Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces AgentSentry, a novel inference-time defense framework against indirect prompt injection (IPI) attacks in tool-augmented LLM agents. AgentSentry models IPI as a temporal causal takeover, localizing attack points through counterfactual re-executions at tool-return boundaries. It then uses causally guided context purification to remove attack-induced deviations, preserving task-relevant information and enabling safe continuation.
AgentSentry stops indirect prompt injection attacks in LLM agents by pinpointing when the attack takes hold using causality, then surgically removing the malicious influence.
Large language model (LLM) agents increasingly rely on external tools and retrieval systems to autonomously complete complex tasks. However, this design exposes agents to indirect prompt injection (IPI), where attacker-controlled context embedded in tool outputs or retrieved content silently steers agent actions away from user intent. Unlike prompt-based attacks, IPI unfolds over multi-turn trajectories, making malicious control difficult to disentangle from legitimate task execution. Existing inference-time defenses primarily rely on heuristic detection and conservative blocking of high-risk actions, which can prematurely terminate workflows or broadly suppress tool usage under ambiguous multi-turn scenarios. We propose AgentSentry, a novel inference-time detection and mitigation framework for tool-augmented LLM agents. To the best of our knowledge, AgentSentry is the first inference-time defense to model multi-turn IPI as a temporal causal takeover. It localizes takeover points via controlled counterfactual re-executions at tool-return boundaries and enables safe continuation through causally guided context purification that removes attack-induced deviations while preserving task-relevant evidence. We evaluate AgentSentry on the \textsc{AgentDojo} benchmark across four task suites, three IPI attack families, and multiple black-box LLMs. AgentSentry eliminates successful attacks and maintains strong utility under attack, achieving an average Utility Under Attack (UA) of 74.55 %, improving UA by 20.8 to 33.6 percentage points over the strongest baselines without degrading benign performance.