Pith. sign in

REVIEW 6 minor 33 references

A terminal security label is not enough to judge post-injection containment; equal zero-harm endpoints can hide both severe over-blocking of authorized work and stage-sensitive differences in how far untrusted influence spreads.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-07-31 23:17 UTC pith:33KRNPGF

load-bearing objection A solid, carefully scoped benchmark paper that makes a real measurement point—endpoint-only scores hide trajectory and utility differences—supported by a frozen, well-controlled study; the caveats are single-model and synthetic workflows, both admitted.

arxiv 2607.23999 v2 pith:33KRNPGF submitted 2026-07-27 cs.CR

ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents

Wenhao Lan , Shan Li , Xinhua Lai , Meiqi Wu , Junbin Yang , Haihua Shen This is my paper
classification cs.CR
keywords prompt injectionLLM agentscontainmenttrace-based evaluationtaint trackingauthorization ledgerendpoint insufficiencyruntime enforcement
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Tool-using LLM agents can be redirected by untrusted content they read, and existing benchmarks judge the damage by the final outcome: did the injection cause an unauthorized commit? This paper argues that the final endpoint is not enough. It introduces a trace-based benchmark that separately records endpoint policy compliance, logged influence spread, recovery behavior, and whether authorized work over external content still gets done. In a frozen 17,640-rollout study, all 600 matched policy pairs had the same zero-committed-harm outcome, yet 73.5% diverged in logged trajectory or utility; a taint-only firewall that looked secure completed only 16% of authorized tainted workflows, while an intent-ledger policy reached 86%. The paper concludes that containment is a trajectory property, and evaluations should report endpoint, stage-stratified path, and utility evidence separately.

Core claim

The paper's central claim is that a terminal policy label is not a sufficient statistic for operational post-exposure containment. Using a sandboxed benchmark that logs every message, tool proposal, memory write, authorization decision, and commit as a directed trace graph, it shows that two runtime policies can produce identical zero-violation endpoints while differing sharply in how far untrusted influence traveled and how much authorized work was blocked. In the matched active-tainted comparison, taint-only enforcement and intent-aware authorization both ended with zero committed harm, but 73.5% of the 600 pairs differed on the shared trajectory projection or utility, with authorized comp

What carries the argument

The central object is the logged trace graph Gτ with nodes for sources, messages, tools, memory, authorization decisions, and commits, and the taint closure Tτ defined as reachability over taint-propagating edges only. On top of this, the benchmark separates four measurement axes: endpoint policy compliance, instrumented logged propagation (normalized blast radius), recovery instrumentation, and authorized structured-action completion. The intent-ledger policy adds a representation Is = {(a,t,φ)} of authorized actions, targets, and argument predicates, with an exact-match authorization predicate that blocks tainted authority expansion while allowing tainted content inside an authorized actio

Load-bearing premise

The trajectory and spread results assume the logged taint labels capture every semantically relevant path of untrusted influence; if paraphrased or implicit influence bypasses the instrumentation, logged spread and divergence measure logging coverage rather than containment.

What would settle it

Run the frozen 17,640-rollout protocol with an independent semantic/causal auditor applied to the same traces; if the 73.5% outcome-conditioned divergence rate largely disappears when implicit influence is counted, the trajectory-insufficiency claim would collapse. Alternatively, perturb the structured ledger with omissions or over-authorizations; if the utility repair vanishes or endpoint violations appear, the policy case study would be overturned.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A defense that reports zero committed violations can still be harmful in deployment if it blocks most authorized work that legitimately uses external content.
  • Containment evaluations should report at least endpoint, stage-stratified trajectory, and utility evidence as separate numbers, not one aggregate score.
  • Aggregate logged-spread rankings are only meaningful with fixed evidence-stage composition and denominator; the same policies can trade places under different normalizations.
  • A trusted structured ledger can repair over-blocking without lowering the observed security endpoint, but may still sit below a simpler tool-boundary policy on utility.
  • Recovery-related metrics (secret leakage, memory reinfection, rollback superiority) should only be used comparatively once a no-defense positive control shows they can discriminate.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the trace-completeness limitation were fixed, for example by pairing online labels with an offline semantic/causal audit, the same benchmark could estimate how much implicit, paraphrased influence currently escapes the taint labels.
  • The endpoint-insufficiency principle likely extends beyond prompt injection to any agent safety evaluation where a blocker can mask failures; the four-axis separation could serve as a template for content-safety and tool-use audits.
  • The intent-ledger result suggests a testable design target: a runtime policy that combines tool-boundary checks with field-level provenance might reach both the 0.92 utility of the boundary baseline and lower spread, a hypothesis the current data does not resolve.
  • Because the full study is single-model and synthetic, the natural next experiment is to run the same frozen protocol on additional models and on an external dynamic task environment once positive controls hold.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 6 minor

Summary. ContainmentBench proposes a trace-based evaluation protocol for post-exposure containment in tool-using LLM agents, decomposing containment into four observables: benchmark-defined endpoint policy compliance, instrumented logged propagation, recovery instrumentation, and authorized structured-action completion. In a pre-specified, hashed 17,640-rollout study with Qwen2.5-7B-Instruct, the paper reports that all 600 matched active-tainted pairs under a taint-only firewall (v1) and an intent-ledger firewall (v2) share the same zero committed-harm endpoint, yet 441/600 (73.5%) differ on the logged-trajectory or utility axes; authorized tainted-action completion is 0.1642 for v1 versus 0.8567 for v2 (scenario-cluster paired delta 0.6925, 95% CI [0.6160, 0.7637]), with a strong tool-boundary baseline at 0.9233. A third finding is that aggregate logged-spread rankings are stage- and denominator-sensitive. The paper concludes that a terminal policy label is not a sufficient statistic for operational post-exposure containment and recommends reporting endpoint, stage-stratified trajectory, and utility evidence separately. The full-scale evidence is explicitly scoped as synthetic, single-model, and, for the policy case study, conditional on a correct structured authorization ledger.

Significance. The central claim is well supported and, if adopted, would change evaluation practice: endpoint-equivalent policies can differ sharply on authorized utility and on logged trajectory, and propagation comparisons are only interpretable when stage composition and denominators are fixed or stratified. The paper's strengths should be credited explicitly: the evaluation is pre-registered in the frozen, hashed configuration; the no-defense condition supplies a nonzero positive control in the security stage (0.3354) and in the active-tainted stage; parser-repair diagnostics with invalid-tool non-execution close a measurement-validity gap; inference uses paired and scenario-cluster bootstraps; the authors explicitly decline to make comparative claims from non-discriminative endpoints (secret leakage, memory reinfection, rollback); and the artifact includes integrity checks and smoke reproduction. The outcome-conditioned design is notably direct: endpoint equality holds for every matched pair in Table 10, so the divergence numbers are not an artifact of subset selection. The claim is falsifiable, and its main evidentiary weight is carried by the utility axis, which does not depend on taint-l

minor comments (6)
  1. [§7.1, Table 10] The headline 73.5% trajectory divergence for the v1/v2 contrast coincides exactly with the utility divergence (intersection = union = 441/600). As presented, the trajectory axis adds no independent information in this particular contrast; the independent trajectory evidence comes from the tool-boundary/v2 rows (16.23% all-stage; 5.10% security-stage), where utility is tied or differs far less. The coincidence is disclosed in the text, but I suggest making the evidentiary division of labor explicit, and optionally reporting divergence among utility-outcome-matched pairs, so that the four-axis decomposition is not read as crediting the trajectory axis with independent detection in the headline number.
  2. [§3.5, §4.4] The trajectory-divergence and logged-spread statistics are defined over logged taint-propagating edges, and §3.5 concedes that paraphrased or implicit influence can be under-counted. Since the headline 73.5% divergence is partly computed from taint-derived projection fields, state explicitly that the measured divergence is a lower bound under incomplete logging, and that the utility leg (0.1642 vs 0.8567) is the logging-independent carrier of the endpoint-insufficiency claim. This would preempt the natural objection that the spread/trajectory rankings reflect logging coverage rather than containment differences.
  3. [§6.1, Table 22, §8.4] All full-scale operating points come from Qwen2.5-7B-Instruct; the Mistral diagnostic cannot carry a policy comparison because parse failure remains 0.63–0.66. The scope statements in §3.7 and §8.4 cover this, but the conclusion re-states the three findings without reminding the reader that the concrete values (0.1642/0.8567/0.9233) are single-model, synthetic-scenario measurements, whereas the measurement claim is protocol-level. One sentence in the conclusion echoing the abstract's scope would harden that boundary.
  4. [Table 26] The seed-variance table reports 'Std.' and 'Range' columns with dashes for the security, memory/recovery, and clean rows. Specify whether those dashes mean 'not computed', 'all seeds identical', or 'omitted as non-applicable', since this table is the main evidence that the headline results are not dominated by a single rollout seed.
  5. [Fig. 2] Figure 2's bars have no y-axis label or gridlines. Adding a labeled y axis (completion proportion) would make the figure legible without forcing the reader to cross-reference Table 11.
  6. [§6.3, Tables 17–19] The two adaptive artifacts (no-defense-optimized transfer diagnostic and target-preserving qualification) serve different protocol roles and support different claims. Consider adding a one-row-per-diagnostic table that maps each artifact to its optimization target, evaluation condition, and the claim it is permitted to support, since Tables 17–19 are easy to conflate.

Circularity Check

0 steps flagged

No significant circularity: the central endpoint-insufficiency claim is carried by independent utility and outcome-conditioned trajectory evidence, not by definitional identity or fitted-value recycling.

full rationale

ContainmentBench fits no parameters and then predicts them back; every headline quantity is a benchmark-defined observable measured from frozen rollouts with explicit positive controls (no-defense committed-violation rate 0.3354) and scope restrictions. The central claim that equal terminal endpoints can conceal severe over-blocking is supported by matched-pair utility differences (v1 0.1642 vs v2 0.8567, delta 0.6925, scenario-cluster CI [0.6160, 0.7637]) and by the tool-boundary vs v2 comparison (delta -0.0667, CI [-0.1167, -0.0250]); neither comparison reduces by construction to the conclusion. The taint-only v1 policy is admittedly a designed security-biased ablation, but the paper uses it as a controlled case study to validate the benchmark's discriminative power, explicitly scopes it in Table 8 as a failure-driven ablation, and disclaims superiority. Eq. (4) deliberately separates logged taint-propagating edges from full structural reachability and even states that conflating them would make normalized spread tautological, so the metric definition avoids the very circularity it names. The acknowledged limitations—operational taint labels can under-count implicit semantic influence, and the intent ledger is an oracle-policy assumption—are stated as conditional scoping (Sec. 3.5, Sec. 5.3, Sec. 8.4) rather than hidden inputs presented as results. There is no load-bearing self-citation: the related-work citations are external, and no uniqueness theorem or ansatz is imported from the authors' prior work. Therefore no circular step meets the quoted-reduction standard; the honest finding is no significant circularity.

Axiom & Free-Parameter Ledger

0 free parameters · 3 axioms · 0 invented entities

The central empirical claim rests on three domain assumptions: oracle-grade intent-ledger correctness, log completeness for taint propagation, and benchmark-local definitions of harm/utility. No new physical entities or fitted constants are introduced. The intent ledger is a system component, not an invented entity in the sense of a new postulated force or particle.

axioms (3)
  • domain assumption The trusted intent ledger for each scenario is correct, i.e., derived from the scenario's authorization metadata without error.
    Section 5.3 assumes a correct structured intent ledger for the policy case study; ledger-construction errors are future work. If the ledger omits or over-authorizes actions, v2's utility and security results change.
  • domain assumption Logged taint-propagating edges in Eq. (2) capture the influence that matters; unlogged or paraphrased influence is negligible.
    Section 3.5 states Eq. (2) is an instrumentation definition, not a semantic proof. If logging misses true taint-propagating edges, blast-radius metrics under-count propagation and trajectory-divergence rates become logging-coverage artifacts.
  • domain assumption Benchmark-defined committed_harm and structured benign-success checks are valid proxies for real security and utility.
    Section 4.4 uses benchmark-local canaries and allowlists; external validity is untested. The paper explicitly scopes its claims to this synthetic environment.

pith-pipeline@v1.3.0-alltime-deepseek · 22987 in / 7691 out tokens · 71352 ms · 2026-07-31T23:17:06.444049+00:00 · methodology

0 comments
read the original abstract

Tool-using LLM agents process untrusted content, maintain memory, delegate across agents, and invoke side-effecting tools. Existing prompt-injection evaluations typically summarize security with terminal attack or policy outcomes, but equal endpoints can conceal different post-exposure traces and different losses of authorized utility. We introduce ContainmentBench, a sandboxed, trace-based benchmark that separately measures benchmark-defined endpoint policy compliance, instrumented logged propagation, recovery instrumentation, and authorized structured-action completion. In a pre-specified 17,640-rollout study with Qwen2.5-7B-Instruct, all 600 matched active-tainted pairs comparing taint-only and intent-aware enforcement have the same zero committed-harm outcome, yet 73.5% differ in logged trajectory or utility. Taint-only enforcement completes only 0.1642 of authorized tainted workflows; a trusted-ledger policy raises completion to 0.8567, while a strong tool-boundary baseline reaches 0.9233 under the same observed endpoint-policy outcomes. We also find that aggregate logged-spread rankings change with evidence-stage composition and denominator choice. These results show that a terminal policy label is not a sufficient statistic for operational post-exposure containment; evaluations should report endpoint, stage-stratified trajectory, and utility evidence separately, and should promote recovery evidence to comparative claims only where the corresponding controls are valid. The full-scale study is synthetic and single-model; the policy case additionally assumes a correct structured authorization ledger.

Figures

Figures reproduced from arXiv: 2607.23999 by Haihua Shen, Junbin Yang, Meiqi Wu, Shan Li, Wenhao Lan, Xinhua Lai.

Figure 1
Figure 1. Figure 1: Threat model and taint/intent graph. The figure emphasizes the distinction between untrusted influence and user-authorized [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Failure-driven repair from taint-only containment to intent-ledger containment. [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Authorized tainted-action completion. Endpoint-safe policies can differ sharply in their ability to complete authorized work [PITH_FULL_IMAGE:figures/full_fig_p015_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Supplementary endpoint-policy and logged-spread operating points. The coincident zero-endpoint points illustrate why the [PITH_FULL_IMAGE:figures/full_fig_p020_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Supplementary strong-baseline operating points. The mixed observables are retained for artifact completeness; the main text [PITH_FULL_IMAGE:figures/full_fig_p020_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Memory and recovery instrumentation. All-zero reinfection and tied recovery identify where a stronger positive control is [PITH_FULL_IMAGE:figures/full_fig_p021_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Artifact and external-compatibility pipeline. [PITH_FULL_IMAGE:figures/full_fig_p021_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

33 extracted references · 26 linked inside Pith

  1. [1]

    Sahar Abdelnabi, Aideen Fay, Ahmed Salem, Egor Zverev, Kai-Chieh Liao, Chi-Huang Liu, Chun-Chih Kuo, Jannis Weigend, Danyael Manlangit, Alex Apostolov, et al. 2025. LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge. arXiv preprint arXiv:2506.09956. https://arxiv.org/abs/2506.09956

    Pith/arXiv arXiv 2025

  2. [2]

    Barrett, Krystal Jackson, Evan R

    Anthony M. Barrett, Krystal Jackson, Evan R. Murphy, Nada Madkour, and Jessica Newman. 2024. Benchmark Early and Red Team Often: A Framework for Assessing and Managing Dual-Use Hazards of AI Foundation Models. arXiv preprint arXiv:2405.10986. https://arxiv.org/abs/2405.10986

    Pith/arXiv arXiv 2024

  3. [3]

    Yuandao Cai, Wensheng Tang, Cheng Wen, and Shengchao Qin. 2026. Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents. arXiv preprint arXiv:2604.23374. https://arxiv.org/abs/2604.23374

    Pith/arXiv arXiv 2026

  4. [4]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2024. JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models. arXiv preprint arXiv:2404.01318. https://arxiv.org/abs/2404.01318

    Pith/arXiv arXiv 2024

  5. [5]

    Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. 2024. StruQ: Defending Against Prompt Injection with Structured Queries. arXiv preprint arXiv:2402.06363. https://arxiv.org/abs/2402.06363

    Pith/arXiv arXiv 2024

  6. [6]

    Sizhe Chen, Arman Zharmagambetov, Saeed Mahloujifar, Kamalika Chaudhuri, David Wagner, and Chuan Guo. 2024. SecAlign: Defending Against Prompt Injection with Preference Optimization. arXiv preprint arXiv:2410.05451. https://arxiv.org/abs/2410.05451

    Pith/arXiv arXiv 2024

  7. [7]

    Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. 2025. Securing AI Agents with Information-Flow Control. arXiv preprint arXiv:2505.23643. https://arxiv.org/abs/2505.23643

    Pith/arXiv arXiv 2025

  8. [8]

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. 2025. Defeating Prompt Injections by Design. arXiv preprint arXiv:2503.18813. https://arxiv.org/abs/2503.18813

    Pith/arXiv arXiv 2025

  9. [9]

    Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. arXiv preprint arXiv:2406.13352. https://arxiv.org/abs/2406.13352

    Pith/arXiv arXiv 2024

  10. [10]

    Runpeng Geng, Chenlong Yin, Yanting Wang, Ying Chen, and Jinyuan Jia. 2026. PIArena: A Platform for Prompt Injection Evaluation. arXiv preprint arXiv:2604.08499. https://arxiv.org/abs/2604.08499

    Pith/arXiv arXiv 2026

  11. [11]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv preprint arXiv:2302.12173. https://arxiv.org/abs/ 2302.12173

    Pith/arXiv arXiv 2023

  12. [12]

    Paul Groth and Luc Moreau. 2013. PROV-Overview: An Overview of the PROV Family of Documents. W3C Working Group Note. https: //www.w3.org/TR/prov-overview/

    2013

  13. [13]

    Lipeng He, Yihan Wang, Jiawen Zhang, and N. Asokan. 2026. Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment. arXiv preprint arXiv:2606.15441. https://arxiv.org/abs/2606.15441

    arXiv 2026

  14. [14]

    Yu He, Haozhe Zhu, Yiming Li, Shuo Shao, Hongwei Yao, Zhihao Liu, and Zhan Qin. 2026. AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations. arXiv preprint arXiv:2603.10749. https://arxiv.org/abs/2603.10749

    Pith/arXiv arXiv 2026

  15. [15]

    Feiran Jia, Tong Wu, Xin Qin, and Anna Squicciarini. 2024. The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents. arXiv preprint arXiv:2412.16682. https://arxiv.org/abs/2412.16682

    Pith/arXiv arXiv 2024

  16. [16]

    Tanqiu Jiang, Yuhui Wang, Jiacheng Liang, and Ting Wang. 2026. AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks. arXiv preprint arXiv:2602.16901. https://arxiv.org/abs/2602.16901

    arXiv 2026

  17. [17]

    Mintong Kang, Chong Xiang, Sanjay Kariyappa, Chaowei Xiao, Bo Li, and Edward Suh. 2025. Mitigating Indirect Prompt Injection via Instruction- Following Intent Analysis. arXiv preprint arXiv:2512.00966. https://arxiv.org/abs/2512.00966

    arXiv 2025

  18. [18]

    Hao Li, Ruoyao Wen, Shanghao Shi, Ning Zhang, Yevgeniy Vorobeychik, and Chaowei Xiao. 2026. AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments? arXiv preprint arXiv:2602.03117. https://arxiv.org/abs/2602.03117

    Pith/arXiv arXiv 2026

  19. [19]

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and Benchmarking Prompt Injection Attacks and Defenses. In33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 1831–1847. https://www.usenix.org/ conference/usenixsecurity24/presentation/liu-yupei 28 Lan et al

    2024

  20. [20]

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. InProceedings of the 41st International Conference on Machine Learning (Proceedings of Machine Learni...

    2024

  21. [21]

    Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav, Sahar Abdelnabi, Vyas Raina, Ivaxi Sheth, and Mario Fritz. 2026. Hidden in Memory: Sleeper Memory Poisoning in LLM Agents. arXiv preprint arXiv:2605.15338. https://arxiv.org/abs/2605.15338

    Pith/arXiv arXiv 2026

  22. [22]

    Nanda Rani and Christian Rossow. 2026. On the Security of Research Artifacts. arXiv preprint arXiv:2605.06508. https://arxiv.org/abs/2605.06508

    Pith/arXiv arXiv 2026

  23. [23]

    Paul Roettger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2023. XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models. arXiv preprint arXiv:2308.01263. https://arxiv.org/abs/2308.01263

    Pith/arXiv arXiv 2023

  24. [24]

    Toby Shevlane, Sebastian Farquhar, Ben Garfinkel, Mary Phuong, Jess Whittlestone, Jade Leung, Daniel Kokotajlo, Nahema Marchal, Markus Anderljung, Noam Kolt, et al. 2023. Model Evaluation for Extreme Risks. arXiv preprint arXiv:2305.15324. https://arxiv.org/abs/2305.15324

    Pith/arXiv arXiv 2023

  25. [25]

    Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. 2025. Progent: Securing AI Agents with Privilege Control. arXiv preprint arXiv:2504.11703. https://arxiv.org/abs/2504.11703

    Pith/arXiv arXiv 2025

  26. [26]

    Shoaib Ahmed Siddiqui, Radhika Gaonkar, Boris Köpf, David Krueger, Andrew Paverd, Ahmed Salem, Shruti Tople, Lukas Wutschitz, Menglin Xia, and Santiago Zanella-Béguelin. 2024. Permissive Information-Flow Analysis for Large Language Models. arXiv preprint arXiv:2410.03055. https://arxiv.org/abs/2410.03055

    arXiv 2024

  27. [27]

    Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. 2024. A StrongREJECT for Empty Jailbreaks. arXiv preprint arXiv:2402.10260. https://arxiv.org/abs/2402.10260

    Pith/arXiv arXiv 2024

  28. [28]

    Peiran Wang, Ying Li, and Yuan Tian. 2026. Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents. arXiv preprint arXiv:2605.26497. https://arxiv.org/abs/2605.26497

    Pith/arXiv arXiv 2026

  29. [29]

    Yanting Wang, Wei Zou, Runpeng Geng, and Jinyuan Jia. 2026. AgentWatcher: A Rule-based Prompt Injection Monitor. arXiv preprint arXiv:2604.01194. https://arxiv.org/abs/2604.01194

    Pith/arXiv arXiv 2026

  30. [30]

    Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. 2023. Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models. arXiv preprint arXiv:2312.14197. https://arxiv.org/abs/2312.14197

    Pith/arXiv arXiv 2023

  31. [31]

    Chenlong Yin, Runpeng Geng, Yanting Wang, and Jinyuan Jia. 2026. PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses. arXiv preprint arXiv:2603.13026. https://arxiv.org/abs/2603.13026

    Pith/arXiv arXiv 2026

  32. [32]

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. arXiv preprint arXiv:2403.02691. https://arxiv.org/abs/2403.02691

    Pith/arXiv arXiv 2024

  33. [33]

    Wei Zhao, Zhe Li, Peixin Zhang, and Jun Sun. 2026. ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection. arXiv preprint arXiv:2604.11790. https://arxiv.org/abs/2604.11790

    Pith/arXiv arXiv 2026