Search papers, labs, and topics across Lattice.
This paper introduces Twin Agent, a novel architecture that enhances the security of large language model (LLM) agents against prompt injection attacks by employing a dual-agent system. The Explore Agent assesses untrusted inputs while the Safe Agent executes actions based on compact hints from the Explore Agent, effectively balancing security and utility without extensive task-specific modifications. Empirical evaluations on software engineering and multi-tool interaction tasks demonstrate that Twin Agent significantly outperforms both undefended agents and existing privilege separation methods in maintaining high task utility while mitigating security risks.
Twin Agent achieves a superior security-utility balance, allowing LLMs to fend off prompt injection attacks without sacrificing performance.
Large language model (LLM) agents are vulnerable to security risks, such as prompt injection attacks from untrusted context that manipulate downstream reasoning and tool use. Existing secure-by-design approaches mitigate this risk by separating untrusted observations from privileged execution and careful control of information flow, but often degrade utility and require extensive task-specific engineering. We thus propose Twin Agent, a general privilege separation design pattern inspired by residual coding in the agent context. Twin Agent consists of two nearly symmetric agents: an Explore Agent that inspects untrusted information and a Safe Agent that executes privileged actions. The Explore Agent is conditioned on the Safe Agent's current context and communicates only compact hints to the Safe Agent about the next action to take. This design reduces the information needed to preserve task utility and thus achieves a better security--utility tradeoff, which we empirically verify by measuring how utility and attack success change as the length of hints varies. We evaluate Twin Agent on long-horizon software engineering tasks with SWE-bench Lite and on heterogeneous multi-tool interaction tasks with AgentDojo and DecodingTrust-Agent. Across both benchmarks, Twin Agent preserves high task utility while preventing prompt injection attacks, outperforming both undefended agents and privilege separation baselines.
