Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?

• Current benchmarks can use flawed metrics, implementation issues, or unrealistic settings that make weak defenses appear effective.The paper proposes standardized benchmarking best practices and targeted fixes.Source: §1 · p. 2
• The Minimize & Sanitize defense uses a Tool-Input Firewall and Tool-Output Firewall at the agent–tool boundary without retraining.The Minimizer removes unnecessary information from tool inputs, while the Sanitizer removes suspected malicious content from tool responses.Source: §1 · pp. 1–2, Figure 1 · p. 2
• The defense achieves the best security–utility tradeoff on AgentDojo, Agent Security Bench, InjecAgent, and τ-bench without performance degradation.Source: §1 · p. 2
• The proposed cascade escalates from formatted injections to second-order semantic deception and defense-aware adaptive mutation when earlier attacks fail.This strategy is intended to expose failures missed by static attacks.Source: §1 · p. 2

• System-level defenses can prevent injections but often require substantial implementation effort and may reduce task success.CaMeL, for example, relies on a custom policy-constrained interpreter.Source: §2 · p. 3
• The paper simplifies prior multi-firewall designs by using a single output firewall that prevents essentially all injections across four benchmark suites without task-specific policies.Source: §2 · p. 3
• Other defenses are reported as ineffective, utility-costly, benchmark-specific, or dependent on retraining and therefore unsuitable for black-box models.Source: §2 · p. 3
• Existing benchmarks contain implementation issues, bugs, design problems, and insufficient metrics, while the simple firewall defense eliminates attacks across them with zero tuning.These findings motivate newer benchmarks and stronger attacks.Source: §2 · p. 3

Threat Model

• The threat model assumes a benign user task, unknown compromised tools, and potentially adversarial outputs containing instructions to exfiltrate data or perform harmful actions.Source: §3 · pp. 3–4

Defense Objective

• The defense must reduce attack success while preserving benign utility and utility under attack.The paper defines these as aligned objectives for practical deployment.Source: §3 · p. 4

Firewall Defenses

• The Minimizer filters unnecessary confidential information from tool arguments using the trusted task, tool description, and original arguments.Only the filtered arguments are passed to the tool.Source: §3 · p. 4
• The Sanitizer filters every tool observation before forwarding it to the primary agent, removing potentially malicious content.Source: §3 · p. 4
• Together, the firewalls form a limited-privilege filtering layer integrated into the iterative tool-calling pipeline.Source: §3 · p. 4

4.1 Setup

• The evaluation covers AgentDojo, Agent Security Bench, InjecAgent, and τ-bench.These benchmarks include security suites, static malicious-tool calls, and dynamic conversational tasks.Source: §4.1 · pp. 4–5
• AgentDojo spans banking, Slack, travel, and workspace tasks with 949 security evaluations, while ASB contains 400 evaluations in a two-stage tool-use setting.Source: §4.1 · pp. 4–5
• InjecAgent uses predetermined tool calls for direct-harm and data-stealing attacks and does not support utility evaluation.Source: §4.1 · p. 5
• τ-bench is augmented with data-stealing attacks and is used to study security–utility trade-offs in dynamic conversational tasks.Source: §4.1 · p. 5

4.2 Evaluation Metrics

• The metrics are Benign Utility, Utility under Attack, and Attack Success Rate.ASR counts following injected instructions or triggering unsafe behavior; safe refusal or ignoring the injection gives ASR = 0.Source: §4.2 · p. 5

AgentDojo.

• On AgentDojo, the Sanitizer achieves 0 ASR across models while preserving high utility, outperforming the Combined defense and matching CaMeL’s security with higher BU and UA.Source: AgentDojo · p. 5

Agent Security Bench.

• Agent Security Bench’s residual ASR partly reflects a metric flaw: benign-looking tool operations are counted as attack success even when the Sanitizer does not flag them.Source: Agent Security Bench · pp. 5–6

5 Results

• The Sanitizer achieves the best ASR–BU and ASR–UA tradeoffs on AgentDojo and Agent Security Bench.Source: AgentDojo · p. 5, Table 1 · p. 6, Table 2 · p. 6

Agent Security Bench.

• In Agent Security Bench, the Sanitizer achieves almost 4× lower ASR with competitive UA, although a slight BU reduction remains.Source: Agent Security Bench · p. 6, Table 2 · p. 6

InjecAgent.

• InjecAgent results show that the Sanitizer significantly reduces or eliminates attacks, while enhanced attacks are less effective because they likely appear overly malicious.Source: InjecAgent · p. 6, Table 3 · p. 7

Tau-Bench.

• In τ-bench, the Sanitizer consistently eliminates prompt-injection attacks without reducing utility, unlike PI Detection methods that cause severe utility degradation.Source: Tau-Bench · pp. 6–7

6 Analysis

• Across Llama 3.3-70B, Qwen3-8B, and Qwen3-32B, the firewalls reduce ASR while maintaining high benign and under-attack utility without model- or benchmark-specific Sanitizer tuning.Source: §6 · p. 7

Data Contamination.

• Across Sanitizer variants evaluated against post-cutoff AgentDojo releases, ASR remains close to 0, supporting effectiveness against unseen attacks without data contamination.Source: Data Contamination · p. 7

Latency Analysis.

• The firewall completes AgentDojo tool-knowledge attack runs in 3,347.93 seconds versus CaMeL’s 8,417.25 seconds, a 2.5× speed-up.Source: Latency Analysis · p. 7
• Sanitizer input usage is 0.51× baseline, reducing mean input tokens from 13,463 to 2,036, while output usage remains comparable to CaMeL.Source: Latency Analysis · p. 7

False Positive and Negative Analysis.

• The Sanitizer achieves 99.53% recall and 100% precision, missing 0.47% of attacks while producing no false positives.Source: False Positive and Negative Analysis · p. 8
• Among nine tasks with utility degradation in at least two of three seeds, seven failures came from agent mistakes and two from Sanitizer redaction.Source: False Positive and Negative Analysis · p. 8

7.1 AgentDojo

• AgentDojo injections can overwrite essential task information, making tasks unsolvable and confounding utility drops with data replacement rather than agentic failure.The paper recommends preserving task-critical signals so failures reflect malicious-instruction influence.Source: §7.1 · p. 8
• AgentDojo’s rigid state-delta metrics can penalize successful task completion when auxiliary events occur, systematically underestimating utility.The paper advocates content-based checks of the task’s semantic goal.Source: §7.1 · p. 8

7 Assessment of Current Benchmarks

• Benchmark fixes reveal substantial evaluation distortions: AgentDojo utility improves by >18% after correcting injection placement and goal-based scoring, while ASB ASR falls from 70% to 9.25%.These changes address overwritten task-critical content, brittle utility metrics, forced attack-tool injection, and control-flow manipulation.Source: §7.1 · p. 8, §7.2 · p. 9

7.2 Agent Security Bench

• ASB forcibly inserts attacker-controlled tools and defines success by their invocation, inflating ASR through benchmark-controlled tool selection rather than prompt-injection influence.Allowing free tool selection sharply reduces the measured ASR.Source: §7.2 · p. 9
• ASB’s static utility evaluation can be gamed by calling every tool, ignores task semantics and sequencing, and assigns zero utility whenever an attacker tool is invoked.These design choices limit its usefulness for measuring real-world task completion.Source: §7.2 · p. 9

7.3 InjecAgent

• InjecAgent reports ASR without BU or UA and uses overly simplistic attacks, preventing security–utility assessment and weakening robustness evaluation.The paper identifies both missing utility metrics and obsolete attack strength as central limitations.Source: §7.3 · p. 9

8 Cascade Attack Strategy

• Existing rigid, context-agnostic attacks can overestimate defense effectiveness, motivating stronger attacks that reveal failure modes hidden by fixed triggers.The cascade is designed to address this benchmark gap.Source: §8 · p. 10

Setup.

• The three-stage cascade escalates only after earlier attacks fail, progressing from existing formatted injections to seven semantic templates and a 10-iteration adaptive LLM attacker.The adaptive stage uses prior successes, failures, defense feedback, and defense knowledge.Source: Setup · p. 10

Results.

• PromptArmor is easily fooled by second-order semantic templates, whereas the Sanitizer shows only a modest ASR increase because it regenerates outputs without injections.The contrasting designs make Sanitizer performance less dependent on surface-form triggers.Source: Results · p. 10
• Non-trivial Sanitizer ASR appears only under defense-aware adaptive attacks, and successes remain limited despite the attacker’s greater capability and cost.The findings support including adaptive attacks in standard prompt-injection robustness evaluation.Source: Results · p. 10

9 Discussion and Conclusion

• Benchmarks should avoid forcibly injecting tools or overriding planning decisions because this distorts ASR.This guideline directly addresses benchmark-induced control-flow manipulation.Source: §9 · p. 10
• Utility evaluation should reflect semantic goal completion, including correct tool sequencing, input-output flow, and partial success.The recommendation targets metrics that can reward tool invocation without meaningful task completion.Source: §9 · p. 10
• Benchmarks should report BU, ASR, and UA together to characterize the security–utility tradeoff.These metrics distinguish benign utility, attack success, and utility under attack.Source: §9 · p. 10
• Benchmarks need stronger adaptive attacks because saturated weak attacks may fail to distinguish among defenses.The paper presents adaptive attacks as necessary for more discriminating evaluation.Source: §9 · p. 11
• Firewalls achieve perfect security across public benchmarks while matching or exceeding complex defenses, establishing them as strong baseline defenses.The conclusion recommends reporting the Sanitizer on revised AgentDojo evaluations.Source: §9 · p. 11

10 Impact statement

• The impact statement cautions that the firewalls assume trusted user tasks and secure tools, may invite overreliance, and can require extra API calls that increase leakage risk.These conditions constrain how broadly the reported security should be interpreted.Source: §10 · p. 11

B Minimizer and Sanitizer Prompts

• The firewall design uses separate input-minimization and output-sanitization prompts that request structured JSON responses.The prompts filter tool arguments using the trusted task and sanitize tool outputs while preserving the original format.Source: B Minimizer and Sanitizer Prompts · p. 14

C.1 AgentDojo

• AgentDojo’s revised evaluation includes separate tables for benign utility, attack success rate, and utility under attack.These tables distinguish no-attack utility from security and under-attack utility measurements.Source: §C.1 · p. 15, Table 7 · p. 15, Table 8 · p. 16
• Across AgentDojo, Agent Security Bench, InjecAgent, and tau-Bench, the Sanitizer substantially reduces injection attacks while preserving utility, with revised benchmark tables documenting the evaluations.The supplied passages identify benchmark-specific results and table scopes but do not provide all cell values.Source: Table 7 · p. 15, Table 8 · p. 16, §C.3 · p. 17

C.3 InjecAgent

• InjecAgent results show near-zero attack success across four LLMs, although some enhanced attacks are less effective because they appear overtly malicious.The authors also identify ambiguously benign injections as a source of residual non-zero attack success.Source: §C.3 · p. 17

D.1.1 Injection vectors overwrite task-critical content

• An injection embedded in a bill file replaced task-critical information, causing the original agent to fail, while the fixed version enabled payment of the December 2023 bill.In the revised example, the agent paid the 98.70 Car Rental bill successfully, whereas the original bill lacked usable details after the injection replaced the information needed for the task.Source: §D.1.1 · pp. 22, 26

D.1.2 Brittle utility checks mis-score success

• A brittle utility check scored the original Slack task as 0 despite successful message delivery, while the fixed condition scored it as 1; InjecAgent also lacks utility metrics for assessing defense costs.The original check required Alice’s inbox length to increase by exactly one, even though the attacker also sent Alice a message, and the InjecAgent results report mitigation of direct-harm and data-stealing attacks without measuring task performance.Source: Table 19 · p. 27, §D.1.2 · p. 28

D.2.1 Forced Attack-Tool Injection Distorts ASR

• Forced attack-tool injection artificially sets ASR to 1 by adding the malicious tool regardless of the agent’s choice, but ASR drops when agents freely select tools.This shows that the earlier high ASR reflected benchmark-induced control-flow manipulation rather than the agent’s underlying vulnerability.Source: §D.2.1 · p. 29

E Cascade Attack Strategy

• Cascade attacks reveal that PromptArmor is easily fooled by semantic templates, whereas the Sanitizer shows only a modest ASR increase and limited successes even against adaptive refinement.The cascade escalates from formatted injections to seven second-order semantic-template families and then to 10 mutation rounds conditioned on attack outcomes, defense feedback, and defense knowledge.Source: E Cascade Attack Strategy · p. 30
• Robustness evaluations should include defense-aware adaptive attacks such as Stage 3, rather than relying solely on static or format-driven attacks.These attacks better reflect attackers optimizing against the deployed defense.Source: E Cascade Attack Strategy · p. 30

E.1 Example of Successful Attack through Sanitizer

• A successful attack bypassed the tool-output firewall when it was implemented using GPT-4o.Source: §E.1 · p. 32

E.1.1 Example: Successful Stage 3 Attack Against Firewall

• The examples include a direct webpage-reading task and a hotel-review task, showing that successful bypasses can arise in ordinary tool-use workflows.The hotel example uses a reservation condition based on the requested rating.Source: §E.1.1 · p. 32, F Another Example of Successful Attack… · p. 33
• The Stage 3 mutator uses a decoy plus verified-tag strategy to make malicious tool instructions appear authenticated.This attack design is distinct from the overt prompt-injection decoy that the firewall removes.Source: §E.1.1 · p. 32
• A Stage 3 attack bypasses the firewall when a legitimate-looking verified-user tag causes the agent to send a message from webpage content.The firewall removes an obvious decoy but passes the apparently authenticated request, which the agent executes.Source: §E.1.1 · pp. 32–33

F Another Example of Successful Attack through Sanitizer

• Braille-encoded injection bypasses the Sanitizer in a hotel-review task and triggers an unauthorized reservation at Riverside View hotel.The defense detects the Braille but decodes it to natural language, allowing the injected reservation instruction to remain actionable.Source: F Another Example of Successful Attack… · pp. 33–34

H.1 Data Contamination

• The paper reports no data contamination because the evaluated benchmarks were released after the stated knowledge cutoffs of GPT-4o and Llama 3.3 70B.The passage attributes this conclusion to the release dates of AgentDojo, InjecAgent, and ASB.Source: §H.1 · p. 34

H.3 Latency Analysis

• 2.5x speed-up: Firewall requires 3,347.93 seconds versus CaMeL’s 8,417.25 seconds on AgentDojo tool-knowledge attacks.The comparison uses gpt-4o-2024-08-06 on the banking and Slack suites.Source: §H.3 · p. 35, Table 24 · p. 35

H.4 Tokens Analysis

• 2.82x more input tokens and 2.73× more output tokens: CaMeL exceeds the no-defense baseline for the median task.Token accounting includes firewall system prompts but excludes tool-documentation tokens for all methods.Source: §H.4 · p. 35, Table 25 · p. 36

H.5 False Positive and Negative Analysis

• 0.47% false negative rate and 100% precision: Sanitizer misses few attacks while never misclassifying benign responses on AgentDojo.The analysis also reports zero false positives and near-perfect recall.Source: §H.5 · p. 35, Table 26 · p. 36

H.6.1 Minimizer

• Minimizer can reduce attack success by removing extraneous or sensitive arguments, but aggressive redaction may remove information needed for task success.The appendix examples show utility drops when Minimizer over-attends to the trusted user task or selects unsuitable hotel arguments.Source: §H.6.1 · pp. 36–38

H.6.2 Sanitizer

• Sanitizer can reduce utility without an attack by flagging benign tool outputs as unsafe, including outputs containing financial identifiers.Examples remove IBAN values even when the output is not an injection, illustrating the utility-security tradeoff.Source: §H.6.2 · pp. 38–39