Search papers, labs, and topics across Lattice.
This paper introduces AuthGraph, a novel defense mechanism against indirect prompt injection attacks in LLM agents that use tool calling. AuthGraph constructs an "injected reasoning graph" representing the agent's actual execution and compares it to an "authorization graph" derived from the user's intended action in a clean, un-injected context. By structurally comparing these graphs, AuthGraph detects deviations at both the tool and parameter-source level, significantly reducing attack success rates on AgentDojo and AgentDyn benchmarks.
LLM agents can be tricked into unauthorized actions via indirect prompt injection, but AuthGraph's dual-graph approach slashes attack success rates from 40% to 1% while preserving utility.
LLM-based agents are increasingly deployed in high-stakes scenarios such as email management, financial transactions, and code execution, where they interact with the external world through tool calling. During execution, these agents must read external data sources (emails, webpages, files) that attackers can control; through indirect prompt injection, attackers embed malicious instructions in this data to manipulate agents into performing unauthorized operations such as transferring funds to attacker-controlled accounts. Existing defenses either perform tool-call-level value checking without tracking where parameter values originate, or analyze execution traces from a single perspective without a clean authorization baseline for comparison. We propose AuthGraph, a dual-graph alignment defense framework that constructs two complementary graphs: an injected reasoning graph that models information provenance from the actual execution trajectory (including potentially manipulated attributions), and an authorization graph derived from the user's intent in an isolated clean context that is information-theoretically impossible to be influenced by injection; a graph alignment checker then structurally compares the two graphs to detect both tool-level and parameter-source-level deviations. On AgentDojo, AuthGraph reduces the attack success rate from 40% to 1% while maintaining 76% task completion rate on GPT-4o; on AgentDyn, it reduces the attack success rate from 39% to 2% while preserving 51% utility, outperforming state-of-the-art defenses including CaMeL, DRIFT, and Progent. To our knowledge, AuthGraph is the first agent security defense to structurally compare authorization specifications against execution provenance at the parameter-source level, achieving fine-grained injection detection without sacrificing agent flexibility.
