StateFence: Task-State Protection Against Evidence-Chain Contamination in Blue-Team LLM Agents

Haowen Dai; Alejandro Guerra-Manzanares

cs.CRNov 2, 2026

StateFence: Task-State Protection Against Evidence-Chain Contamination in Blue-Team LLM Agents

Authors: Haowen Dai, Alejandro Guerra-Manzanares

Organizations: The University of Nottingham Ningbo China Ningbo, China

Abstract

Indirect prompt injection creates a distinctive risk for blue-team Large Language Model (LLM) agents in Security Operations Centers (SOCs). Malicious instructions can be embedded in telemetry, tickets, retrieval results, or memory and then propagate through alert triage, incident summarization, response recommendation, and Indicator of Compromise (IOC) extraction as locally plausible intermediate decisions. We characterize this failure mode as evidence-chain contamination of protected task state. The main challenge is task dependent: a suspicious string may be malicious control text for summarization but essential evidence for IOC extraction. To address this challenge, we propose StateFence, a task-aware evaluation and defense framework that treats severity labels, incident narratives, response policies, and IOC sets as protected states. StateFence maps indirect prompt-injection attacks into explicit, stealth, multi-hop, and persistent SOC evidence attacks, records observable propagation traces, and routes defenses according to the attacked state. Across controlled SOC cases and public-SOC validation cases, StateFence lowers attack success and reduces failures that appear only after evidence is poisoned, while preserving task utility and avoiding the indicator loss caused by task-mismatched filtering. Our findings indicate that robust blue-team LLM agents require mechanisms that preserve task-critical state under untrusted evidence.

Figures & tables

Figure 1: Prompt-centric filtering and StateFence task-state protection under the same poisoned SOC evidence.

Figure 2: Overview of StateFence. The left side shows StateFence, which routes untrusted SOC evidence through task-specific state defenses and evaluates outcomes using trace-based analysis. The right side illustrates an evidence-chain manipulation attack, where poisoned SOC evidence corrupts downstream task states when no state-aware defense is applied.

Task	Protected state	Intervention and utility requirement
Triage	Severity label	Calibrate severity; retain compromise cues.
Summary	Incident narrative	Filter control text; retain incident-point coverage.
Response	Action set	Filter and constrain actions; retain useful allowed responses.
IOC	Indicator set	Preserve source-linked candidates before filtering facts.

Table 1: Manually specified task-to-state contracts. The corresponding task contract is selected before inference, while state values are derived at runtime from the available evidence.

		Alert Triage			Summarisation		Response		IOC Extraction
Model	Defense	TS (%) $\uparrow$	AS (%) $\downarrow$	PD (%) $\downarrow$	TS (%) $\uparrow$	AS (%) $\downarrow$	TS (%) $\uparrow$	AS (%) $\downarrow$	TS (%) $\uparrow$	AS (%) $\downarrow$	Rec. (%) $\uparrow$
Claude	No defense	46.88	53.12	21.88	76.56	23.44	87.50	12.50	98.44	1.56	99.00
	Best public	62.50	37.50	12.50	92.19	7.81	93.75	6.25	100.00	0.00	100.00
	StateFence	87.50	12.50	4.69	93.75	6.25	95.31	4.69	98.44	1.56	98.44
Gemini	No defense	65.62	34.38	18.75	89.06	10.94	90.62	9.38	60.94	39.06	62.00
	Best public	79.69	20.31	7.81	95.31	4.69	92.19	7.81	95.31	4.69	95.00

Table 2: Main controlled-benchmark results across four SOC tasks. Best public is the strongest PA, DF, or LG result per model–task setting.

Model	Defense	TS (%) $\uparrow$	AS (%) $\downarrow$	PD (%) $\downarrow$
Claude	No defense	46.88	53.12	21.88
	Sanitize-only	26.56	73.44	29.69
	Policy-only	82.81	17.19	7.81
	StateFence	87.50	12.50	4.69
Gemini	No defense	65.62	34.38	18.75
	Sanitize-only	50.00	50.00	28.12

Table 3: Triage ablation across four target models.

Defense	End-to-end TS (%) $\uparrow$	End-to-end AS (%) $\downarrow$	IOC Rec. (%) $\uparrow$
No defense	57.81	42.19	78.13
Best public	70.31	29.69	92.19
Full firewall	46.88	53.13	62.50
Structured extraction	65.63	34.38	81.25
StateFence	89.06	10.94	96.88

Table 4: Held-out end-to-end evidence-chain evaluation.

Defense	TS (%) $\uparrow$	AS (%) $\downarrow$	Rec. (%) $\uparrow$	PD (%) $\downarrow$
PromptArmor	84.38	15.62	92.00	15.62
DataFilter	86.72	13.28	94.50	12.50
LLM Guard	83.59	16.41	93.50	17.19
StateFence	91.41	8.59	94.00	4.69

Table 5: Average performance of baselines and StateFence on public SOC tasks.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Threshold	No defense	Full firewall
Coverage $\geq 0.4$	82.8	93.8
Coverage $\geq 0.5$	75.0	92.2
Coverage $\geq 0.6$	70.3	90.6

Appendix

Table 6: Summary coverage threshold sensitivity. Entries are TS percentages.

Threshold	No defense	Full firewall
At least 1 allowed action	89.1	96.9
At least 2 allowed actions	82.8	90.6

Appendix

Table 7: Allowed-action threshold sensitivity for response scoring. Entries are TS percentages.

Threshold	No defense	DataFilter	Full firewall
Rec. $\geq 0.95$	70.3	96.9	43.8
Rec. $\geq 0.99$	62.5	93.8	40.6
Average Rec. (%)	62.5	93.8	53.1

Appendix

Table 8: IOC recall threshold sensitivity.

Matcher	No defense PD	StateFence PD	Gap
Exact match	18.8	1.6	17.2
Normalized label match	17.2	1.6	15.6
Semantic bucket match	18.8	0.0	18.8

Appendix

Table 9: PD sensitivity under alternative severity matchers. Values are percentages.

Model	Defense	TS (%)	AS (%)	Rec. (%)
Claude	No defense	98.44	1.56	99.00
	Full firewall	57.81	42.19	75.00
	StateFence (IOC-preserving)	98.44	1.56	98.44
Gemini	No defense	60.94	39.06	62.00
	Full firewall	40.62	59.38	52.00
	StateFence (IOC-preserving)	90.63	9.38	93.75

Appendix

Table 10: IOC route ablation across four target models. Full firewall is the task-mismatched comparison.

Figure 3: Propagation-profile visualization by attack family and protected state on the controlled formal benchmark.

Figure 4: IOC route comparison averaged over four target models. The left panel reports task success and IOC recall; the right panel reports attack success.

Slice	Metric	Comparison	$\Delta$ (%)	95% CI	$p$
Triage / Claude	AS	None $\rightarrow$ SG	39.06	[23.44, 54.69]	$<0.001$
Triage / Gemini	PD	None $\rightarrow$ SG	15.63	[6.25, 26.56]	0.006
Response / Claude	AS	None $\rightarrow$ FW	12.50	[4.69, 20.31]	0.008
IOC / Qwen	AS	None $\rightarrow$ FW	-51.56	[-64.06, -39.06]	$<0.001$

Appendix

Table 11: Representative paired statistical checks on 64-case formal slices.

\Delta

is the baseline rate minus the defense rate. SG denotes severity_guard ; FW denotes full_firewall .

Task	$n$	Raw TS	Matched TS
Triage	4	75.00%	100.00%
Summary	4	100.00%	100.00%
Response	4	100.00%	100.00%

Appendix

Table 12: Existing defense-aware results on gpt-5.4 . Matched routes are severity protection for triage and firewalling for summary/response.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 530 papers

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
Jun 9, 2026Yuchen Ling, Shengcheng Yu, Zhenyu Chen +1Prompt Injection LLM Agent Security
State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China · Technical University of Munich, Heilbronn, Germany
AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification
Feb 26, 2026Tian Zhang, Yiwei Xu, Juan Wang +8Prompt Injection Defense Prompt Injection Attacks on AI Agents
Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China · Department of Computer Science and Engineering, University at Buffalo, SUNY · Department of Computer Science, College of Information Science and Technology, Jinan University, Guangzhou 510632, China +1
Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents
Oct 13, 2026Kristoffer Hempel, Nils Loose, Lorenzo Cavallaro +1LLM Agent Security Runtime Enforcement for AI Agents
Universität zu Lübeck · University College London · Mohamed bin Zayed University of Artificial Intelligence

Jun 9, 2026J/K move · Enter open · S save

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

Yuchen Ling, Shengcheng Yu, Zhenyu Chen, Chunrong Fang

State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China · Technical University of Munich, Heilbronn, Germany

Prompt Injection LLM Agent Security AI Agent Security Benchmarks

Open paper AskPDF arXiv

Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments. This transition changes the nature of security risk. In agentic settings, failures are no longer limited to unsafe text generation. Untrusted content may redirect control flow, misuse tool privileges, corrupt persistent state, leak sensitive information, or trigger harmful external actions. At the same time, research on LLM agent security is expanding quickly but remains fragmented across attack families, defense layers, application domains, and evaluation settings. This paper synthesizes 247 papers through a lifecycle-based, systems-oriented framework that models agent security around the interaction of information flow, delegated authority, and persistent state. We organize the literature around four questions: how LLM agent security should be modeled, which threat surfaces and attack families dominate, what defenses have been proposed and with what tradeoffs, and how security claims are evaluated. We find that prompt injection and tool-mediated control-flow hijacking still dominate the field, while persistent state corruption and multi-agent propagation are becoming central emerging concerns. We further find that current defenses provide useful building blocks but remain weakly compositional, and that existing benchmarks still underrepresent long-horizon, stateful, and deployment-sensitive risks. We argue that secure LLM agents require explicit trust boundaries, principled privilege control, provenance-aware state management, and evaluation practices aligned with realistic operational settings.

Abstract

AI Agent Security

Explore similar work

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents