AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification
This paper tackles a critical security vulnerability (indirect prompt injection) for users of LLM agents that interact with external tools, providing a novel inference-time defense. This is a significant incremental improvement in LLM agent security.
This paper addresses indirect prompt injection (IPI) in LLM agents, where attacker-controlled context in tool outputs or retrieved content manipulates agent actions. The authors propose AgentSentry, a framework that detects and mitigates IPI by modeling it as a temporal causal takeover, localizing takeover points, and purifying the context. AgentSentry eliminates successful attacks and improves Utility Under Attack (UA) by 20.8 to 33.6 percentage points over strong baselines, achieving an average UA of 74.55%.
Large language model (LLM) agents increasingly rely on external tools and retrieval systems to autonomously complete complex tasks. However, this design exposes agents to indirect prompt injection (IPI), where attacker-controlled context embedded in tool outputs or retrieved content silently steers agent actions away from user intent. Unlike prompt-based attacks, IPI unfolds over multi-turn trajectories, making malicious control difficult to disentangle from legitimate task execution. Existing inference-time defenses primarily rely on heuristic detection and conservative blocking of high-risk actions, which can prematurely terminate workflows or broadly suppress tool usage under ambiguous multi-turn scenarios. We propose AgentSentry, a novel inference-time detection and mitigation framework for tool-augmented LLM agents. To the best of our knowledge, AgentSentry is the first inference-time defense to model multi-turn IPI as a temporal causal takeover. It localizes takeover points via controlled counterfactual re-executions at tool-return boundaries and enables safe continuation through causally guided context purification that removes attack-induced deviations while preserving task-relevant evidence. We evaluate AgentSentry on the \textsc{AgentDojo} benchmark across four task suites, three IPI attack families, and multiple black-box LLMs. AgentSentry eliminates successful attacks and maintains strong utility under attack, achieving an average Utility Under Attack (UA) of 74.55 %, improving UA by 20.8 to 33.6 percentage points over the strongest baselines without degrading benign performance.