ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

• URL: http://arxiv.org/abs/2609.14987v1
• Date: Mon, 14 Sep 2026 03:47:05 GMT
• Title: ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents
• Abstract summary: We propose ActGuard, a pre-execution action auditing framework.<n>Rather than judging whether external content is inherently suspicious, ActGuard assesses whether it causes the current action to deviate from a reasonable expectation.<n>A verifier then examines the localized evidence, masks only spans confirmed as malicious, and regenerates the action from the sanitized context.
• Score: 11.495797074855703
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prompt injection (IPI) attacks. Existing defenses mainly rely on prompt hardening, content filtering, pre-generated plans, or permission constraints. These approaches often struggle with complex tasks or over-sanitize external content, making it difficult to balance security and utility. The key challenge is therefore to preserve execution flexibility while precisely identifying and removing the malicious content that actually induces unsafe actions. To address this challenge, we propose ActGuard, a pre-execution action auditing framework. Rather than judging whether external content is inherently suspicious, ActGuard assesses whether it causes the current action to deviate from a locally reasonable expectation. At each step, ActGuard predicts the tools likely to be used by the upcoming action and constructs a local tool prior without constraining the execution trajectory. Before execution, it compares the candidate action against this prior and performs tool-level contrastive analysis and parameter-level evidence localization to identify deviations in tool selection and action parameters. A verifier then examines the localized evidence, masks only spans confirmed as malicious, and regenerates the action from the sanitized context. This design preserves legitimate planning flexibility while minimizing information loss from indiscriminate filtering. We evaluate ActGuard on challenging benchmarks for tool-using agents. Results show that ActGuard reduces attack success rates to a level comparable to state-of-the-art defenses while maintaining task utility close to the no-attack setting, achieving a favorable security-utility trade-off. Our code is publicly available at: https://github.com/binzhwang/ActGuard.

Related papers

• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing [80.39644823192113]
  We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed.<n>StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4.<n>When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3%.
  arXiv  Detail & Related papers  (2026-08-25T16:17:27Z)
• ToolGuardian: Declarative Security for AI Agent-Tool Interactions [0.0]
  Existing defenses rely on weak metadata, collapse characterization and policy judgment.<n>This paper presents ToolGuardian, a policy-driven framework for securing agent-tool interactions.
  arXiv  Detail & Related papers  (2026-07-23T21:53:34Z)
• Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning [48.99783163807576]
  Cross-tool description poisoning can manipulate planner-visible tool metadata to steer an agent's trajectory.<n>A key observation is that poisoned descriptions persist in the planning context across steps, enabling continuous influence over subsequent tool choices.<n>We propose Tool-Guard, a novel system-level defense based on a new concept called isolated planning.
  arXiv  Detail & Related papers  (2026-06-18T20:31:08Z)
• ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection [8.627671856044527]
  textscClawGuard enforces a user-confirmed rule set at every tool-call boundary.<n>textscClawGuard blocks all three injection pathways without model modification or infrastructure change.<n>This work establishes deterministic tool-call boundary enforcement as an effective defense mechanism for secure agentic AI systems.
  arXiv  Detail & Related papers  (2026-04-13T17:55:11Z)
• PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification [1.7904458681854372]
  PlanGuard is a training-free defense framework based on the principle of Context Isolation.<n>PlanGuard effectively neutralizes attacks, reducing the Attack Success Rate (ASR) from 72.8% to 0%.
  arXiv  Detail & Related papers  (2026-04-11T09:59:46Z)
• AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations [38.49666480491258]
  LLM agents are highly vulnerable to Indirect Prompt Injection (IPI)<n>We propose a new paradigm, action-level causal attribution, which secures agents by asking why a particular tool call is produced.<n>We instantiate this paradigm with AttriGuard, a runtime defense based on parallel counterfactual tests.
  arXiv  Detail & Related papers  (2026-03-11T13:23:46Z)
• SkillJect: Automating Stealthy Skill-Based Prompt Injection for Coding Agents with Trace-Driven Closed-Loop Refinement [120.52289344734415]
  We propose an automated framework for stealthy prompt injection tailored to agent skills.<n>The framework forms a closed loop with three agents: an Attack Agent that synthesizes injection skills under explicit stealth constraints, a Code Agent that executes tasks using the injected skills and an Evaluate Agent that logs action traces.<n>Our method consistently achieves high attack success rates under realistic settings.
  arXiv  Detail & Related papers  (2026-02-15T16:09:48Z)
• CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution [49.689452243966315]
  AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks.<n>We propose CausalArmor, a selective defense framework that computes lightweight, leave-one-out attributions at privileged decision points.<n> Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses.
  arXiv  Detail & Related papers  (2026-02-08T11:34:08Z)
• ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback [53.2744585868162]
  Monitoring step-level tool invocation behaviors in real time is critical for agent deployment.<n>We first construct TS-Bench, a novel benchmark for step-level tool invocation safety detection in LLM agents.<n>We then develop a guardrail model, TS-Guard, using multi-task reinforcement learning.
  arXiv  Detail & Related papers  (2026-01-15T07:54:32Z)
• IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents [33.775221377823925]
  Large language model (LLM) agents are widely deployed in real-world applications, where they leverage tools to retrieve and manipulate external data for complex tasks.<n>When interacting with untrusted data sources, tool responses may contain injected instructions that covertly influence agent behaviors and lead to malicious outcomes.<n>We propose a novel defensive task execution paradigm, called IPIGuard, to prevent malicious tool invocations at the source.
  arXiv  Detail & Related papers  (2025-08-21T07:08:16Z)
• MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents [60.30753230776882]
  LLM agents are vulnerable to indirect prompt injection (IPI) attacks, where malicious tasks embedded in tool-retrieved information can redirect the agent to take unauthorized actions.<n>We present MELON, a novel IPI defense that detects attacks by re-executing the agent's trajectory with a masked user prompt modified through a masking function.
  arXiv  Detail & Related papers  (2025-02-07T18:57:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.