PaperlayerView exact revision on arXiv

Source-linked AI summary

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

Bingzheng Wang, Xiaoyan Gu, Wentao Wang, Xingyou Yang, Hongcheng Li, Rong Yin

arXiv:2609.14987v1cs.CRcs.AI

TL;DR

Tool outputs can inject instructions that manipulate LLM-agent actions, creating a challenge of preserving flexible execution while pinpointing malicious evidence. ActGuard audits actions against a local tool prior and maintains low attack success rates and high task utility across models and adaptive attacks.

  • Problem

    The central challenge is preserving execution flexibility while precisely locating malicious instructions that induce unsafe actions without discarding task-relevant content.

    Source: §1 · p. 1

  • Method

    ActGuard audits candidate actions against a task-state-adaptive tool prior, localizes tool or parameter deviations, and masks verifier-confirmed malicious spans before regenerating actions.

    Source: §1 · p. 2, Overview · p. 2, §6 · p. 7

  • Results

    Across multiple backend models and adaptive attacks, ActGuard maintains low attack success rates and high task utility, with utility close to the no-attack setting.

    Source: §1 · p. 2, Comparison on AgentDyn · p. 5

  • Takeaways & Limitations

    ActGuard provides a better balance among security, utility, and execution cost than the evaluated alternatives.

    Source: Computational Cost · p. 7

    For verifier-directed attacks, the evaluation uses coarse payload-overlap annotations because identifying core instructions at the fragment level would require subjective judgments.

    Source: Verifier-Directed Attack · p. 14

Abstract

from arXiv · show

Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prompt injection (IPI) attacks. Existing defenses mainly rely on prompt hardening, content filtering, pre-generated plans, or permission constraints. These approaches often struggle with complex tasks or over-sanitize external content, making it difficult to balance security and utility. The key challenge is therefore to preserve execution flexibility while precisely identifying and removing the malicious content that actually induces unsafe actions. To address this challenge, we propose ActGuard, a pre-execution action auditing framework. Rather than judging whether external content is inherently suspicious, ActGuard assesses whether it causes the current action to deviate from a locally reasonable expectation. At each step, ActGuard predicts the tools likely to be used by the upcoming action and constructs a local tool prior without constraining the execution trajectory. Before execution, it compares the candidate action against this prior and performs tool-level contrastive analysis and parameter-level evidence localization to identify deviations in tool selection and action parameters. A verifier then examines the localized evidence, masks only spans confirmed as malicious, and regenerates the action from the sanitized context. This design preserves legitimate planning flexibility while minimizing information loss from indiscriminate filtering. We evaluate ActGuard on challenging benchmarks for tool-using agents. Results show that ActGuard reduces attack success rates to a level comparable to state-of-the-art defenses while maintaining task utility close to the no-attack setting, achieving a favorable security-utility trade-off. Our code is publicly available at: https://github.com/binzhwang/ActGuard.

1 Introduction

Indirect prompt injection exploits tool outputs to steer LLM agents toward unauthorized actions. ActGuard audits candidate actions before execution, localizes action-inducing evidence, and selectively sanitizes confirmed malicious content to preserve flexibility while improving security and utility.

Problem

Motivation

  • Dynamic tasks make fixed plans brittle, while sparse injections that resemble legitimate content require precise localization; coarse filtering can suppress useful information, whereas permissive defenses leave attacks unchecked.These tensions make it difficult to distinguish legitimate replanning from injection-induced deviations and attribute deviations to their causes.Source: §1 · p. 1

ActGuard

  • ActGuard audits each candidate action before execution against a state-adaptive local tool prior, then verifies localized evidence and regenerates actions after masking confirmed malicious spans.The tool prior guides auditing without fixing or constraining the execution trajectory.Source: §1 · p. 2
  • Its dual-granularity localization checks unexpected tool choices through contrastive attribution and traces historical provenance for potentially contaminated action arguments.A verifier confirms localized evidence before context sanitization.Source: §1 · p. 2

Evaluation

  • ActGuard reduces ASR to levels comparable to state-of-the-art defenses while keeping task utility close to attack-free settings; evaluations across backend models and adaptive attacks report low ASR and high utility.The paper describes this as a substantially better security–utility trade-off than existing methods.Source: §1 · p. 2

2 Problem Setting

The setting models a tool-using LLM agent whose actions depend on the user request and interaction history, while attackers can inject instructions through external content. The defense must judge actions without knowing the injection or attack set while minimizing attack success and retaining task completion.

LLM Agent

  • An agent selects a tool and arguments from the user request and interaction history, executes the action, and appends the resulting observation to that history.Observations may come from webpages, emails, or other untrusted sources and may contain task information or indirect prompt injections.Source: LLM Agent · p. 2

Threat Model

  • An attacker cannot alter the request, system instructions, policy, or tools, but can inject instructions into external content that may influence later actions.An attack succeeds when an executed action at any later step belongs to the attack objective's action set, which may constrain the tool or its arguments.Source: Threat Model · p. 2
  • Without knowing the injected instruction or attack-action set, a defense must decide whether to pass or block an action while minimizing attack success and retaining task completion.Source: Threat Model · p. 2

3 Method

ActGuard audits candidate actions against a dynamic local tool prior without fixing the full execution trajectory. It localizes evidence of tool or parameter deviations, masks only verifier-confirmed malicious spans, and regenerates the action from sanitized context.

Overview

  • ActGuard combines step-wise planning, dual-granularity evidence localization, and verifier-guided sanitization to audit actions while preserving legitimate information.The verifier masks confirmed malicious content and regenerates the action from the sanitized interaction history.Source: Overview · p. 2, Figure 1 · p. 3

Step-wise Planning

  • ActGuard predicts plausible next-step tool names alongside the current action, using them as a dynamic local reference rather than an execution whitelist.Because future arguments depend on observations not yet seen, it predicts tool names but not arguments; the reference adapts to new observations.Source: Step-wise Planning · p. 3

Dual-Granularity Evidence Localization

  • ActGuard searches fine-grained chunks from untrusted observations, merging semantically near-duplicate chunks to reduce attribution underestimation.This limits the evidence search to untrusted content rather than the full history, where injections could be diluted by irrelevant content.Source: Dual-Granularity Evidence Localization · p. 3

Tool-Level Localization via Contrastive Attribution.

  • For tool deviations, ActGuard retrieves relevant chunks and scores whether masking each chunk reduces the candidate tool’s advantage over a plausible prior tool.Chunks whose contrastive attribution exceeds threshold τ are forwarded to the verifier.Source: Tool-Level Localization via… · p. 3

Argument-Level Localization via Explicit Parameter Anchoring.

  • When the tool matches the local prior, ActGuard retrieves source chunks matching candidate arguments to expose potentially manipulated addresses, URLs, or commands.These explicit parameter anchors are sent to the verifier as argument-level evidence.Source: Argument-Level Localization via… · p. 4

Verifier-Guided Context Sanitization

  • The verifier assesses localized evidence with neighboring context, masks only chunks confirmed as IPI, and regenerates and re-audits the action before execution.If no malicious evidence is confirmed, the action passes; otherwise, the regenerated action reaches the executor only after another audit finds no confirmed malicious evidence.Source: Verifier-Guided Context Sanitization · p. 4

4 Experiments

ActGuard is evaluated on AgentDyn and AgentDojo using task-utility and attack-success metrics; the experiments examine its benchmark performance, auditing components, robustness, and cost.

Experimental Setup

  • AgentDojo includes 97 benign tasks and 629 security cases, while AgentDyn includes 60 benign tasks and 560 injection cases; both are evaluated using NAU, UAU, and ASR.AgentDyn has longer trajectories, more cross interactions, and legitimate third-party instructions; NAU measures task completion without attack, UAU completion under injection, and ASR attacker-objective completion.Source: Experimental Setup · p. 4

Main Results

  • ActGuard maintains low ASR with utility close to the no-attack setting on AgentDyn and achieves the best overall security–utility performance on AgentDojo.On AgentDojo, DRIFT is the only baseline with comparable results; shorter trajectories make planning constraints less likely to block legitimate actions.Source: Figure 3 · p. 5, Comparison on AgentDyn · p. 5, Comparison on AgentDojo · p. 5

Tool Prior Analysis

  • The step-wise tool prior retains high coverage under attack, unlike global plans, which rarely match benign trajectories and fail under attack.Updated from the latest observation, the prior reduces long-horizon uncertainty while preserving legitimate replanning.Source: Tool Prior Analysis · p. 5, Table 1 · p. 5

Evidence Localization Analysis

  • Contrastive attribution improves recall, reduces ASR, and preserves UAU across evaluated models, while threshold choice trades attack coverage against verifier calls, precision, and utility.A threshold of 0 is used in the main experiments; recall remains below 100% when payloads span adjacent chunks, addressed by verifying neighboring chunks and re-auditing regenerated actions.Source: Evidence Localization Analysis · p. 6, Figure 4 · p. 6

Verifier Adaptation

  • GPT-5-mini provides the best balance of low ASR and high utility among the tested verifiers and is selected as the default.GPT-4o-mini has high recall but lower precision, leading to more benign spans being misclassified as injections and lower utility.Source: Verifier Adaptation · p. 6, Table 2 · p. 6

Adaptive Attacks

  • Repeated payloads do not increase ASR, and verifier-directed instructions cause no ASR increase and little change in task utility.Repeated injections can lower UAU by consuming the benchmark’s attempt budget through additional audits and action regenerations; verifier-directed instructions are treated as audited data, not trusted control text.Source: Repeated-Payload Stress Attack · p. 6, Figure 5 · p. 6

Computational Cost

  • ActGuard incurs moderate overhead over no defense while costing less than system-level methods, with latency mainly from local-proxy probability-margin computation.Localized sanitization avoids unnecessary blocking and retries, whereas system-based methods may require intermediate-code repairs or repeated tool reselection.Source: Computational Cost · pp. 6–7, Table 3 · p. 7

Component Ablation

  • ActGuard has the best overall security–utility trade-off; removing argument-level localization causes the largest degradation, showing tool-level auditing alone misses parameter contamination.Removing embedding retrieval increases ASR and token cost, removing log-probability filtering mainly reduces utility, and removing the contrastive reference weakens security.Source: Component Ablation · p. 7, Table 4 · p. 7

5 Related Work

Related work frames indirect prompt injection as a system-level threat and surveys defenses that seek to prevent or detect it. Existing approaches face trade-offs between security, task utility, and precise localization of malicious triggers.

Indirect Prompt Injection Attacks

  • IPI turns untrusted webpages, emails, and tool outputs into executable instructions, while benchmarks have expanded from single-turn attacks to realistic tool execution and long-horizon utility.The cited benchmarks include InjecAgent, AgentDojo, ASB, and AgentDyn.Source: §5 · p. 7
  • IPI research now spans adaptive and retrieval-aware, multimodal and computer-use, cross-component, and persistent attacks across retrieval, tools, memory, and environmental execution.Examples include Adaptive Attacks, AgentVigil, LLMail-Inject, WebInject, VPI-Bench, Prompt Infection, MSB, and memory poisoning.Source: §5 · p. 7

Defenses against Indirect Prompt Injection

  • Defenses include prompt-based, alignment-based, filter-based, and system-based methods, alongside approaches that localize external evidence influencing candidate actions.Examples include Spotlighting, StruQ, PromptGuard, Task Shield, CaMeL, and methods using content ablation, counterfactual re-execution, or attention analysis.Source: §5 · p. 7
  • These defenses may rely on model compliance, remove task-relevant information, or fail to identify the exact spans that induce malicious actions.Span ablation can underestimate repeated or similar injections, attention can miss non-salient threats, and counterfactual analysis may detect hijacking without locating its trigger.Source: §5 · p. 7

6 Conclusion

ActGuard audits actions before execution against a step-wise tool prior, localizing and selectively masking verified indirect prompt injections before regenerating actions. The paper reports low attack success and high utility without fixing task trajectories or discarding entire tool outputs.

6 Conclusion

  • ActGuard uses a step-wise tool prior and tool-level contrastive attribution plus parameter-level evidence localization to identify external spans that induce actions.A verifier confirms injections before they are selectively masked and the action is regenerated.Source: §6 · p. 7
  • ActGuard selectively masks verified injections while avoiding fixed task trajectories and wholesale removal of tool outputs.Source: §6 · p. 7
  • ActGuard achieves low attack success rates and high utility, with further experiments confirming robustness and component effectiveness.Source: §6 · p. 7

A Implementation Details … Verifier-Directed Attack

This section describes ActGuard’s pre-execution auditing and verifier, which use localized evidence to distinguish malicious instructions from legitimate task content, mask confirmed malicious chunks, and regenerate and re-audit actions. It also examines whether the verifier maintains the instruction–data boundary when untrusted content attempts to manipulate its judgment.

Default Configuration

  • The default configuration uses temperature 0 for action generation and verification, chunks tool outputs into 80–180 characters, and allows at most two repair attempts per action.Near-duplicates are grouped at similarity 0.9; localization uses all-MiniLM-L6-v2, retrieves five chunks, and forwards tool-level candidates with attribution scores above τ = 0. GPT-5-mini verifies candidates expanded by one adjacent chunk on either side; confirmed chunks receive a fixed placeholder.Source: Default Configuration · p. 10

Algorithm

  • ActGuard localizes evidence differently depending on whether the candidate tool falls outside the prior or its parameters may be manipulated, then verifies, masks confirmed chunks, and re-audits regenerated actions.For unexpected tools, it retrieves action-relevant chunks and uses contrastive attribution against a plausible prior tool; for expected tools, it retrieves chunks anchored by action arguments. Candidate evidence is expanded with neighboring chunks for joint verification.Source: Algorithm · p. 10

Step-wise Planning Prompt

  • ActGuard uses one-to-three predicted next tools as a soft auditing reference, not an execution constraint, and removes prediction metadata before contrastive scoring to avoid reference-tool probability leakage.The same inference generates the candidate action and machine-parseable prior, grounded in available tool schemas; malformed or misdirected predictions would make the prior unreliable.Source: Step-wise Planning Prompt · p. 10

Verifier Prompt

  • The verifier audits only localized chunks and their neighbors, using the request, candidate action, and history to distinguish malicious instructions from legitimate workflow guidance and authorized parameters.It targets control takeover, task hijacking, data exfiltration, and false authority; its structured output gives a binary decision, exact chunk identifiers, and a short reason.Source: Verifier Prompt · p. 12
  • The verifier treats task-reasonable operations, bill-payment parameters, and factual OTPs as non-IPI, but flags an unauthorized transfer request as IPI.Source: Verifier Prompt · pp. 12–13
  • The verifier receives the user query, historical tool results, candidate action, and localized chunks, then returns an IPI verdict, chunk IDs, and a one-sentence reason as JSON.Source: Verifier Prompt · p. 13

Verifier-Directed Attack

  • The adaptive payload places a directive to ignore safety rules and label it benign immediately before the attack goal, keeping both inside an untrusted tool result.This tests whether the verifier preserves the instruction–data boundary when localized evidence attempts to manipulate its security judgment.Source: Verifier-Directed Attack · p. 13

B Detailed Results · AgentDyn

Across the three AgentDyn suites, ActGuard achieves the best overall security–utility balance across three backend models, while its auditing and verifier-guided masking preserve legitimate replanning and task-relevant context.

AgentDyn

  • ActGuard achieves the best overall security–utility balance across GPT-4o-mini, Gemini-2.5-Flash, and DeepSeek-V4-Flash on AgentDyn.The comparison spans all three AgentDyn suites.Source: AgentDyn · p. 13
  • Across all three backend models, ActGuard consistently maintains low ASR while preserving high UAU despite differences in backend behavior and attack susceptibility.Source: AgentDyn · p. 13
  • AgentDyn’s Average columns pool task-level outcomes across suites rather than taking an unweighted mean of the displayed suite-level percentages.The suites contain different numbers of evaluated instances.Source: AgentDyn · p. 13
  • ActGuard’s state-adaptive tool prior and dual-granularity localization identify evidence behind unexpected tools and manipulated arguments without restricting legitimate replanning.Source: AgentDyn · p. 13
  • Verifier-guided masking removes only confirmed malicious chunks, preserving task-relevant context.Source: AgentDyn · p. 13
  • Contaminated actions are regenerated and re-audited before execution.Source: AgentDyn · p. 13

AgentDojo

On AgentDojo with GPT-4o-mini, ActGuard achieves the highest average UAU while maintaining an average ASR of 0.42 across four suites.

AgentDojo

  • ActGuard achieves the highest pooled average UAU (59.85) with average ASR 0.42 across four AgentDojo suites using GPT-4o-mini.The averages are computed from pooled task-level outcomes, not as an unweighted mean of suite-level percentages; the security–utility balance holds across all four suites.Source: AgentDojo · p. 13

Verifier-Directed Attack

Verifier-directed payloads do not systematically reduce agent security or task utility, and verifier accuracy and recall remain stable across all three backends. The evaluation’s payload-overlap annotation can count non-actionable boundary fragments as positives, lowering absolute recall.

Verifier-Directed Attack

  • For Figure 5(b) and Table 10, payload-overlap annotation labels every chunk overlapping the full injected payload positive, including potentially non-actionable boundary fragments that can lower absolute recall.Table 2 instead uses instruction-content-level annotations, excluding non-actionable boundary fragments from the recall denominator.Source: Verifier-Directed Attack · p. 14
  • Across all three verifier backends, verifier-directed payloads cause no systematic deterioration in agent security or task utility, while verifier accuracy and recall remain stable.The injected directive is treated as audited data within localized evidence; trusted authorization criteria and output constraints prevent it from overriding the verifier’s decision boundary.Source: Verifier-Directed Attack · p. 14

C Comparison with Concurrent Defenses

ActGuard and concurrent defenses all address imminent agent actions, but ActGuard distinguishes itself through a dynamic local tool prior, tool- and argument-level evidence localization, and source-level repair. The section also explains why it provides no quantitative head-to-head comparison with those defenses.

C Comparison with Concurrent Defenses

  • AttriGuard (He et al. 2026) uses control-attenuated shadow execution to gate calls, whereas CausalArmor (Kim et al. 2026) applies attribution to predefined privileged actions.CausalArmor selectively sanitizes when a chunk’s leave-one-out attribution dominates the user request’s support.Source: C Comparison with Concurrent Defenses · pp. 14–15
  • AgentSentry (Zhang et al. 2026) detects temporal takeover through counterfactual tool-return re-executions, while ICON (Wang et al. 2026a) detects and rectifies adversarial attention patterns.AgentSentry revises the next action after detected drift or mediator influence; ICON steers anomalous query–key dependencies toward task-relevant context.Source: C Comparison with Concurrent Defenses · p. 15
  • ActGuard combines a soft, state-adaptive local tool prior, tool- and argument-level evidence localization, and source-level repair that preserves the rest of the observation.Unexpected tools trigger chunk-level analysis of tool-choice evidence; expected tools are checked by tracing argument anchors such as URLs, addresses, recipients, and commands to their source outputs.Source: C Comparison with Concurrent Defenses · pp. 15–16
  • ActGuard returns source chunks for independent verification, masks only confirmed malicious evidence, regenerates the action, and audits it again.This differs from AttriGuard’s whole-call gating, CausalArmor’s localization at designated privileged decisions, AgentSentry’s boundary-level diagnosis, and ICON’s latent-attention editing.Source: C Comparison with Concurrent Defenses · pp. 15–16
  • The authors omit quantitative comparisons because controlled, reproducible head-to-head evaluations were unavailable and published protocols differed across tasks, attacks, agents, backends, and costs.They restrict quantitative comparisons to baselines reproducible within a common evaluation framework.Source: C Comparison with Concurrent Defenses · p. 16

Related papers

Loading 2609.14987v1…