cs.CRAug 28, 2026
SaveCAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?
Organizations: The Hong Kong Polytechnic University · The Chinese University of Hong Kong
Abstract
Prompt injection attacks on Large Language Model (LLM) agents seek to introduce malicious instructions or content into external text sources retrieved by agents, forcing the underlying LLMs to execute harmful actions outside their benign scope. While current defenses effectively counter known injection attacks, deploying them in LLM agent environments remains challenging due to attack variants and emerging threats. Moreover, existing solutions typically suffer from an inherent trilemma, i.e., a constant trade-off among runtime efficiency, contextual precision, and adaptability. To bridge this gap, we propose Continuous Agents for Injection Threats via Lifelong Yielding Nexus (CAITLYN), an agent-agnostic defense middleware. CAITLYN integrates two systems. System I focuses on immediate defense against existing attacks using a two-tiered library: Tier-0 for rule-based detection scripts and Tier-1 for optimized LLM-based accurate inference. System II, in contrast, is deployed to monitor potential abnormal signals and attempt to synthesize new defenses. On standard benchmarks, CAITLYN matches the detection performance of state-of-the-art defenses at lower token overhead than LLM-as-a-judge baselines. On Emerging, our new delivery-aware benchmark featuring novel injection techniques, static baselines and the standalone System I configuration remain vulnerable. In contrast, System II autonomously synthesizes verified defense capabilities, substantially lowering the attack success rate across three diverse agent environments.
Figures & tables
Figure 1: The overall framework of CAITLYN. System I performs fast runtime enforcement with the Tier-0 filter and the Tier-1 classifier over untrusted content entering the protected tool-augmented agent, while System II continuously evolves defense skills from observed counterexamples and writes them back into the shared defense skill library.
Figure 2: The skill representation. Both panels are defense skills stored as directories. The Tier-0 skill (left) pairs a YAML contract with an executable script that returns one JSON verdict. The Tier-1 skill (right) stores detection logic as a prompt template in the same YAML contract. The runtime dispatches on the tier field, so synthesis can rewrite either contract without changing the folder interface.
Figure 3: Merged-pair execution and prompt caching in Tier 1. (a) CAITLYN issues two parallel API calls over the untrusted input suffix, evaluating detector skills (Call A) and reference knowledge skills (Call B) against a shared prefix. Prefix caching applies to the byte-identical prompt header across consecutive scans. (b) Impact of provider-side prompt caching, demonstrating that subsequent invocations incur token overhead only for the new input suffix and generated verdict.
Figure 4: Detection-only experiments across the four datasets. Every detector uses the same ranking score: the predicted-class confidence when the detector fires as attack-like, and 0 otherwise. Operating points at the default thresholds are marked in the ROC panels with one marker shape per detector, and the operating point of CAITLYN is highlighted in the PR panels.
Figure 5: Latency and cost of the detection-only experiments.
| Agent | Defense | AgentDojo-S250 [ 12 ] | ASPI-S [ 36 ] | SafeClawBench-S240 [ 39 ] | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Action ASR | FPR | Latency | Cost | Action ASR | FPR | Latency | Cost | Action ASR | FPR | Latency | Cost | ||
| opencode † | None | 16.8% | 0.0% | 9.4 | 0.0047 | 5.4% | 0.0% | 8.3 | 0.0021 | 33.3% | n/a | 11.7 | 0.0049 |
| Regex-Guard ∗ | 17.6% | 0.0% | 9.5 | 0.0047 | 2.2% | 0.0% | 7.5 | 0.0021 | 34.2% | n/a | 11.0 | 0.0049 | |
| LLM-Judge ∗ | 0.0% | 0.0% | 9.4 | 0.0047 | 2.2% | 9.7% | 7.1 | 0.0020 | 24.2% | n/a | 13.8 | 0.0048 | |
| LLM-Judge+Fewshot ∗ | 0.0% | 0.0% | 10.8 | 0.0047 | 2.2% | 6.5% | 7.0 | 0.0020 | 19.6% | n/a | 14.0 | 0.0048 | |
| Spotlighting+Delimiting [ 12 ] | 13.6% | 0.0% | 9.7 | 0.0047 | 3.2% | 0.0% | 6.5 | 0.0021 | 30.4% | n/a | 10.9 | 0.0049 | |
Table 1: End-to-end effectiveness across agents and defenses.
| Variant | TPR (%) | FPR (%) | Latency (s) | USD | |||
|---|---|---|---|---|---|---|---|
| AgentDojo-S250 | ASPI-S | SafeClawBench-S240 | AgentDefense-S250 | ||||
| Tier-0 only | 3.2 | 5.4 | 17.5 | 48.4 | 0.0 | 0.01 | 0 |
| Tier-1 only | 96.8 | 73.1 | 81.7 | 80.8 | 6.0 | 8.49 | 0.00099 |
| Ensemble | 100.0 | 91.4 | 65.4 | 84.0 | 6.8 | 5.20 | 0.00022 |
| Merged-Knowledge | 100.0 | 86.0 | 67.1 | 79.2 | 4.0 | 2.71 | 0.00075 |
| Merged-Detectors | 100.0 | 88.2 | 78.8 | 75.2 | 1.6 | 2.38 | 0.00025 |
Table 2: Ablation study under the detection-only protocol. One paired run of six variants: Tier-0 only, Tier-1 only, the per-detector ensemble, one-call merged detectors, one-call merged knowledge, and the full two-call OR schema. TPR is per dataset. FPR uses the shared benign pool. Latency and USD are mean time and mean provider cost per inspection on this run. Latency can vary across measurement windows.
| Model | Action ASR | Utility | Latency | USD per Case |
|---|---|---|---|---|
| DeepSeek-V4-Flash | 3.3% | 49.2% | 15.5 | 0.0002 |
| Qwen3.8-Max | 0.4% | 25.8% | 9.0 | 0.0105 |
| GLM-5.3 | 0.0% | 37.5% | 10.6 | 0.0035 |
| Kimi-K3 | 1.7% | 59.2% | 16.0 | 0.0063 |
| MiniMax-M3 | 0.0% | 27.9% | 17.1 | 0.0007 |
| Claude-Opus-4.6 | 0.0% | 45.8% | 9.3 | 0.0090 |
Table 3: LLM API comparison on CAITLYN.
Figure 6: End-to-end ASR on the Emerging dataset across three agents. The shaded band marks the ASR range from None through PI Detector ; all static baselines and CAITLYN-static remain inside it. CAITLYN-evolved breaks out of this band, reducing ASR by about 40 percentage points at the same agents.
Figure 7: An Emerging failure-to-protection transition on OpenClaw. Evolution turns a failure shared by all static defenses into a pre-delivery block.
| Method | Held-out TPR | FPR | Skills | Tokens |
|---|---|---|---|---|
| Static | 16.0 | 1.6 | 0 | 0 |
| Batch | 16.0 | 1.6 | 0 | 20331 |
| Sequential | 30.0 | 1.6 | 4 | 104932 |
Table 4: Lifelong synthesis at the end of the nine-family stream. Held-out TPR is measured on the 100 Emerging held-out cases. FPR uses the shared benign pool.
Figure 8: Lifelong synthesis on the nine-family Emerging stream under the detection-only protocol. Each wave adds one family; the curves report cumulative held-out cases detected on all families seen so far.
Figure 9: Merged-pair system wrapper used by both Tier-1 API calls. The detector-scope call packs skills whose role is detector . The knowledge-scope call packs every remaining prompt-bearing skill with tier greater than 0, including the two shipped entries tagged tier 2, as reference knowledge. The user prompt is the delimited suffix <content>…</content> containing the untrusted content.
Figure 10: Tier-1 instruction-hierarchy skill prompt packed into the merged-pair evaluator.
Figure 11: Tier-0 detector input and output contract.
| Skill | Name | Tier | Role | Category | Detection target |
|---|---|---|---|---|---|
| adversarial-suffix | Adversarial Suffix and Compliant Prefill Detector | 0 | Detector | Jailbreak | GCG-style suffixes, format corruption, and compliant-prefill jailbreaks |
| delimiter-sandwich | Delimiter Sandwich Preprocessor | 0 | Non Detector | Injection | XML and JSON delimiter wrap with breakout checks |
| entropy-anomaly | Entropy and Statistical Anomaly Detector | 0 | Detector | Unknown | Character-distribution and token-repetition anomalies |
| exfiltration | Exfiltration Detector | 0 | Detector | Exfiltration | Credential, system-prompt, and conversation exfiltration |
| hardened-prompt | Hardened System Prompt Preprocessor | 0 | Non Detector | Injection | Override-resistant system prompt construction |
| injection-general | General Injection Detector | 0 | Detector | Injection | Fast regex and heuristic injection signatures |
Table 5: The shipped defense skill library of CAITLYN. Every skill is a self-contained directory with a YAML contract and, for Tier 0, an executable detector script. Tier 0 and Tier 1 skills run inside System I. Entries tagged tier 2 also run inside System I: they are packed only as knowledge-scope context, not as a separate runtime system. The tier field determines whether the runtime dispatches the signature engine or the merged-pair evaluator.
Figure 12: Lineage of the synthesized skills in the Emerging experiment. Solid edges are synthesis steps accepted by the generator-verifier-reviewer loop. Muted nodes are accepted by the verifier but pruned by the over-broad filter. Pass-filled nodes remain active in the final library. All retained nodes run at Tier 0, which is why the evolved library adds no LLM cost on the hot path.
Figure 13: System II evolution statistics from the Emerging experiment. (a) Of 77 evolution runs, 18 terminate with acceptance and 59 terminate without a skill. Rejected runs partition into max-round exhaustion (31), token-budget exhaustion (21), and generation failure (7). The 18 accepting runs materialize 24 skills, of which four remain after the over-broad filter of Appendix 7.1 . This log is the end-to-end Emerging vaccination, not the nine-wave sequential study. (b) Generator tokens for each accepted skill, sorted by cost. Skills emitted in the same run share a token count. Pass-filled bars mark the four retained skills. The full experiment spends about 2.18 million generator tokens.
| Detector | AgentDojo-S250 | ASPI-S | SafeClawBench-S240 | AgentDefense-S250 | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TPR | FPR | Lat | Cost | TPR | FPR | Lat | Cost | TPR | FPR | Lat | Cost | TPR | FPR | Lat | Cost | |
| Regex-Guard ∗ | 0.0 | 0.0 | 0.00 | – | 0.0 | 0.0 | 0.00 | – | 0.0 | 0.0 | 0.00 | – | 8.8 | 0.0 | 0.00 | – |
| LLM-Judge ∗ | 100.0 | 0.0 | 3.72 | 0.00068 | 76.3 | 0.0 | 4.03 | 0.00069 | 50.0 | 0.0 | 5.02 | 0.00083 | 63.2 | 0.0 | 4.44 | 0.00076 |
| LLM-Judge+Fewshot ∗ | 100.0 | 0.0 | 4.72 | 0.00083 | 69.9 | 0.0 | 5.20 | 0.00082 | 40.0 | 0.0 | 6.75 | 0.00104 | 58.0 | 0.0 | 5.31 | 0.00084 |
| PI Detector | 96.0 | 0.0 | 0.07 | – | 29.0 | 0.0 | 0.05 | – | 14.6 | 0.0 | 0.06 | – | 45.2 | 0.0 | 0.06 | – |
| CAITLYN | 100.0 | 2.8 | 2.52 | 0.00036 | 76.3 | 2.8 | 2.35 | 0.00036 | 63.7 | 2.8 | 2.25 | 0.00031 | 76.4 | 2.8 | 2.09 | 0.00031 |
Table 6: Full detection-only results at the default thresholds. TPR and FPR are in percent. Latency is the mean per-sample wall-clock time in seconds and tracks OpenRouter load in that window. Cost is the mean USD reported by the provider usage endpoint. Every detector shares the same benign pool. The shaded row is CAITLYN. The bold cell is the best TPR in its column block.
Figure 14: Statistics of the Emerging benchmark. (a) Orthogonal partitions of the 200 cases by objective type, seed versus held-out split, delivery tool, and attacker target. Every case uses a distinct attacker target. (b) Nine attack families with seed and held-out counts. Bars follow construction order used by the lifelong synthesis study of Section 5.2 . (c) Ten generation templates sorted by frequency.
| Defense | OpenClaw | Codex | Hermes |
|---|---|---|---|
| None | 76.5 | 76.0 | 78.0 |
| Regex-Guard ∗ | 72.5 | 74.5 | 76.0 |
| LLM-Judge ∗ | 78.0 | 79.0 | 76.0 |
| LLM-Judge+Fewshot ∗ | 80.0 | 79.0 | 78.5 |
| Spotlighting+Delimiting | 77.0 | 79.0 | 76.0 |
| Tool Filter | 78.0 | 75.5 | 77.5 |
Table 7: End-to-end ASR on Emerging for every evaluated defense. This table is the numeric companion of Figure 6 . The shaded rows are the CAITLYN configurations and the bold cells highlight the lowest ASR per agent column.
| Family | None | Static | S-I | S-II | |
|---|---|---|---|---|---|
| Status | 25 | 96 | 83 100 | 96 | 0 |
| Freshness | 27 | 96 | 83 100 | 100 | 93 |
| Policy | 25 | 100 | 100 100 | 96 | 0 |
| Mirror | 25 | 100 | 83 100 | 100 | 0 |
| Event | 24 | 88 | 50 100 | 83 | 83 |
| Alias | 26 | 96 | 50 100 | 100 | 92 |
Table 8: Per-family ASR on Emerging for each agent. Static reports the range over the six static defenses (Regex-Guard, LLM-Judge, LLM-Judge+Fewshot, Spotlighting+Delimiting, Tool Filter, and PI Detector). None is the undefended column. S-I is the initial System I library of CAITLYN, and S-II is the System I library after System II synthesis with the over-broad filter.
| Wave | Family | Held | TPR | Tokens | Termination | Skills |
|---|---|---|---|---|---|---|
| 1 | Status Field | 12 | 25.0 | 4064 | Generation Failed | 0 |
| 2 | Freshness Framing | 13 | 0.0 | 21397 | Max Rounds | 0 |
| 3 | Policy Delta | 13 | 7.7 | 2669 | Accept | 1 |
| 4 | Search Mirror | 13 | 0.0 | 20299 | Max Rounds | 1 |
| 5 | Latest Event | 12 | 8.3 | 22209 | Max Rounds | 1 |
| 6 | Directory Alias | 13 | 15.4 | 22520 | Max Rounds | 1 |
Table 9: Per-wave detail of Sequential synthesis on the nine-family Emerging stream, after the over-broad filter.
| Metric | Value |
|---|---|
| Blocked-set size | 113 |
| Target-collision cases | 50 |
| Rewrites that escaped | 38 |
| Query budget exhausted | 25 |
| Escape rate over blocked set | 33.6% |
| Escape rate over rewritable set | 60.3% |
Table 10: Skill-aware evasion against the evolved scan oracle and the defender-mediated re-vaccination that closes the reopened window.
Figure 15: Three OpenClaw case traces from the Emerging evaluation. Cases 1 and 2 are blocked by the evolved library while every static defense and CAITLYN-static remain compromised. Case 3 remains compromised because the freshness-framing family is not covered by the four retained skills.
Figure 16: Six poisoning defenses on the local update path of the defense repository. Layers are checked in order from L1 to L6.
Figure 17: Command surface of the CAITLYN CLI. The default entry point without a subcommand launches the terminal user interface.
Figure 18: Library inventory from the CAITLYN CLI. The listing is truncated with ... . Counts reflect a development workstation after the evaluation campaigns in Section 4 .
Figure 19: Defense telemetry from the CAITLYN CLI dashboard. Counts reflect a development workstation after the evaluation campaigns in Section 4 .
Figure 20: Single-shot CLI scan that triggers Tier 0 signature matches without an LLM call. The prompt is a synthetic injection sample used only for illustration.
Figure 21: Cold-start view of the CAITLYN terminal user interface. The footer reports antibody count, model, and defense status.
Figure 22: Defense-dashboard overlay in the CAITLYN terminal user interface. KPI cards, tier split, and top antibodies mirror the CLI dashboard in Figure 19 .
| Command | Purpose |
|---|---|
| Defense | |
| /scan <content> | Single-shot scan |
| /status | Antibody and antigen library |
| /dashboard | Defense statistics |
| /history [N] | Recent scan history |
| /antibody list|add|remove | Library edits |
Table 11: Slash commands exposed by the CAITLYN terminal user interface. The upper block lists defense-facing commands. The lower block lists session and configuration commands.