Source-linked AI summary
WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents
Xilong Wang, Yinuo Liu, Zhun Wang, Dawn Song, Neil Gong
TL;DR
Prompt injection attacks can manipulate webpages so web agents pursue attacker-specified goals, while existing detection and localization methods have limited effectiveness in this setting. WebSentinel extracts potentially contaminated segments and evaluates them against surrounding webpage context, substantially outperforming baselines across contaminated and clean webpage datasets.
Problem
Existing web-agent prompt-injection detection and localization methods have limited effectiveness because their assumptions do not cover subtle attacks, embedded instructions, or imperceptible visual manipulations.
Method
WebSentinel extracts segments of interest from HTML webpages and uses an analyzer LLM to evaluate each segment for semantic or functional consistency with the surrounding page.
Results
WebSentinel substantially outperforms baselines across contaminated and clean webpage datasets, achieving accuracy 0.120 higher than the best-performing baseline.
Takeaways & Limitations
Pruning irrelevant webpage content and structured alignment checks improve WebSentinel’s detection and localization performance.
Abstract
from arXiv · showhide
Prompt injection attacks manipulate webpage content to cause web agents to execute attacker-specified tasks instead of the user's intended ones. Existing methods for detecting and localizing such attacks achieve limited effectiveness, as their underlying assumptions often do not hold in the web-agent setting. In this work, we propose WebSentinel, a two-step approach for detecting and localizing prompt injection attacks in webpages. Given a webpage, Step I extracts \emph{segments of interest} that may be contaminated, and Step II evaluates each segment by checking its consistency with the webpage content as context. We show that WebSentinel is highly effective, substantially outperforming baseline methods across multiple datasets of both contaminated and clean webpages that we collected. Our code is available at: https://github.com/wxl-lxw/WebSentinel.
1 Introduction
Web agents operate on untrusted webpages, where explicit or subtle prompt injections can redirect their actions and create security risks. WebSentinel addresses weaknesses in existing text- and screenshot-based methods with segment extraction, contextual analysis, pruning, and strong benchmark performance.
- Webpages are untrusted execution environments where injected content can redirect agents from user goals toward click fraud, malware downloads, or sensitive-information disclosure.
- Existing text-based methods struggle with subtle attacks and instructions buried in benign content, while screenshot-based methods miss imperceptible or visually unchanged manipulations.
- WebSentinel extracts potentially contaminated segments, then uses an analyzer LLM to judge each segment against the surrounding webpage’s legitimate purpose.
- Untargeted and targeted pruning reduce analyzer input while preserving contextual cues needed for accurate segment evaluation.
- 0.120 higher accuracy than the best-performing baseline was achieved by WebSentinel across the collected contaminated and clean webpage datasets.
2 Related Work
Prior work addresses prompt injection attacks that contaminate webpages through malicious pop-ups, forms, comments, messages, or imperceptible visual perturbations. Table 1 organizes WebSentinel’s segment types, corresponding attacks, and extraction methods.
- Webpage attacks inject malicious content through pop-ups, HTML forms, duplicate elements, comments, messages, or visually imperceptible perturbations.
- Table 1 summarizes potentially contaminated segment types, the attacks associated with them, and WebSentinel’s extraction approaches.
3 Problem Definition
The paper defines a webpage as an HTML source file and studies detection and localization of prompt injection attacks within it. Detection classifies contamination, while localization identifies the injected prompt.
- A webpage is defined as its HTML source code, and a contaminated webpage is one compromised by a prompt injection attack.
- Detection determines whether a webpage is contaminated, while localization identifies the injected prompt within the webpage when contamination is detected.
4 Our WebSentinel
WebSentinel extracts segments of interest using code patterns and an extractor LLM, then analyzes each segment with webpage context. It combines pruning and alignment checks to classify webpages and localize contaminated segments.
- Step I: Extracting Segments of Interest: Step I extracts potentially contaminated segments, using code-pattern matching for recognizable structures and an extractor LLM for variable layouts.
- Step II: Contextual Segment Analysis: Step II evaluates each extracted segment with an analyzer LLM because contamination often depends on the webpage’s overall semantics and structure.
- Pruning: Untargeted pruning removes globally irrelevant content, while targeted pruning retains context relevant to the segment type being analyzed.
- Alignment Checks: Alignment checks examine duplicate elements, duplicate purposes, misleading or coercive instructions, sensitive-data collection, and false-positive safeguards.
- Detection and Localization: A webpage is classified as contaminated when at least one segment is identified as contaminated, and those detected segments provide the attack localization.
5 Data Collection
The evaluation datasets include contaminated webpages generated by five prompt injection attacks and counterpart clean webpages collected to measure false positives.
- Five attacks—EIA, Pop-up, WASP, WebInject, and VPI—provide the contaminated webpages used for evaluation.The contaminated webpages were sourced from the original attack papers.
- Counterpart clean webpages were collected to evaluate WebSentinel’s false positive rates across attack-specific webpage sources.The clean sets include webpages from Mind2Web and pre-attack WebInject pages, among other counterparts.
6 Evaluation
WebSentinel is evaluated against text-, screenshot-, and segment-based baselines for detection and localization, with ablations examining its components, pruning, and adaptive attacks.
- WebSentinel achieves the highest detection accuracy and average localization JC across webpage types, outperforming the evaluated baselines.Detection uses FNR, FPR, and Acc, while localization uses JC.
- The two-step design improves robustness because extracted segments are analyzed with webpage context, unlike methods using full text, screenshots, or isolated segments.This supports attacks without explicit instructions, attacks lacking visible layout changes, and imperceptible visual perturbations.
- Impact of the analyzer LLM: Alignment checks reduce EIA FNR by 0.291 and increase EIA JC by 0.593 compared with binary classification alone.The ablation attributes the gains to more comprehensive analysis of segments of interest.
- Impact of Step I: Including Step I decreases FNR by 0.609 and FPR by 0.382 relative to analyzing webpage text without segment extraction.The result underscores the role of precisely extracting segments of interest before analysis.
- Impact of pruning: Pruning substantially reduces tokens and inference time while slightly improving detection and localization performance on EIA webpages.The reported efficiency gains arise from removing redundant webpage content that can distract the analyzer LLM.
- Adaptive attack: Under AgentVigil’s adaptive attack, WebSentinel’s FNR rises from 0.007 to 0.020 while attack success rate falls from 0.640 to 0.060.The reported degradation in attack success rate is attributed to alignment checks requiring less harmful optimized segments to evade detection.
7 Conclusion and Future Work
WebSentinel detects and localizes prompt injection attacks by extracting webpage segments of interest and analyzing each in webpage context, with pruning and alignment checks improving performance.
- WebSentinel substantially outperforms existing baselines by extracting potentially contaminated segments and analyzing them in webpage context.The conclusion identifies pruning irrelevant content and structured alignment checks as further performance improvements.
Impact Statement
WebSentinel’s detection and localization are presented as mechanisms supporting safer web-agent deployment, forensic analysis, and webpage recovery.
- Identifying contaminated segments can help mitigate security and privacy risks, including leakage of sensitive user information.Localization also supports post-attack forensic analysis and restoring webpages to a clean state.