CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution

Minbeom Kim; Mihir Parmar; Phillip Wallis; Lesly Miculicich; Kyomin Jung; Krishnamurthy Dj Dvijotham; Long T. Le; Tomas Pfister

Source-linked AI summary

CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution

Minbeom Kim, Mihir Parmar, Phillip Wallis, Lesly Miculicich, Kyomin Jung, Krishnamurthy Dj Dvijotham, Long T. Le, Tomas Pfister

arXiv:2602.07918v1Feb 8, 2026cs.CRcs.LGstat.ME

TL;DR

Tool-calling agents remain vulnerable to hidden instructions in untrusted content, while always-on defenses can harm benign utility and latency. CausalArmor uses leave-one-out attribution at privileged decisions to identify dominance shifts, then selectively sanitizes responsible spans and masks poisoned reasoning. Across AgentDojo and DoomArena, it reports near-zero attack success while preserving utility and latency near the No Defense setting, subject to conditional assumptions and deployment limits.

Problem
Indirect Prompt Injection can make agents execute unauthorized privileged actions, while always-on defenses degrade benign utility and increase latency.
Method
CausalArmor computes leave-one-out attributions at privileged decisions and selectively sanitizes dominant untrusted spans while masking poisoned reasoning traces.
Results
CausalArmor achieves near-zero Attack Success Rates while maintaining benign utility and latency close to defense-free agents on AgentDojo and DoomArena.
Takeaways & Limitations
Detecting causal dominance lets CausalArmor target expensive defenses only when threats are detected, preserving benign utility and latency while retaining security.
Takeaways & Limitations
CausalArmor provides conditional guarantees and should not be treated as standalone protection under arbitrary distribution shift or highly adaptive adversaries; worst-case overhead can approach always-on sanitization.

Abstract

from arXiv · show

AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks. In this attack scenario, malicious commands hidden within untrusted content trick the agent into performing unauthorized actions. Existing defenses can reduce attack success but often suffer from the over-defense dilemma: they deploy expensive, always-on sanitization regardless of actual threat, thereby degrading utility and latency even in benign scenarios. We revisit IPI through a causal ablation perspective: a successful injection manifests as a dominance shift where the user request no longer provides decisive support for the agent's privileged action, while a particular untrusted segment, such as a retrieved document or tool output, provides disproportionate attributable influence. Based on this signature, we propose CausalArmor, a selective defense framework that (i) computes lightweight, leave-one-out ablation-based attributions at privileged decision points, and (ii) triggers targeted sanitization only when an untrusted segment dominates the user intent. Additionally, CausalArmor employs retroactive Chain-of-Thought masking to prevent the agent from acting on ``poisoned'' reasoning traces. We present a theoretical analysis showing that sanitization based on attribution margins conditionally yields an exponentially small upper bound on the probability of selecting malicious actions. Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses while improving explainability and preserving utility and latency of AI agents.

1. Introduction

Tool-calling agents can be hijacked when hidden instructions in untrusted content redirect privileged actions, while always-on defenses impose utility and latency costs. CausalArmor detects this dominance shift with lightweight attribution and selectively sanitizes only the responsible spans.

Indirect Prompt Injection hides malicious commands in webpages, emails, or tool outputs, causing agents to execute unauthorized privileged actions.
Always-on sanitization and verification can reduce attack success but degrade benign utility and increase latency.
Successful IPI shifts attributable influence from the user request toward a specific untrusted span at a privileged decision.
CausalArmor computes lightweight leave-one-out attributions and triggers targeted sanitization only when an untrusted span dominates the user request.
CausalArmor combines targeted span sanitization with retroactive reasoning-history masking, while benign requests proceed without the defense overhead.
On AgentDojo and DoomArena, CausalArmor achieves near-zero Attack Success Rate while preserving benign utility and latency close to No Defense.

2. Related Work

Prior IPI defenses span prompting, classifiers, and system controls, but strong security often requires expensive or restrictive always-on interventions. CausalArmor instead detects causal dominance at privileged decisions and pays for sanitization selectively.

IPI exploits attacker-controlled webpages, emails, or tool outputs that introduce hidden instructions and can propagate across long-horizon interactions.
Existing defenses include prompting, trained classifiers, and system-based constraints, with a recurring trade-off between security, utility, and latency.
Prompting is inexpensive but brittle against adaptive phrasing and rarely provides reliable security across diverse templates and domains.
Trained classifiers can be efficient but face out-of-distribution phrasing, false positives, and distribution shifts across domains and tool formats.
System defenses impose structural constraints or repeated expensive calls, which can restrict capability and add latency during benign scenarios.
CausalArmor detects when untrusted spans outweigh the user request and selectively activates expensive sanitization, preserving utility and latency while targeting robust security.
LOO attribution measures the counterfactual effect of removing an input span on the model’s output distribution.

3. Indirect Prompt Injection: Setup and Formalization

The paper models IPI as untrusted content overriding user grounding in privileged action selection. Its formal setup separates trusted and untrusted context, measures leave-one-out influence, and detects dominance shifts with a tunable margin.

3.1. Notation and agentic setting: At each turn, the agent observes a user request and aggregated context containing dialogue history, tool schemas, retrieved documents, and tool outputs.
3.1. Notation and agentic setting: The context separates trusted system-side information from instruction-bearing untrusted spans extracted from external sources.
3.1. Notation and agentic setting: The action space combines privileged tools such as execute, write, and send with non-privileged tools such as search and read.
3.2. Leave-one-out attribution (LOO): LOO attribution measures each user request or untrusted span’s marginal support for a candidate next action by removing that context component.
3.3. What IPI does: Inducing a Dominance Shift: IPI redirects probability toward an unauthorized privileged action by making an untrusted span function as a hidden instruction.
3.3. What IPI does: Inducing a Dominance Shift: Under benign execution, user attribution dominates, whereas successful IPI collapses user grounding and spikes the influence of a specific injected span.
3.4. Margin-based IPI detection at privileged decisions: The framework flags privileged decisions when an untrusted span exceeds user attribution by a margin τ, with τ controlling the defense range.
3.4. Margin-based IPI detection at privileged decisions: Algorithm 1 implements batched attribution checks followed by selective sanitization and retroactive CoT masking for flagged spans.

4. CausalArmor Framework

CausalArmor reduces attribution cost with proxy-model batching and length normalization, then sanitizes detected spans and masks poisoned reasoning. Its analysis links attribution margins to probabilistic safety under explicit capability and sanitization assumptions.

Repeated leave-one-out queries create latency and API constraints, motivating proxy models and batched attribution.
CausalArmor uses a smaller proxy model because leave-one-out computations across spans are independent and causal influence can transfer across models.
Attribution scores are normalized by generated-output length so the detection margin remains robust across different tool calls.
When the detected set is non-empty, CausalArmor sanitizes the flagged spans using context containing the user request and proposed tool definition.
Retroactive CoT masking replaces subsequent assistant reasoning traces with a generic placeholder, forcing replanning from the user request and sanitized data.
The theoretical analysis models IPI as competition for causal control and derives a risk bound under two assumptions.
The first assumption requires a positive benign log-probability gap favoring the user-aligned action over malicious alternatives.
Under the stated assumptions, Proposition 4.1 bounds malicious privileged actions by exponential decay, while sanitization’s effective margin is linked to the detection threshold.

5. Experiments

CausalArmor is evaluated on AgentDojo and DoomArena across utility, latency, and security, including adaptive attacks and ablations. It achieves near-zero attack success while preserving benign utility and latency, with threshold tuning controlling the security–usefulness trade-off.

Experimental Setup: AgentDojo evaluates four agent types across 70 tools and 629 injection tasks using benign utility, benign latency, utility under attack, and attack success rate.The study compares prompting, trained-classifier, and system-based defenses, using Gemini-2.5-flash as the default backbone and additional stronger backbones.
AgentDojo Results: Existing defenses often trade stronger security for higher latency or lower utility because they verify or sanitize continuously.Prompting is lightweight but brittle, classifiers can over-block benign outputs, and system-based defenses incur large API overhead.
AgentDojo Results: CausalArmor attains near-zero ASR while preserving benign latency and utility close to the No Defense baseline through selective sanitization of attribution-dominant untrusted spans.Figure 3 compares UA against ASR in attack scenarios and BU against BL in benign scenarios.
Trade-off from Always-on Sanitization to CausalArmor: At τ=0, CausalArmor already reduces ASR to near zero while largely preserving benign utility, and increasing τ provides controllable security–utility–latency trade-offs.The intervention sanitizes only when an untrusted span outranks the user request in attribution.
DoomArena Results: On DoomArena, CausalArmor neutralizes privileged adaptive attacks while preserving high benign utility, unlike classifier defenses that suffer severe over-defense.DoomArena gives the attacker access to conversation history and adaptive database manipulation, creating a stronger threat model than AgentDojo.
Ablation Study: Disabling retroactive CoT masking increases average ASR by 1.46% and decreases Benign Utility by 0.5% across models and attacks.The ablation attributes the security loss to poisoned reasoning traces that can re-anchor malicious intent after sanitization.
Ablation Study: Proxy models larger than 8B parameters identify most IPI attacks, while models exceeding 12B achieve near-perfect defense rates comparable to the oracle.The Gemma family provides a more Pareto-optimal latency–security balance than other evaluated families.
Empirical Support for Theoretical Assumptions: Tuning the detection threshold τ controls when sanitization is triggered, producing a practical security–utility–latency trade-off consistent with the theoretical assumptions.The empirical results support Assumptions 1–2 and the margin-based interpretation of the defense.

6. Conclusion

CausalArmor addresses the over-defense dilemma by using causal inversion to selectively activate defenses against indirect prompt injection. Experiments report near-zero attack success while preserving benign utility and latency near undefended settings.

CausalArmor operationalizes IPI as a causal inversion in which untrusted spans overtake the user request’s influence on privileged actions.
Selective attribution-based activation triggers expensive sanitization only when a threat is detected, unlike always-on defenses.
Near-zero Attack Success Rates on AgentDojo were achieved while maintaining benign utility comparable to defense-free agents.
Future work may extend CausalArmor to multimodal contexts and improve attribution for complex causal dependencies.

Impact Statement

CausalArmor is presented as a selective guardrail for mitigating unauthorized privileged actions while preserving benign utility and latency. Its potential benefits are accompanied by risks from adaptive evasion, proxy disclosure, restrictive deployment, and operational limitations.

CausalArmor targets unauthorized privileged actions while preserving benign utility and latency in tool-calling agents.
The study reports established, publicly available repositories and standard benchmarks for all included datasets.
Selective sanitization may reduce harmful tool calls, unnecessary over-blocking, and latency overhead compared with always-on defenses.
Attackers may distribute malicious influence across spans, exploit sanitizer weaknesses, or use disclosed proxy details to optimize evasion.
CausalArmor should be used within defense-in-depth because its guarantees are conditional and overhead can approach always-on sanitization when many steps are flagged.

A. Limitations and Future Research Directions

The paper identifies limits in its operational causality, robustness against highly distributed attacks, and dependence on sanitizer effectiveness. It proposes broader attribution tests and improved sanitizers as future directions.

Leave-one-out span removal measures operational counterfactual influence but is not a full structural causal model.
CausalArmor shows strong robustness against split-context strategies that rely on localized triggers in AgentDojo.
A theoretically optimal adversary could distribute causal influence so thinly that no individual span exceeds the detection threshold.
The framework selects when and where to sanitize but does not claim its specific sanitizer defeats all future obfuscations or distribution shifts.
In heavily adversarial regimes with many flagged steps, CausalArmor’s overhead can approach always-on sanitization.

B. Proof of Proposition 4.1

The proof decomposes the safety margin into baseline user-alignment and sanitization contributions, then converts their sum into exponential bounds on malicious-action probability. The threshold controls which spans are sanitized, but end-to-end security and utility need not vary monotonically with it.

The proof relates the benign baseline advantage and post-sanitization attribution margin to the log-probability gap between user-aligned and malicious actions.
The benign baseline advantage β represents the backbone’s preference for a user-aligned action after the explicit trigger is neutralized.
The sanitization benefit γ captures the additional margin produced when sanitized untrusted content disfavors malicious privileged actions.
The proof applies union bounds over malicious candidates and time steps to bound episode-level attack success.
A sufficiently large combined margin β+γ suppresses the probability of selecting any malicious privileged action exponentially.
B.2. How the detection threshold τ influences the effective margin γ: Increasing threshold τ sanitizes a weakly larger subset of spans and caps remaining per-span influence at detection time.
B.2. How the detection threshold τ influences the effective margin γ: End-to-end attack success and benign utility need not be monotone in τ because sanitization changes both preserved benign evidence and residual adversarial support.

C. Experimental Details

The evaluation uses AgentDojo and DoomArena to test CausalArmor against varied indirect-prompt-injection settings, including adaptive and multi-turn attacks. The method batches leave-one-out attribution, selectively sanitizes flagged spans, masks poisoned reasoning, and regenerates the action.

The evaluation adds task_dependency and tool_output_hijack templates alongside AgentDojo’s important_instructions template to simulate unseen attack vectors.
CausalArmor constructs batched full and ablated contexts, computes length-normalized LOO attributions, selectively sanitizes flagged spans, masks prior reasoning, and regenerates the action.
DoomArena evaluates a conversational setting with a privileged adaptive attacker that observes the conversation and can modify database information.
89.47% ASR occurs for Gemini-3-Pro without defense under DoomArena’s high-threat model.
Attack Utility is reported as zero-converging across methods because the attacker can delete essential ground-truth information, so the benchmark reports benign utility, benign latency, and ASR.

D. Implementation Details

The implementation combines figure-based validation, cloud-served agent and sanitizer models, batched proxy attribution, selective sanitization, and standardized baseline integrations. The sanitization prompt removes injected instructions while preserving task-relevant factual content.

Figure 7 compares pre- and post-defense LOO attribution scores, with post-defense scores showing suppressed injected-span influence and restored user-request dominance.
CausalArmor’s additional latency comes from LOO attribution for detection and sanitization of contexts flagged as suspicious.
Batched proxy inference evaluates the full context and all LOO-ablated contexts in one call, keeping sequential proxy invocations at O(1) while batch token-compute and memory scale as O(|S_t|).
Sanitization uses a full generation call with Gemini-2.5-flash and is triggered selectively to limit the defense’s main computational cost.
The sanitizer removes malicious instructions and injected prompts while preserving factual data relevant to the original user request.
The study compares against prompting, classifier, and system-level defenses using benchmark prompts, open-source classifiers, adapted DRIFT, and MELON integrations.

E.1. Robustness against Split-Context and Multi-turn Strategies

CausalArmor addresses split-context and multi-turn injections by detecting a decisive causal bottleneck at privileged actions and masking poisoned reasoning after input sanitization. This restores user-grounded planning in the illustrated recovery case.

AgentDojo evaluation finds CausalArmor robust against split-context attacks that fragment malicious instructions across turns or retrieved chunks.
Multi-turn attacks typically require a decisive trigger segment at the privileged call, creating a causal bottleneck that CausalArmor can detect.
Input sanitization alone may leave poisoned reasoning traces in dialogue history, allowing the agent to reproduce a malicious privileged action.
Retroactive CoT masking wipes post-injection reasoning traces and forces replanning from the user request and sanitized context.
Figure 8 depicts residual poisoned CoT leading through an intermediate tool call toward a malicious privileged action, whereas Figure 9 depicts masking followed by recovery and a correct rent update.