Search papers, labs, and topics across Lattice.
This paper presents a systematization of knowledge (SoK) for Indirect Prompt Injection (IPI) defense frameworks in LLM agents, providing a taxonomy along five dimensions and evaluating the security and usability of representative defenses. Through analysis of defensive failures, the authors identify six root causes of circumvention. They then design three novel adaptive attacks that substantially improve attack success rates, highlighting vulnerabilities in existing defenses.
Existing defenses against indirect prompt injection in LLM agents are riddled with flaws, as demonstrated by three new adaptive attacks that easily bypass them.
Large Language Model (LLM)-based agents with function-calling capabilities are increasingly deployed, but remain vulnerable to Indirect Prompt Injection (IPI) attacks that hijack their tool calls. In response, numerous IPI-centric defense frameworks have emerged. However, these defenses are fragmented, lacking a unified taxonomy and comprehensive evaluation. In this Systematization of Knowledge (SoK), we present the first comprehensive analysis of IPI-centric defense frameworks. We introduce a comprehensive taxonomy of these defenses, classifying them along five dimensions. We then thoroughly assess the security and usability of representative defense frameworks. Through analysis of defensive failures in the assessment, we identify six root causes of defense circumvention. Based on these findings, we design three novel adaptive attacks that significantly improve attack success rates targeting specific frameworks, demonstrating the severity of the flaws in these defenses. Our paper provides a foundation and critical insights for the future development of more secure and usable IPI-centric agent defense frameworks.
