The Cognitive Firewall:Securing Browser Based AI Agents Against Indirect Prompt Injection Via Hybrid Edge Cloud Defense

Qianlong Lan; Anuj Kaul

cs.CRMar 24, 2026

The Cognitive Firewall:Securing Browser Based AI Agents Against Indirect Prompt Injection Via Hybrid Edge Cloud Defense

Authors: Qianlong Lan, Anuj Kaul

Organizations: eBay Inc

Abstract

Deploying large language models (LLMs) as autonomous browser agents exposes a significant attack surface in the form of Indirect Prompt Injection (IPI). Cloud-based defenses can provide strong semantic analysis, but they introduce latency and raise privacy concerns. We present the Cognitive Firewall, a three-stage split-compute architecture that distributes security checks across the client and the cloud. The system consists of a local visual Sentinel, a cloud-based Deep Planner, and a deterministic Guard that enforces execution-time policies. Across 1,000 adversarial samples, edge-only defenses fail to detect 86.9% of semantic attacks. In contrast, the full hybrid architecture reduces the overall attack success rate (ASR) to below 1% (0.88% under static evaluation and 0.67% under adaptive evaluation), while maintaining deterministic constraints on side-effecting actions. By filtering presentation-layer attacks locally, the system avoids unnecessary cloud inference and achieves an approximately 17,000x latency advantage over cloud-only baselines. These results indicate that deterministic enforcement at the execution boundary can complement probabilistic language models, and that split-compute provides a practical foundation for securing interactive LLM agents.

Figures & tables

Figure 1: Operational sequence of the Cognitive Firewall. User inputs are first processed by the Edge Sentinel (Layer 1) to filter visual obfuscations. Only sanitized, text-based context is sent to the Cloud Planner (Layer 2) for semantic reasoning. The resulting plan is then validated by the Edge Guard (Layer 3) against a local whitelist and intent constraints before execution, yielding a fail-closed, defense-in-depth workflow.

Defense Layer	Primary Role	Target Vector	Avg Latency (ms)	Intercept Count
			(Mean $\pm$ SD)	(% of Total)
Layer 1: Edge Sentinel	Visual Heuristic (Fail-Fast)	Presentation Attacks	$0.06\pm 0.06$	89 (13.1%)
Layer 2: Cloud Planner	Semantic Reasoning	Jailbreaks & Logic Traps	$288.1\pm 144.8$	323 (47.6%)
Layer 3: Edge Guard	Policy Enforcement	Goal Hijacking & Exfiltration	$948.6\pm 791.4^{\ast}$	259 (38.2%)
Residual (Failures)	N/A	Advanced Evasion	N/A	6 (0.88%)
System Aggregate	Hybrid Edge-Cloud Defense	All Attack Vectors	$\sim$ 517 ms (Avg)	99.1% Intercepted

Table 1: Performance and Security Summary by Defense Layer (

N=1,000

)

Figure 2: The defense funnel (Sankey diagram). Visualization of attack filtration across $N=1000$ samples. Presentation-layer attacks are filtered by the Edge Sentinel, semantic threats are handled by the Cloud Planner, and remaining hijacking attempts are blocked by the Edge Guard. Only 0.88% of attacks bypass all layers.

Configuration	Enabled Layers	ASR	Latency	Defense Logic
Baseline	None	100.0%	N/A	No filtering (Unsafe)
Edge Only	Layer 1	86.9%	0.06 ms	Fast but misses semantic
Edge + Cloud	Layer 1 + 2	39.2%	$\sim$ 288 ms	Misses hijacking
Full Hybrid	L1 + L2 + L3	0.88%	$\sim$ 517 ms	Defense in depth

Table 2: Ablation Study of Defense Configurations (

N=1,000

)

Figure 3: System latency distribution by defense layer (log scale). The Edge Sentinel (Layer 1) runs at $\mu\approx 0.06$ ms, roughly $\sim$ 17,000x faster than the Cloud Planner ( $\mu\approx 288$ ms).

$\uparrow$ : Layer compensated for bypass; $\downarrow$ : Layer bypassed.
Attack Scenario	L1 (%)	L2 (%)	L3 (%)	Success (%)
Fragmentation	0.0 $\downarrow$	93.0 $\uparrow$	7.0	0.0
Benign Wrapping	0.0 $\downarrow$	39.0 $\downarrow$	59.0 $\uparrow$	2.0
Allowed-Origin Exfil	0.0 $\downarrow$	91.0 $\uparrow$	9.0	0.0
Static Baseline	13.1	47.6	38.2	0.88

Table 3: Robustness against adaptive adversaries. Fragmentation is neutralized after reconstruction by Layer 2, while benign wrapping achieves a small success rate (2.0%) by exploiting the probabilistic nature of intent classification, motivating stronger deterministic constraints.

Explore similar work

AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification
Feb 26, 2026Tian Zhang, Yiwei Xu, Juan Wang +8Prompt Injection Defense Prompt Injection Attacks on AI Agents
Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China · Department of Computer Science and Engineering, University at Buffalo, SUNY · Department of Computer Science, College of Information Science and Technology, Jinan University, Guangzhou 510632, China +1
ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
Feb 24, 2026Che Wang, Fuyao Zhang, Jiaming Zhang +6Prompt Injection Defense AI Agent Security
School of Computer Science, Peking University, China · College of Computing and Data Science, Nanyang Technological University, Singapore · Ant Group +1
ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents
Sep 14, 2026Bingzheng Wang, Xiaoyan Gu, Wentao Wang +3Runtime Enforcement for AI Agents Prompt Injection Defense
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China · Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China 2School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China 3Key Laboratory of Cyberspace Security Defense, Beijing, China +3

Feb 26, 2026J/K move · Enter open · S save

AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

Tian Zhang, Yiwei Xu, Juan Wang, Keyan Guo+7

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China · Department of Computer Science and Engineering, University at Buffalo, SUNY · Department of Computer Science, College of Information Science and Technology, Jinan University, Guangzhou 510632, China+1

Prompt Injection Defense Prompt Injection Attacks on AI Agents LLM Agent Safety

Open paper AskPDF arXiv

Large language model (LLM) agents increasingly rely on external tools and retrieval systems to autonomously complete complex tasks. However, this design exposes agents to indirect prompt injection (IPI), where attacker-controlled context embedded in tool outputs or retrieved content silently steers agent actions away from user intent. Unlike prompt-based attacks, IPI unfolds over multi-turn trajectories, making malicious control difficult to disentangle from legitimate task execution. Existing inference-time defenses primarily rely on heuristic detection and conservative blocking of high-risk actions, which can prematurely terminate workflows or broadly suppress tool usage under ambiguous multi-turn scenarios. We propose AgentSentry, a novel inference-time detection and mitigation framework for tool-augmented LLM agents. To the best of our knowledge, AgentSentry is the first inference-time defense to model multi-turn IPI as a temporal causal takeover. It localizes takeover points via controlled counterfactual re-executions at tool-return boundaries and enables safe continuation through causally guided context purification that removes attack-induced deviations while preserving task-relevant evidence. We evaluate AgentSentry on the AgentDojo benchmark across four task suites, three IPI attack families, and multiple black-box LLMs. AgentSentry eliminates successful attacks and maintains strong utility under attack, achieving an average Utility Under Attack (UA) of 74.55 %, improving UA by 20.8 to 33.6 percentage points over the strongest baselines without degrading benign performance.

Abstract

Explore similar work

AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents