Search papers, labs, and topics across Lattice.
This paper introduces SkillGuard, a harness-level enforcement layer designed to mitigate the risks associated with indirect prompt injection in large language model (LLM) agents by treating contamination from untrusted data as a trigger for capability confinement. By utilizing a Skill Impact Graph and steerability signatures, SkillGuard effectively restricts future agent capabilities to prevent unauthorized actions while maintaining high utility. Evaluation results show that SkillGuard significantly reduces attack success rates across multiple AgentDojo suites, outperforming existing defenses without incurring additional model calls or token overhead.
SkillGuard cuts attack success rates to as low as 4.8% by redefining agent capabilities in response to contamination from untrusted data.
Large language model agents place outputs from external skills into their execution context, allowing attacker-controlled data to influence later privileged actions. Existing defenses mainly classify untrusted content or authorize proposed operations. They do not directly address how an agent's future authority should change once untrusted data enters its state. We present SkillGuard, a harness-level enforcement layer that treats this event as contamination and restricts future capabilities to disconnect the resulting state from deployer-defined forbidden states. Given sound skill summaries and policies, SkillGuard represents security-relevant transitions with a Skill Impact Graph, specifies admissible control over skill parameters via steerability signatures, and mediates invocations with an inline reference monitor. Following contamination, it computes weighted capability restrictions using binary, fractional, or fractional-flow strategies without auxiliary language-model inference. We evaluate SkillGuard on four AgentDojo suites with two backend LLMs, Gemini 2.5 Flash and Llama3.3-70B, against an LLM-only No Defense baseline and three defenses at different system layers: Spotlighting, CaMeL, and AttriGuard. We construct a compositional attack benchmark in which each attack combines observations individually insufficient to induce target violation and evaluate the same baselines on it. Under AgentDojo's Tool Knowledge attacks, SkillGuard eliminates attack success on three of four suites for both backends and reduces it to 4.8% and 14.3% on Slack. Against compositional attacks, it outperforms every baseline on Llama and matches the strongest baseline on Gemini at higher benign utility. Fractional-flow restriction preserves substantially more capabilities than binary restriction at the same attack success rate. Across both settings, SkillGuard adds no model calls or token overhead.
