ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection

Shihao Weng; Yang Feng; Jinrui Zhang; Xiaofei Xie; Jiongchi Yu; Jia Liu

Source-linked AI summary

ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection

Shihao Weng, Yang Feng, Jinrui Zhang, Xiaofei Xie, Jiongchi Yu, Jia Liu

arXiv:2605.03378v2May 5, 2026cs.CRcs.SE

TL;DR

Prompt-injection research often misses tasks whose correct actions depend on runtime context and attacks tailored to that context. The paper introduces AgentLure and ARGUS, which audits whether each proposed action has a complete benign causal justification. On AgentLure, ARGUS reduces attack success rate from 28.8% to 3.8% while preserving 87.5% clean utility.

Problem
Existing benchmarks and defenses largely miss context-dependent tasks and context-aware attacks, where runtime evidence helps determine the action and may contain task-tailored injected instructions.
Method
ARGUS uses an Influence-Provenance Graph, runtime-span labeling, and argument grounding to release actions only when benign evidence supports them and task invariants hold.
Results
28.8% to 3.8%: ARGUS reduces attack success rate while preserving 87.5% clean utility at 1.24× token overhead.
Takeaways & Limitations
Complete causal verification achieves a stronger security-utility tradeoff than existing defenses for context-dependent tasks under context-aware attacks.
Takeaways & Limitations
ARGUS audits whether an action follows from an observed carrier but does not establish that the carrier itself is authentic.

Abstract

from arXiv · show

Large Language Model (LLM) agents are increasingly deployed as task-oriented software systems that use runtime context to decide and act on behalf of users. This delegation model makes prompt injection especially dangerous: an attacker can hide a context-aware instruction inside evidence the agent must use to decide what to do. Existing benchmarks and defenses largely miss this setting. Benchmarks often use context-insensitive tasks where the user prompt already specifies the intended action, together with generic attack payloads independent of context. Existing defenses also do not capture the causal support from runtime evidence to concrete actions, which makes them incomplete and ineffective for context-dependent tasks. We present AgentLure, a benchmark for context-dependent tasks under context-aware prompt injection. AgentLure spans four agentic domains and eight attack vectors across six attack surfaces. To defend this setting, we propose ARGUS, a causal-provenance auditor for LLM agents. Instead of relying only on tool authorization or suspicious-context detection, ARGUS verifies whether each proposed action has a complete benign causal justification. It builds an influence-provenance graph, labels runtime spans, grounds action arguments in supporting evidence, and releases an action only when benign evidence entails it and task invariants hold. On AgentLure, ARGUS reduces attack success rate from 28.8% to 3.8% while preserving 87.5% clean utility, significantly outperforming existing defenses in the security-utility tradeoff.

1 Introduction

Prompt injection becomes harder to defend when agents must use runtime context to resolve underspecified tasks and attackers tailor payloads to that context. The paper introduces AgentLure and ARGUS to evaluate and audit this setting.

Motivation: Context-dependent tasks require agents to obtain runtime context before deciding which action to take.Existing benchmarks often let the user prompt specify the intended action directly.
Motivation: Context-aware attacks tailor injected payloads to the task-relevant context that supports an agent’s decision.This setting combines ambiguous user requests with payloads designed for the surrounding task.
Limitations of Existing Defenses: Existing defenses can fail because checking action consistency with user intent does not verify the causal support supplied by runtime evidence.Figure 1 illustrates a representative ToolFilter failure in this setting.
Evaluation: 28.8% to 3.8%: ARGUS reduces attack success rate while preserving 87.5% clean utility at 1.24× token overhead.The benchmark contains 320 attack samples across 8 attack vectors, 6 attack surfaces, and 4 agentic domains.
Contributions: AgentLure benchmarks context-dependent tasks under context-aware attacks, while ARGUS audits proposed actions using causal provenance.ARGUS maintains an Influence-Provenance Graph and traces context and action arguments back to benign evidence.

2 Background

Tool-augmented agents use runtime context from multiple surfaces to resolve decisions that user requests leave unspecified. The paper formalizes context-dependent actions and context-aware injections by describing how injected context changes the agent’s next action.

Agent Pipeline: Many user requests leave decisions unresolved, so agents must use runtime context to choose which bill, operation, or message to act on.The same context that resolves these decisions may contain adversarial content.
Agent Pipeline: Runtime context can enter through retrieved documents, tool returns, memory records, installed skills, tool descriptions, and inter-agent messages.These are identified as injection surfaces in the agent pipeline.
Problem Definition: A task is context-dependent when its correct next action is a_t = π(q, C_t), where C_t is the runtime context observed before step t.The formalization separates the user request from context accumulated during execution.
Problem Definition: A context-aware injection replaces a task-relevant context item with c_j ⊕ p and succeeds when the resulting action differs from the task-equivalent action.The injected payload targets the decision that the modified context item is supposed to support.
Defense Model: A defense intervenes before state-changing execution and returns RELEASE or BLOCK based on auditing the agent’s decision state.The stated goal is to block payload-induced actions while releasing benign ones.

3 The AgentLure Benchmark

AgentLure benchmarks context-dependent tasks under context-aware prompt injection, coupling unresolved user requests with runtime evidence and attacks tailored to that evidence. It broadens evaluation across attack vectors, surfaces, domains, and security-utility metrics.

AgentLure evaluates LLM-agent defenses on context-dependent tasks under context-aware attacks.
Benchmark construction: Each sample couples an unresolved user request, runtime context, and a payload bound to surrounding task evidence.
Coverage: AgentLure covers 8 attack vectors across 6 attack surfaces and combines 4 domains with 10 tasks per domain.The benchmark contains 4 × 10 × 8 = 320 samples.
Attack design: The attack vectors include tool, argument, condition, and reasoning injection, alongside additional vectors defined for the benchmark.
Evaluation: AgentLure evaluates defenses with 7 metrics spanning security, utility, cost, and overall defense quality.
Evaluation: The benchmark includes metrics such as ASR, W-ASR, clean utility, attacked utility, and refusal rate.

4 The ARGUS Defense

ARGUS audits state-changing actions through causal provenance: it records runtime dependencies, separates benign from anomalous evidence, grounds arguments, and checks task invariants before execution. Actions are released only when benign evidence entails their arguments and the action preserves the user’s task constraints.

Overview: ARGUS is a causal-provenance runtime auditor that verifies complete benign causal justification for each state-changing action.
Overview: The Influence-Provenance Graph records causal dependencies among observations and actions, while task invariants anchor auditing to the user’s original task.
Context analysis: ContextSegmenter labels runtime spans BENIGN or ANOMALOUS by tracing backward through the provenance graph.ARGUS retains anomalous spans as audit information rather than simply deleting them, because deletion can reduce utility.
Runtime workflow: ARGUS releases an action only when its checks pass; otherwise, it blocks the action and returns a corrective hint for a safer retry.
Action auditing: ArgumentGrounder traces backward from each proposed action to identify evidence supporting every action argument.It can ground arguments in natural-language statements and referenced values, not only exact copied strings.
Action auditing: EntailChecker requires independent benign support for arguments, while InvChecker blocks actions that violate task type, scope, or authorization invariants.

5 Evaluation

The evaluation tests ARGUS across defense effectiveness, component ablations, and white-box adaptive attacks. ARGUS maintains a strong security-utility tradeoff because its causal audit verifies the chain from runtime evidence to authorized actions.

Evaluation Setup: ARGUS is evaluated on attack success, task utility, refusal, defense quality, token cost, and per-vector ASR.The study also reports ASR separately for all eight AgentLure attack vectors.
RQ1: Defense Effectiveness: ARGUS remains consistently low across all eight attack vectors, with worst-vector ASR no higher than 7.5%.Baseline defenses are uneven: text-level defenses leave several vectors vulnerable, while execution-level defenses remain weak on others.
RQ1: Defense Effectiveness: ARGUS transfers to existing benchmarks, reducing ASR from 38.1% to 5.0% on AgentDojo, from 19.8% to 1.8% on BIPIA, and from 40.0% to 0.0% on ASB.It also improves AgentDojo EDS from 40.2% to 65.5%, preserves BIPIA clean utility at 72.5%, and yields 0.0% refusal on ASB.
RQ1: Defense Effectiveness: ARGUS outperforms baseline families because it verifies whether each state-changing action is causally supported by benign evidence rather than relying on prompt authorization or context suppression.This preserves useful benign context while preventing anomalous context from serving as valid execution evidence.
RQ2: Ablation Studies: Removing ContextSegmenter causes the largest ablation degradation, raising ASR from 3.8% to 25.0% and reducing EDS from 84.2% to 71.3%.Removing EntailChecker, InvChecker, and ArgumentGrounder raises ASR to 11.2%, 8.1%, and 7.5%, respectively.
RQ3: Adversarial Robustness: ARGUS remains robust under white-box adaptation: trace-guided adaptive attacks raise ASR from 3.8% to 5.9%, while seven of eight vectors remain at or below 7.5%.The main degradation is HI, which rises from 2.5% to 15.0%, because handoff messages naturally carry claims about prior intent and delegated authority.

6 Discussion

ARGUS treats each action’s causal justification as the security object, auditing whether evidence supports the concrete action while preserving valid context-dependent behavior. The discussion also identifies carrier integrity as a boundary and evidence-aware recovery as a future direction.

Implications: ARGUS audits an action’s causal justification rather than stopping at text classification or tool authorization.It blocks actions whose evidence is anomalous or unsupported, even when they resemble the user’s task.
Implications: Runtime context has conditional authority: it may drive execution only when the relevant action receives support from the checked causal chain.The landlord notice in Case S2 resolves the user’s request because its update evidence has valid causal support.
Implications: Task invariants and provenance play different roles: boundaries specify authorized action types, while provenance explains why a concrete action was selected.Case S1 passes the task boundary but fails provenance; Case S2 passes both; Case S3 fails both.
Future Work: Carrier integrity remains outside ARGUS’s guarantee because a forged invoice can make an attacker’s account appear to be the only available evidence.The discussion recommends combining causal auditing with signed records, source authentication, issuer checks, and cross-record consistency tests.
Future Work: Evidence-aware recovery can turn blocking into repair by returning hints that direct the agent toward information needed for a safer retry.Future improvements include ranking benign alternatives, requesting independent evidence when carriers are ambiguous, and avoiding attacker-helpful hints.

7 Related Works

Related work studies LLM agents, prompt injection, benchmarks, and defenses, but existing evaluations often assume the user prompt already determines the intended action. ARGUS addresses this gap by checking the complete causal chain from the task and benign runtime evidence to each state-changing action.

Agent Systems: Agent research frames reliability as a system property shaped by long-horizon connections among evidence, actions, tools, environments, tests, and feedback.AgentLure applies this system view to adversarial failures in which untrusted runtime context supports harmful actions.
Benchmarks: Benchmarks such as ToolEmu, AgentDojo, and ASB mostly evaluate tasks where the user prompt already determines the intended action.Prior work also exposes risks from poisoned tool outputs, memory, retrieval, indirect sources, and multi-agent sources.
Prompt Injection: Prompt-injection research progressed from crafted prompts and indirect attacks to universal triggers, optimized suffixes, genetic search, and black-box optimization.These attacks place adversarial instructions either directly in inputs or in external data consumed later by the model.
Defenses: Existing defenses transform or annotate inputs, train instruction-data separation, or add guard models and detectors.They are less complete when legitimate behavior requires runtime context and attacks become clear only at the action level.
ARGUS: ARGUS complements prior defenses by checking the complete causal chain from the user’s task and benign runtime evidence to each state-changing action.The paper connects this provenance requirement to degradation under adaptive attacks.

8 Conclusion

The paper studies prompt injection when correct agent actions depend on runtime context, introducing AgentLure for evaluation and ARGUS for causal verification. It reports that complete benign causal verification achieves a stronger security-utility tradeoff than existing defenses.

Conclusion: The paper introduces AgentLure for context-dependent prompt-injection evaluation and ARGUS to verify complete benign causal support for each state-changing action.Its conclusion reports a stronger security-utility tradeoff than existing defenses.