at most ten explicit Attack Success and ten explicit False Positive labels per scenario, accurate and immediately available after scoring, while §3.3 specifies that induction occurs only after a user-confirmed AS and that FP updates are the only mechanism that narrows an overbroad antibody. No experiment varies label noise, delay, or budget, and BA evidence alone cannot induce new antibodies or detect overblocking. The Figure 4 trajectory (cumulative ASR 35.0% at N=5 to 6.1% at N=80) and the 81.1% versus 36.6% macro SU-HM therefore measure the method under an idealized feedback channel, not under the sparse, noisy, or delayed feedback that the 'learns the user's boundary' deployment argument assumes. Please add a sensitivity analysis over label noise, delay, and budget, and report the trajectory when only BA/self-supervised evidence is available.
  2. [§5.1, Table 1] There is an evaluation asymmetry between the adaptive method and the static baselines. AgentAntibody receives up to ten accurate AS labels and ten accurate FP labels per scenario through the benchmark oracle, while none of the baselines receives any post-case signal. The reported advantage may therefore reflect the privileged feedback channel rather than the antibody mechanism itself. The ablations in Table 2 remove epitopes, responses, and maturation, but none removes or degrades the oracle feedback. Add at least one control condition in which AgentAntibody runs without explicit labels (only BA evidence), or otherwise ablate feedback type and quantity, so that the incremental value of the persistent memory, rather than the oracle labels, is isolated.
  3. [§5.2, Table 1] All reported ASR, TSR, BU, and SU-HM values are single-run point estimates on stochastic LLM backbones. For example, on AgentDojo the cold-start AgentAntibody ASR ranges from 2.8% to 7.0% across backbones, and the advantage over MELON is sometimes only a few points; with 80-attack streams this could be within run-to-run variation. Report multiple seeds or bootstrap intervals for the main macro SU-HM values and for the cumulative ASR curves in Figure 4, so the magnitude of the claimed 81.1% versus 36.6% advantage can be assessed.
  4. [§4, Supplementary D] The new LatentBoundaryBench is authored and evaluated by the same team and is not released. Although the construction protocol is careful, with independent inspectors and a reported Cohen's κ of 0.740, the LBB cases drive a substantial part of the headline result (95.7% SU-HM on LBB versus 13.2% for the best baseline, and the macro average that includes LBB as one of three benchmarks). To support external validity, either release the benchmark so others can audit it, or provide results on an independently constructed latent-boundary evaluation, and in the meantime clearly separate claims that depend on LBB from claims that are supported by the external AgentDojo and AgentDyn results.
minor comments (3)
  1. [§3.2, §A.2] The values of the retrieval width n and the antibody-specific thresholds τ_A are never reported, and no sensitivity analysis is given for them; since these parameters control the operating point of the matching stage, a brief sensitivity table would help.
  2. [§5.3] The claim that the reuse pattern is 'inconsistent with case-by-case accumulation' is qualitative; defining the reuse rate formally alongside SU-HM in Supplementary E.3 would make this quantitative and reproducible.
  3. [Reproducibility] The paper does not state whether the code and the LatentBoundaryBench data will be released; providing them would materially aid reproducibility, especially because LBB is a new artifact.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: AgentAntibody's adaptive-learning claim is evaluated on future encounters via a test-before-update protocol against external benchmarks, and the only self-citation (ARGUS) is non-load-bearing related work.

full rationale

AgentAntibody's central claim—that a persistent antibody library updated from action-level AS/FP feedback reduces future attack success—is an online-learning claim, and the evaluation protocol prevents the updates from directly forcing the measured outcome. Supplementary E.2 states: 'For episode t, the current library L_t is frozen while the defense scans the external content, the task agent acts under the resulting response plan, and the benchmark scores attack success and task success. Only after these outcomes are recorded may feedback update the library' and 'No case is rescored or replayed after its update.' Thus the reported ASR, TSR, and SU-HM improvements are computed on held-out future encounters, not on the labeled events that drove the updates. The antibody parameters are fit from user labels, but the predicted quantities are not defined in terms of those same labels; no equation in the paper reduces a predicted result to a fitted parameter. The validator's requirement that 'an induced antibody must recognize the confirmed miss' is an internal consistency check on the accepted delta, not a prediction. The only self-citation, ARGUS (Weng et al. 2026), appears in the introduction and related work as a prior defense to contrast with, and it is not load-bearing for any premise, uniqueness claim, or ansatz in this paper. Evaluation against the external AgentDojo and AgentDyn benchmarks, plus the LBB ablation study, provides independent grounding for the mechanism. The reliance on an oracle supplying accurate, immediate AS/FP labels (at most ten per type per scenario) is a deployment-environment assumption: sparse, noisy, or delayed feedback would weaken the transfer claim, but it is not an internal circularity because the method's success metric is not defined in terms of that label stream. Overall, no circular step is exhibited, and the only mild self-citation concern does not affect the derivation chain.

Assumptions & free parameters 2 free parameters · 4 assumptions · 1 invented entities

The ledger contains no fitted numeric constants that directly generate the headline results, but the method rests on several domain assumptions about label availability, epitope stability, and the existence of stable user boundaries. The only invented conceptual entity is the latent boundary bu itself.

free parameters (2)
  • retrieval width n
    Hand-set structural-neighbor count in hierarchical matching; no sensitivity analysis is reported.
  • antibody threshold tau_A
    Per-antibody threshold set by vaccine authors or induction; no sensitivity analysis is reported.
assumptions (4)
  • domain assumption The latent user boundary bu is stable across encounters and is recoverable from action-level labels.
    Section 3.1 defines bu and Section 3.3 updates the library only from labeled outcomes. If the boundary drifts or labels are unreliable, the memory cannot converge.
  • domain assumption The fixed GPT-4o-mini defense model reliably projects behavior-shaping spans into consistent intent, mechanism, and goal-impact epitopes across paraphrases.
    Prompt 1 in Supplement A.5 performs this projection; transfer and maturation depend on stable epitopes.
  • domain assumption Simulated oracle feedback is a faithful proxy for real user feedback.
    Supplementary E.2 limits to 10 AS and 10 FP labels per scenario and uses an oracle. If real feedback is noisier or sparser, the reported learning curve overstates deployable performance.
  • domain assumption Goal-compatible but boundary-violating requests are a distinct and common attack class.
    Figure 1 and Section 1 introduce this as the motivating gap; LBB is designed around it. This assumption sets up the benchmark and is not independently established.
invented entities (1)
  • latent user boundary bu
    purpose: Unstated rule that determines which goal-compatible actions a user permits; the object the defense learns.
    It is defined abstractly in Section 3.1 and operationalized only through the paper's LBB oracle and update labels; no external measurement or falsifiable prediction outside the paper is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection." pith.science (2026). https://pith.science/paper/3NOLQRCD

@misc{pith2026260804053,
  author       = {Pith},
  title        = {Pith review of: AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3NOLQRCD}},
  note         = {Machine review of arXiv:2608.04053}
}
read the original abstract

Prompt injection remains a critical threat to LLM agents, yet existing defenses treat each task as a self-contained problem, independent of previous encounters. In practice, user requests are often underspecified: they describe the desired outcome without fully specifying acceptable behavior. An injection can exploit this ambiguity, causing the agent to complete the task in a way the user would reject. As the user's expectations become clearer through concrete cases, a defense should learn from each encounter and apply what it learns to the next. Inspired by adaptive immunity, we propose AgentAntibody, which equips LLM agents with a self-evolving immune system against prompt injection. AgentAntibody represents its evolving understanding of the user's security boundary as a persistent library of antibodies. At runtime, the library recognizes threats to this boundary and mounts corresponding immune responses. Across encounters, it evolves to strengthen the agent's immunity to future attacks. Extensive experiments across three benchmarks and four backbone LLMs show that, by learning the user's boundary through experience, AgentAntibody outperforms existing defenses in preventing harmful actions while preserving legitimate task completion, even when the harmful and legitimate actions are both compatible with the stated task.

Figures

Figures reproduced from arXiv: 2608.04053 by the authors.

Figure 1
Figure 1. Comparison of prompt-injection threat models. (a) [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of AgentAntibody. Runtime epitope matching triggers targeted defenses, while action-level evidence matures existing antibodies or induces new ones, enabling the antibody library to evolve through use. boundary by bu. It is not fully observable from one task or one prompt. AgentAntibody treats its antibody library Lt as its cur￾rent operational model of bu, built from boundary evidence learned by time t. The… view at source ↗
Figure 3
Figure 3. LBB pairs goal compatible requests on opposite [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: SU-HM (%) across benchmarks, macro-averaged over four task-agent backbones. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: API cost of the final main-table runs, totaling $272.2. Defense costs exclude agent inference. InjecGuard uses local [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 21 canonical work pages

  1. [1]

    Proceedings of the 16th ACM workshop on artificial intelligence and security , pages=

    Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection , author=. Proceedings of the 16th ACM workshop on artificial intelligence and security , pages=

  2. [2]

    arXiv preprint arXiv:2310.12815 , year=

    Formalizing and benchmarking prompt injection attacks and defenses , author=. arXiv preprint arXiv:2310.12815 , year=

    arXiv

  3. [3]

    Advances in Neural Information Processing Systems , volume=

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents , author=. Advances in Neural Information Processing Systems , volume=

  4. [4]

    2023 , publisher=

    How to do things with words , author=. 2023 , publisher=

    work page 2023

  5. [5]

    1979 , publisher=

    Expression and meaning: Studies in the theory of speech acts , author=. 1979 , publisher=

    work page 1979

  6. [6]

    Cognitive linguistics: Basic readings , volume=

    Frame semantics , author=. Cognitive linguistics: Basic readings , volume=

    work page

  7. [7]

    COLING 1998 Volume 1: The 17th International Conference on Computational Linguistics , year=

    The berkeley framenet project , author=. COLING 1998 Volume 1: The 17th International Conference on Computational Linguistics , year=

    1998

  8. [8]

    Computational linguistics , volume=

    Automatic labeling of semantic roles , author=. Computational linguistics , volume=

    work page

Show all 54 references
  1. [9]

    arXiv preprint arXiv:2602.10453 , year=

    The landscape of prompt injection threats in llm agents: From taxonomy to analysis , author=. arXiv preprint arXiv:2602.10453 , year=

  2. [10]

    arXiv preprint arXiv:2605.03378 , year=

    ARGUS: Defending LLM agents against context-aware prompt injection , author=. arXiv preprint arXiv:2605.03378 , year=

    arXiv

  3. [11]

    arXiv preprint arXiv:2605.17324 , year=

    ASPI: Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents , author=. arXiv preprint arXiv:2605.17324 , year=

    arXiv

  4. [12]

    arXiv preprint arXiv:2605.17634 , year=

    AI agents may always fall for prompt injections , author=. arXiv preprint arXiv:2605.17634 , year=

    arXiv

  5. [13]

    arXiv preprint arXiv:2603.30016 , year=

    Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks , author=. arXiv preprint arXiv:2603.30016 , year=

  6. [14]

    , author=

    A modification of Jerne's theory of antibody production using the concept of clonal selection. , author=

  7. [15]

    Cell , volume=

    MHC-dependent antigen processing and peptide presentation: providing ligands for T lymphocyte activation , author=. Cell , volume=. 1994 , publisher=

    1994

  8. [16]

    Nature reviews immunology , volume=

    Towards a systems understanding of MHC class I and MHC class II antigen presentation , author=. Nature reviews immunology , volume=. 2011 , publisher=

    2011

  9. [17]

    2001 , publisher=

    Immunobiology , author=. 2001 , publisher=

    2001

  10. [18]

    Nature Reviews Immunology , volume=

    Fc receptors as regulators of immune responses , author=. Nature Reviews Immunology , volume=. 2008 , publisher=

    2008

  11. [19]

    arXiv preprint arXiv:2403.14720 , year=

    Defending against indirect prompt injection attacks with spotlighting , author=. arXiv preprint arXiv:2403.14720 , year=

    arXiv

  12. [20]

    Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V

    Benchmarking and defending against indirect prompt injection attacks on large language models , author=. Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1 , pages=

  13. [21]

    Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents , author=. Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    2024

  14. [22]

    International Conference on Learning Representations , volume=

    Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents , author=. International Conference on Learning Representations , volume=

  15. [23]

    arXiv preprint arXiv:2404.13208 , year=

    The instruction hierarchy: Training llms to prioritize privileged instructions , author=. arXiv preprint arXiv:2404.13208 , year=

    arXiv

  16. [24]

    34th USENIX Security Symposium (USENIX Security 25) , pages=

    \ StruQ \ : Defending against prompt injection with structured queries , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=

  17. [25]

    arXiv preprint arXiv:2410.05451 , year=

    Secalign: Defending against prompt injection with preference optimization , author=. arXiv preprint arXiv:2410.05451 , year=

    arXiv

  18. [26]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    PIGuard: Prompt injection guardrail via mitigating overdefense for free , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  19. [27]

    arXiv preprint arXiv:2505.06311 , volume=

    Defending against indirect prompt injection by instruction detection , author=. arXiv preprint arXiv:2505.06311 , volume=

  20. [28]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  21. [29]

    arXiv preprint arXiv:2503.18813 , year=

    Defeating prompt injections by design , author=. arXiv preprint arXiv:2503.18813 , year=

    arXiv

  22. [30]

    Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    Ipiguard: A novel tool dependency graph-based defense against indirect prompt injection in llm agents , author=. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    2025

  23. [31]

    arXiv preprint arXiv:2603.10749 , year=

    AttriGuard: Defeating indirect prompt injection in LLM agents via causal attribution of tool invocations , author=. arXiv preprint arXiv:2603.10749 , year=

    arXiv

  24. [32]

    arXiv preprint arXiv:2605.15030 , year=

    WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections , author=. arXiv preprint arXiv:2605.15030 , year=

    arXiv

  25. [33]

    Advances in Neural Information Processing Systems , volume=

    Personalized safety in llms: A benchmark and a planning-based agent approach , author=. Advances in Neural Information Processing Systems , volume=

  26. [34]

    Advances in neural information processing systems , volume=

    Reflexion: Language agents with verbal reinforcement learning , author=. Advances in neural information processing systems , volume=

  27. [35]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Expel: Llm agents are experiential learners , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  28. [36]

    arXiv preprint arXiv:2607.14611 , year=

    Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems , author=. arXiv preprint arXiv:2607.14611 , year=

    arXiv

  29. [37]

    arXiv preprint arXiv:2606.04329 , year=

    From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents , author=. arXiv preprint arXiv:2606.04329 , year=

    arXiv

  30. [38]

    Proceedings of 1994 IEEE computer society symposium on research in security and privacy , pages=

    Self-nonself discrimination in a computer , author=. Proceedings of 1994 IEEE computer society symposium on research in security and privacy , pages=. 1994 , organization=

    1994

  31. [39]

    Evolutionary computation , volume=

    Architecture for an artificial immune system , author=. Evolutionary computation , volume=. 2000 , publisher=

    2000

  32. [40]

    arXiv preprint arXiv:2605.19328 , year=

    RoboJailBench: Benchmarking adversarial attacks and defenses in embodied robotic agents , author=. arXiv preprint arXiv:2605.19328 , year=

    arXiv

  33. [41]

    Advances in Neural Information Processing Systems , volume=

    Drift: Dynamic rule-based defense with injection isolation for securing llm agents , author=. Advances in Neural Information Processing Systems , volume=

  34. [42]

    arXiv preprint arXiv:2502.05174 , year=

    Melon: Provable defense against indirect prompt injection attacks in ai agents , author=. arXiv preprint arXiv:2502.05174 , year=

    arXiv

  35. [43]

    arXiv preprint arXiv:2602.03117 , year=

    Agentdyn: Are your agent security defenses deployable in real-world dynamic environments , author=. arXiv preprint arXiv:2602.03117 , year=

    arXiv

  36. [44]

    Advances in Neural Information Processing Systems , volume=

    Wasp: Benchmarking web agent security against prompt injection attacks , author=. Advances in Neural Information Processing Systems , volume=

  37. [45]

    Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    Webinject: Prompt injection attack to web agents , author=. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    2025

  38. [46]

    Advances in Neural Information Processing Systems , volume=

    Continual learning for instruction following from realtime feedback , author=. Advances in Neural Information Processing Systems , volume=

  39. [47]

    arXiv preprint arXiv:1909.12434 , year=

    Learning the difference that makes a difference with counterfactually-augmented data , author=. arXiv preprint arXiv:1909.12434 , year=

    1909 arXiv

  40. [48]

    Nature Reviews Immunology , volume=

    A guide to adaptive immune memory , author=. Nature Reviews Immunology , volume=. 2024 , publisher=

    2024

  41. [49]

    Advances in Neural Information Processing Systems , volume=

    Privacylens: Evaluating privacy norm awareness of language models in action , author=. Advances in Neural Information Processing Systems , volume=

  42. [50]

    Advances in Neural Information Processing Systems , volume=

    Memory injection attacks on LLM agents via query-only interaction , author=. Advances in Neural Information Processing Systems , volume=

  43. [51]

    Advances in Neural Information Processing Systems , volume=

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases , author=. Advances in Neural Information Processing Systems , volume=

  44. [52]

    Advances in neural information processing systems , volume=

    Cooperative inverse reinforcement learning , author=. Advances in neural information processing systems , volume=

  45. [53]

    Advances in Neural Information Processing Systems , volume=

    Capturing individual human preferences with reward features , author=. Advances in Neural Information Processing Systems , volume=

  46. [54]

    2026 , howpublished=

    Introducing. 2026 , howpublished=

    2026

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.