CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?

• Agents’ extensive execution privileges and exposure to untrusted input channels make prompt injection a threat to operational pipelines and production environments.Source: §1 · p. 1
• Existing defenses trade runtime efficiency, contextual precision, and post-deployment adaptability: filters are obfuscatable, LLM guardians costly and false-positive prone, and static boundaries cannot absorb new payloads.Source: §1 · p. 2
• CAITLYN is an agent-agnostic middleware that separates pre-verified runtime defense skills in System I from System II’s attack-triggered synthesis loop.Source: §1 · p. 2
• System II treats bypassing payloads as counterexamples, iteratively generates candidate skills, and deterministically verifies them against attack and benign datasets before deployment.Source: §1 · pp. 2–3
• System I starts with 24 skills across three categories: Tier 0 uses no-LLM scripts, while Tier 1 applies compact LLM detection; System II’s monitor supports adaptation under benign constraints.Source: §1 · p. 2
• CAITLYN matches state-of-the-art detection on standard benchmarks with lower token overhead than LLM-as-a-judge baselines, while System II substantially reduces attack success across three agent environments on Emerging.Source: §1 · p. 2

2.1 Background

• Agents combine reasoning and planning, tool actuation, and memory, while external observations enter their context and become entangled with internal instructions.External observations include web results, repository files, API payloads, and third-party MCP tool outputs.Source: §2.1 · p. 3
• Prompt injections, jailbreaks, and poisoned data or state can hijack agent execution, enable privileged tool use, or persist compromise across the agent lifecycle.The passage identifies direct and indirect injections, poisoned tuning data and knowledge bases, backdoored memory, and malicious MCP responses.Source: §2.1 · p. 3
• Input filtering, model hardening, and system-level isolation defend against manipulation, but existing approaches trade runtime efficiency, detection precision, and post-deployment adaptability.Static rules can be brittle against semantic evasion, while heavyweight evaluators and manual policies do not dynamically absorb novel variations.Source: §2.1 · pp. 3–4

2.2 Threat Model

• The user prompt is trusted, but referenced external content is untrusted and mediated by CAITLYN inspection hooks, except when implementation issues such as timeouts occur.The trusted computing base includes the agent host runtime, model or model service, and CAITLYN daemon with its defense repository.Source: §2.2 · pp. 4–5
• Adversaries seek confidentiality or integrity violations, not benign task degradation, and can craft obfuscated payloads but cannot alter system prompts, model weights, or API credentials.They may use black-box query access, tool-interface and parameter-schema knowledge, and public outputs or execution traces to refine evasion.Source: §2.2 · pp. 4–5
• Emerging attacks are absent from the seed corpus, baseline skill authoring and verification, and seeded signatures; the threat model tests whether few observed counterexamples enable verified defenses without sacrificing benign utility.The paper notes that completeness against unconstrained future payloads is beyond empirical synthesis guarantees and evaluates mitigation rates across emerging attack families.Source: §2.2 · p. 5

3.1 Skills as the Unit of Defense Knowledge

• Each defense skill is a portable, self-contained directory with a natural-language specification, standardized metadata, and optional prompts and executable scripts for heterogeneous defenses.The format is intended to support human review and revision while accommodating rule-based matching and LLM-based judgment.Source: §3.1 · pp. 5–6

3.2 Hierarchical Organization of Defenses

• System I first routes each input through the Tier 0 Filter, which returns MALICIOUS if any skill labels it MALICIOUS with confidence at least its threshold; otherwise, it forwards input to Tier 1.Tier 1 packs active LLM-based defense skills into two parallel API calls; their identical shared prefixes enable provider-side prompt caching, and their verdicts are OR-aggregated.Source: §3.2 · p. 8

3.3 Evolution of Defenses: Counterexample-Guided Skill Synthesis

• System II treats defense-bypassing payloads as counterexamples and monitors agent, filesystem, and host-network signals to mine attack payloads or analyze user-submitted candidates.It can operate offline while synthesized skills are finalized for integration into System I.Source: §3.3 · p. 8, §3.2 · p. 8
• System II’s generator adapts existing skills using attack characteristics and similar corpus samples, while a sandbox, independent reviewer, and lesson database critique and inform iterations.Iterations are bounded by maximum rounds, token budgets, and acceptance criteria.Source: §3.3 · pp. 8–9

3.4 Engineering Details

• CAITLYN runs as agent-agnostic middleware with execution hooks, filesystem watchers, and OS telemetry, and includes operational, privacy, and synthesis-rate guardrails.Hooks fail open by default, inputs are capped at 1 MiB with head-and-tail truncation, and synthesis defaults to a 60-minute cooldown and 10-run daily cap; cloud synchronization is opt-in and human-audited.Source: §3.4 · p. 9

4.1 Experimental Settings

• Evaluation spans five coding and daily-assistant agents across AgentDojo, ASPI, and SafeClawBench, with Emerging added to investigate defenses against emerging attacks.AgentDojo has 97 tasks and 629 security tests; ASPI has 728 scenarios, and SafeClawBench has 600 staged tasks across six attack families. The evaluation also uses seven baselines, including no defense, regex filtering, LLM judges, content delimiting, write-tool filtering, and a pretrained injection classifier.Source: §4.1 · p. 10
• Security is measured with Action ASR and detection metrics; benign-operation impact uses FPR and Utility, while efficiency uses latency and financial cost.Detection quality includes TPR, FPR, Precision, and Recall; Utility is the safe-completion rate, and financial cost is reported in USD.Source: §4.1 · pp. 10–11

4.2 Detection-Only Evaluation

• CAITLYN matches LLM judges' perfect recall on AgentDojo, ties the top judge at 76.3% TPR on ASPI-S, and records the highest TPR on SafeClawBench-S240 and AgentDefense-S250.Those highest TPRs are 63.7% and 76.4%, respectively; default inspections take 2.1 to 2.5 seconds and cost less per sample than either LLM judge.Source: §4.2 · p. 12

4.3 End-to-end Evaluation

• CAITLYN reduces ASR to 0.0% on four of five AgentDojo agents, at most 2.2% on ASPI, and 2.1% to 5.8% on SafeClawBench.On ASPI, it matches or stays within 1.1 percentage points of the top-performing baseline. Its FPR is 0.0% on AgentDojo but 12.9% to 19.4% on ASPI; the latter reflects conversational benign controls that mimic attacks under the full-prompt protocol.Source: §4.3 · p. 12

4.4 Ablation Study

• The full two-call OR schema reaches 100.0% TPR on AgentDojo-S250 and 89.2% on ASPI-S, with 3.2% FPR versus the ensemble's 6.8%.It matches or stays within 2.2 percentage points of the ensemble's detection coverage, outperforms it on SafeClawBench-S240, and in this paired run takes 5.17 s and costs 0.00100 USD per inspection. Tier-0 alone costs nothing and has zero false positives, but its TPR ranges from 3.2% to 48.4%.Source: Table 2 · p. 12, §4.4 · p. 13

4.5 Influence of LLM Backbones

• Across nine backbones, CAITLYN keeps ASR at or below 3.3%, with five models at 0.0%; GPT-5.6-Sol reaches 60.4% utility at 0.0% ASR.Latency ranges from 8.9 to 17.1 seconds and per-case cost spans more than two orders of magnitude, while the most expensive model offers no security advantage over models costing up to two orders of magnitude less.Source: Table 3 · p. 13, §4.5 · p. 13

5.1 Adaptation to Emerging Attacks

• Emerging embeds injection intent in domain-specific content across file, search, and webpage observations, capturing end-to-end traces through downstream agent compromise.Examples include manipulated vendor contact records, poisoned mirror URLs, and redirected authority pages.Source: §5.1 · p. 13
• 38.5% on OpenClaw and 39.5% on both Codex and Hermes: CAITLYN-evolved cuts Emerging end-to-end ASR by about 40 percentage points.CAITLYN-static ASRs were 77.0%, 79.5%, and 77.5%, respectively. The evolved configuration incorporates four verified skills synthesized from static detection misses.Source: Figure 6 · p. 14, §5.1 · p. 14
• In a representative OpenClaw case, a synthesized skill blocks a poisoned contact whose attacker-controlled endpoint contradicts a legitimate security contact in the ingested file.Static CAITLYN and all baseline defenses allow the payload to reach the agent; CAITLYN-evolved isolates it before downstream actions.Source: Figure 7 · p. 14, §5.1 · p. 14

5.2 Lifelong Synthesis Experiments

• The lifelong evaluation streams 200 cases across nine attack families, isolating current-family seed misses from held-out cases and future families at each wave.Static, Batch, and Sequential start from identical states; Sequential retains a lineage graph, and candidate skills must pass multi-sample trigger and benign over-broadness filters.Source: §5.2 · p. 15
• 30.0% held-out TPR at 1.6% FPR: Sequential synthesis raises coverage from Static’s 16.0% held-out TPR at 1.6% FPR, while Batch spends 20,331 tokens and synthesizes no valid skill.Sequential accumulates four active skills; newly admitted skills do not reduce prior-family detection counts, though large seed clusters within a wave remain a synthesis bottleneck. Table 4 measures held-out TPR on 100 cases and FPR on a shared benign pool.Source: Table 4 · p. 15, Figure 8 · p. 15, §5.2 · p. 15

5.3 Adaptive Attacks

• 33.6% net evasion rate on the blocked set: an adaptive rewriter bypasses detection on 38 of 113 previously blocked cases within five queries, while exhausting its budget on 25.Fifty cases contain invariant target strings matching evolved signatures and cannot be adaptively evaded; the adversary has visibility into four OpenClaw skills but cannot tamper with the daemon or local disk.Source: §5.3 · pp. 15–16
• A single System II update restores detection across all 38 adaptive variants, with benign-pool FPR rising from 0.4% to 2.0%.The evaded payloads are supplied back to System II for another synthesis iteration.Source: §5.3 · p. 16
• CAITLYN mitigates library poisoning by disabling cloud synchronization by default and requiring local verification, independent review, and human expert auditing before remote artifacts are distributed.Remote submissions never automatically activate on client nodes.Source: §5.3 · p. 16

6 Conclusion

• CAITLYN matches existing defenses’ detection accuracy on standard benchmarks with lower token overhead than LLM-based baselines, while its adaptation loop closes novel-attack coverage gaps without significantly increasing false positives.On Emerging, static baselines remain vulnerable to novel injection vectors.Source: §6 · p. 16
• System I provides immediate, low-latency inspection through a tiered gatekeeper, while System II turns runtime detection misses into verified, reusable defense skills through autonomous lifelong evolution.Source: §6 · p. 16
• CAITLYN abstracts security controls into executable, modular defense skills to address the trilemma among runtime efficiency, contextual precision, and post-deployment adaptability.Source: §6 · p. 16

Appendix 7. Synthesis Internals

• Appendix 7 covers synthesis internals, overfitting controls, prompts and configuration, system wrappers, skill prompts, defaults, and the Tier-0 script contract.Its subsections are 7.1 and 7.2.1–7.2.4.Source: Appendix Outline · p. 20

Appendix 9. Extended Evaluation

• Appendix 9 presents extended evaluation materials, including supplementary detection results, Emerging benchmark results, synthesis waves, adaptive attacks, and case traces.Its subsections cover 9.1–9.5.Source: Appendix Outline · p. 20

Appendix 8. Defense Library Artifacts

• Appendix 8 documents defense-library artifacts through a skill inventory, synthesized-skill evolution lineage, and evolution-run statistics.Its subsections are 8.1–8.3.Source: Appendix Outline · p. 20

Appendix 10. Engineering Notes

• Appendix 10 provides engineering notes on defense-repository security analysis and the terminal user interface.Its subsections are 10.1–10.2.Source: Appendix Outline · p. 20

Appendix 9. Extended Evaluation

• Appendix 9 presents full detection-only and Emerging results, including end-to-end and per-family ASR, synthesis-wave details, evasion and re-vaccination, and OpenClaw case traces.It includes Table 6, Figure 14, Tables 7–10, and Figure 15.Source: Appendix Figures and Tables · p. 20

Appendix 7. Synthesis Internals

• Appendix 7 shows the merged-pair wrapper, Tier-1 instruction-hierarchy prompt, and Tier-0 detector input/output contract.These synthesis internals appear in Figures 9–11.Source: Appendix Figures and Tables · p. 20

Appendix 8. Defense Library Artifacts

• Appendix 8 documents the shipped defense skill library and the lineage and evolution statistics of synthesized skills in the Emerging experiment.It includes Table 5 and Figures 12–13.Source: Appendix Figures and Tables · p. 20

Appendix 10. Engineering Notes

• Appendix 10 covers repository-update poisoning defenses and CAITLYN’s CLI and terminal interface, including commands, library inventory, telemetry, and scan behavior.It includes Figures 16–22 and Table 11.Source: Appendix Figures and Tables · p. 20

7.1 Overfitting Controls in Skill Synthesis

• A synthesized skill must match every attack trigger while flagging at most one benign sample; the generator sees attack summaries, graph metadata, and prior failure feedback, not raw trigger text.Nearest-neighbor samples guide generation but do not affect formal acceptance; regex checks run in an isolated process with a 200-millisecond timeout and static analysis.Source: §7.1 · p. 21

7.2.1 Merged-Pair System Wrapper

• Tier-1 merged-pair calls share a wrapper but pack detector skills versus other tier-greater-than-zero skills, then OR their verdicts; untrusted content appears only in a delimited user suffix.The byte-identical wrapper supports provider-side prompt caching across repeated scans of the same library snapshot.Source: §7.2.1 · p. 21, Figure 9 · p. 22

7.2.2 Tier-1 Skill Prompt Example

• The instruction-hierarchy Tier-1 skill encodes a four-level authority ordering and covers impersonation, priority inversion, authority confusion, and chain-of-trust failures.It is representative rather than exhaustive; other Tier-1 detectors use the same packaging pattern for different attack families.Source: §7.2.2 · pp. 21–22, Figure 10 · p. 23

7.2.3 Evolution Configuration Defaults

• Defaults admit unknown-threat proposals as shadow candidates; synthesis allows up to three proposals per round and five CEGIS rounds or 40,000 tokens, with promotion considered after 50 scans within seven days.Sample-backed proposals may be recorded, shadowed, or promoted directly depending on the autonomy setting.Source: §7.2.3 · pp. 22, 24

7.2.4 Tier-0 Script Contract

• Tier-0 scripts accept content through stdin or detect(content) and return a JSON verdict; sandbox failures are treated as misses and return benign with zero confidence.One-shot execution uses a child process; resident workers avoid per-scan startup, and scripts run without network or filesystem write access.Source: §7.2.4 · p. 24, §7.2.3 · p. 24, Figure 11 · p. 24

8.1 Defense Skill Inventory

• The shipped library contains 24 skills: 14 Tier-0 detectors run on every scan, eight Tier-1 skills run after escalation, and two tier-2 entries provide reference knowledge only.Each skill has a YAML contract; Tier-0 skills include executable scripts, and the shared folder interface lets System II materialize replacements without changing runtime dispatch.Source: §8.1 · pp. 24–25, Table 5 · p. 25

8.2 Evolution Lineage of Synthesized Skills

• The four retained Emerging skills are narrow Tier-0 predicates derived from seed failures, combining single-line structure, bounded length, high entropy, and pipe-to-shell patterns.Their lineage demonstrates traceability rather than generalization: precise length-band signatures are easy to audit but can be evaded by rewriting.Source: §8.2 · pp. 25–26, Figure 12 · p. 26

8.3 Evolution Run Statistics

• 59 of 77 evolution runs accept no skill; 18 accepting runs materialize 24 skills, but only four survive filtering, while adaptation costs about 2.18 million generator tokens.31 runs exhaust all five rounds and 21 exhaust the token budget; rejected hypotheses account for most of the adaptation cost.Source: §8.3 · p. 26

9.1 Detection-Only Supplementary Results

• CAITLYN reaches the highest or tied recall on every dataset at lower per-sample cost and latency than both LLM judges.Table 6 reports default-threshold TPR and FPR, mean per-sample latency, and mean per-sample USD cost; its values are not included in the supplied passages.Source: §9.1 · p. 26, Table 6 · p. 27
• The Tier-0-only signature path takes 0.01 seconds, while parallel Tier-1 calls dominate measured wall-clock time and return a status code and confidence score.Provider queueing can extend the two-call schema from 2.1–2.5 seconds in the detection-only sweep to 5.17 seconds in the Full entry.Source: §9.1 · pp. 26–27
• Of 77 System II evolution runs, 18 terminated with acceptance and 59 without a skill; the accepted runs produced 24 skills, of which four remained after filtering.The experiment used about 2.18 million generator tokens; this is the end-to-end Emerging vaccination, not the nine-wave sequential study.Source: Figure 13 · p. 27

9.2 Emerging Benchmark Statistics and Full Results

• On Emerging, the evolved library reduces Status Field and Policy Delta to 0.0% ASR on all three agents, and Search Mirror to 0.0% on OpenClaw and Codex and 4% on Hermes.Freshness Framing, Latest Event, Directory Alias, and Ledger Update remain partially vulnerable; Table 8 reports per-family ASR.Source: §9.2 · p. 27, Table 8 · p. 28
• Emerging contains 200 attack cases across nine attack families and ten generation templates, with a distinct attacker target for every case.Distinct targets prevent signatures memorizing one target string from inflating results.Source: §9.2 · p. 27
• Static defenses and the initial System I library reach 72.5%–80.0% ASR on every agent, while the evolved library reaches 38.5% on OpenClaw and 39.5% on Codex and Hermes.These end-to-end Emerging results are reported in Table 7.Source: §9.2 · p. 27, Table 7 · p. 28

S-I S-II

• On Hermes, Ledger Update ASR rises from 88% under the initial library to 100% after evolution.The four retained end-to-end skills were synthesized from pipe-to-shell seed failures, not from the families in the separate sequential detection-only stream.Source: S-I S-II · p. 29

9.3 Lifelong Synthesis Wave Detail

• Ledger Update and Mail Followup reach 100% held-out TPR in the sequential stream, while its false-positive rate stays at 1.6% on every wave.Most large families terminate without a surviving skill; Policy Delta retains one skill but stays at 7.7% current-family held-out TPR, matching the static rate. Operational Command is skipped because the static library already blocks its seed misses.Source: §9.3 · p. 29, Table 9 · p. 29

9.4 Adaptive Attack Protocol and Outcomes

• Of 63 target-preserving cases, the rewriter escapes 38 within five queries; re-vaccination detects all 38 and raises benign-pool false positives from 0.4% to 2.0%.The 50 target-collision cases cannot miss by construction. These are scan-oracle rates, not agent outcomes, and bound one-shot robustness against an adversary who can read deployed predicates.Source: §9.4 · p. 30, Table 10 · p. 30

9.5 Case Traces on Emerging

• OpenClaw traces show evolved skills blocking two cases accepted by static defenses, while an uncovered freshness-framing case remains compromised.The residual coverage gap matches the quantified coverage profile and is a scenario for another counterexample-guided round in a long-running deployment.Source: §9.5 · p. 30

10.1 Defense Repository Security Analysis

• The defense repository is part of CAITLYN’s trusted computing base, and poisoning risk remains if plausible contributions pass expert review or an attacker compromises operator authentication.The adversarial model excludes both paths, leaving end-to-end poisoning campaigns against the curation pipeline as an open research direction.Source: §10.1 · pp. 30–31, Figure 16 · p. 32
• Cases 1–2 are blocked by the evolved library while static defenses and CAITLYN-static are compromised, but Case 3 remains compromised because its freshness-framing family is uncovered.Source: Figure 15 · p. 31
• The local repository is writable only by System II or an authenticated operator; candidates require deterministic verification and a clean observation window or explicit approval before activation.Cloud synchronization is off by default; when enabled, remote skills require human audit and never auto-activate.Source: §10.1 · p. 31

10.2 Terminal User Interface

• The CLI supports one-shot scans, library inspection, and telemetry, while the TUI provides the same defense surface through slash commands, overlays, and a streaming chat pane.Source: §10.2 · pp. 31–32
• TUI sessions persist as append-only JSONL logs for reproducibility, and its dashboard reads the statistics events that trigger System II so operators can observe anomalies before an immune response.Source: §10.2 · p. 32, Figure 22 · p. 34