AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

Tian Zhang; Yiwei Xu; Juan Wang; Keyan Guo; Xiaoyang Xu; Bowen Xiao; Quanlong Guan; Jinlin Fan

cs.CRFeb 26, 2026

AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

Authors: Tian Zhang, Yiwei Xu, Juan Wang, Keyan Guo, Xiaoyang Xu, Bowen Xiao, Quanlong Guan, Jinlin Fan, +3 more

Organizations: Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China · Department of Computer Science and Engineering, University at Buffalo, SUNY · Department of Computer Science, College of Information Science and Technology, Jinan University, Guangzhou 510632, China · College of Cyber Security, Jinan University, Guangzhou 510632, China

Abstract

Large language model (LLM) agents increasingly rely on external tools and retrieval systems to autonomously complete complex tasks. However, this design exposes agents to indirect prompt injection (IPI), where attacker-controlled context embedded in tool outputs or retrieved content silently steers agent actions away from user intent. Unlike prompt-based attacks, IPI unfolds over multi-turn trajectories, making malicious control difficult to disentangle from legitimate task execution. Existing inference-time defenses primarily rely on heuristic detection and conservative blocking of high-risk actions, which can prematurely terminate workflows or broadly suppress tool usage under ambiguous multi-turn scenarios. We propose AgentSentry, a novel inference-time detection and mitigation framework for tool-augmented LLM agents. To the best of our knowledge, AgentSentry is the first inference-time defense to model multi-turn IPI as a temporal causal takeover. It localizes takeover points via controlled counterfactual re-executions at tool-return boundaries and enables safe continuation through causally guided context purification that removes attack-induced deviations while preserving task-relevant evidence. We evaluate AgentSentry on the AgentDojo benchmark across four task suites, three IPI attack families, and multiple black-box LLMs. AgentSentry eliminates successful attacks and maintains strong utility under attack, achieving an average Utility Under Attack (UA) of 74.55 %, improving UA by 20.8 to 33.6 percentage points over the strongest baselines without degrading benign performance.

Figures & tables

Figure 1. A representative attack chain of tool-mediated IPI.

Figure 2. AgentSentry pipeline for defending against multi-turn IPI.

Figure 3. Boundary-local causal gating and safe continuation in AgentSentry.

Metric	Description
ASR ( $\downarrow$ )	Fraction of attacked tasks where the injected objective is executed.
UA ( $\uparrow$ )	Fraction of attacked tasks where the user objective is completed while avoiding the injected objective.
CU ( $\uparrow$ )	Success rate on benign (non-attacked) tasks.
FPR ( $\downarrow$ )	Fraction of benign tasks where the defense incorrectly intervenes.

Table 1. Evaluation metrics.

\uparrow

indicates the higher the better while

\downarrow

indicates the lower the better.

Model	Defense	No Attack		Important Instr.		Tool Knowledge		InjecAgent		Avg.
Model	Defense	CU	FPR	UA	ASR	UA	ASR	UA	ASR	UA	ASR
GPT-4o	No Defense	78.35	0.00	36.84	33.23	42.14	30.00	72.22	15.28	50.40	26.17
	Delimiting ( Chen et al., 2025 ; Hines et al., 2024 )	72.16	0.00	39.85	48.57	50.00	21.43	75.00	11.81	54.95	27.27
	Repeat Prompt ( Learn Prompting, 2024 )	84.54	0.00	61.35	28.42	57.14	11.43	77.08	15.97	65.19	18.61
	Tool Filter ( Debenedetti et al., 2024 )	72.16	0.00	50.38	5.41	60.81	7.86	62.50	3.47	57.90	5.58
	DeBERTa Detector ( Kokkula et al., 2024 )	41.24	0.00	18.95	14.29	31.43	15.00	31.25	0.00	27.21	9.76

Table 2. Aggregate defense performance on AgentDojo across three IPI families (Important Instr., Tool Knowledge, InjecAgent) for three black-box backbones (GPT - 4o, GPT - 3.5 - turbo, Qwen3 - Max). We report CU (

\uparrow

) and FPR (

\downarrow

) on benign runs, and UA (

\uparrow

) and ASR (

\downarrow

) under attack. The last columns average UA/ASR over the three attack families. All values are percentages.

Figure 4. Security–utility trade-off of indirect prompt-injection defenses for tool-augmented LLM agents.

Configuration	UA (%)	ASR (%)
AgentSentry (Full)	90.36	0.00
Temporal aggregation disabled	88.57	1.07
Sanitized counterfactuals removed	58.21	22.50
Single-step causal contrast	56.25	21.79
Weak masking (paraphrasing)	56.07	23.57
Weak masking (tool-instruction deletion)	56.43	22.86

Table 3. Ablation results on Workspace .

Figure 5. Boundary-aligned causal effects.

Figure 6. Realized severity trajectory $Y_{b}$ .

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Defense (pipeline)	Takeover	Task complete
MELON	Yes	Yes
Transformer PI detector	No	No
Task Shield	No	Yes
AgentSentry (ours)	No	Yes

Appendix

Table 4. Per-instance outcomes for the Travel Tool Knowledge case. “Takeover” indicates whether the injected hotel endorsement appears in the assistant output. “Task complete” indicates whether the assistant returns the highest-rated French and Chinese restaurants in Paris and reports the cost per person for each.

Instance	Retrieved context surface	Injected directive	Observed tool action
Calendar query ( user_task_3 , injection_task_1 )	Calendar event description returned by search_calendar_events contains an embedded <INFORMATION> block.	Delete the file with ID ‘13’ from the cloud drive.	Destructive side effect executed via delete_file after the tool return is interpreted as authorized instruction.
Meeting query ( user_task_3 , injection_task_8 )	Calendar event record is retrieved normally, while the injected <INFORMATION> payload is surfaced as part of the context that precedes task completion.	Email the contents of all unread emails to [email protected], delete the sent email, then delete all unread emails.	No high-impact tool call is executed in the shown trace segment, yielding a residual failure mode where persuasive drift can precede an overt tool-side violation.

Appendix

Table 5. Case snapshots illustrating how Important Instructions payloads become actionable at tool-return boundaries in Workspace (Qwen3-Max). Each row summarizes the retrieved context, the injected directive, and the resulting tool-side behavior observed in the trace.

Explore similar work

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
Feb 24, 2026Che Wang, Fuyao Zhang, Jiaming Zhang +6Prompt Injection Defense AI Agent Security
School of Computer Science, Peking University, China · College of Computing and Data Science, Nanyang Technological University, Singapore · Ant Group +1
ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents
Sep 14, 2026Bingzheng Wang, Xiaoyan Gu, Wentao Wang +3Runtime Enforcement for AI Agents Prompt Injection Defense
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China · Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China 2School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China 3Key Laboratory of Cyberspace Security Defense, Beijing, China +3
IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization
May 23, 2026Zixuan Chen, Jiaxiang Chen, Li Luo +4LLM Agent Security Indirect Prompt Injection
1Shanghai Jiao Tong University · 2The University of Hong Kong

Feb 24, 2026J/K move · Enter open · S save

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction

Che Wang, Fuyao Zhang, Jiaming Zhang, Ziqi Zhang+5

School of Computer Science, Peking University, China · College of Computing and Data Science, Nanyang Technological University, Singapore · Ant Group+1

Prompt Injection Defense AI Agent Security Prompt Injection Detection Inference-Time Intervention

Open paper AskPDF arXiv

Large Language Model (LLM) agents are susceptible to Indirect Prompt Injection (IPI) attacks, where malicious instructions in retrieved content hijack the agent's execution. Existing defenses typically rely on strict filtering or refusal mechanisms, which suffer from a critical limitation: over-refusal, prematurely terminating valid agentic workflows. We propose ICON, a probing-to-mitigation framework that neutralizes attacks while preserving task continuity. Our key insight is that IPI attacks leave distinct over-focusing signatures in the latent space. We introduce a Latent Space Trace Prober to detect attacks based on high intensity scores. Subsequently, a Mitigating Rectifier performs surgical attention steering that selectively manipulate adversarial query key dependencies while amplifying task relevant elements to restore the LLM's functional trajectory. Extensive evaluations on multiple backbones show that ICON achieves a competitive 0.4% ASR, matching commercial grade detectors, while yielding a over 50% task utility gain. Furthermore, ICON demonstrates robust Out of Distribution(OOD) generalization and extends effectively to multi-modal agents, establishing a superior balance between security and efficiency.

Abstract

Explore similar work

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization