tool-using-agents-enforcing-injection-defense-deterministic-provenance-check-sensitiveFor tool-using agents, enforcing injection defense as a deterministic provenance check on sensitive tool parameters — with the only model call reading the trusted user request and never fetched content — makes admission decisions invariant to how an injection is worded, whereas defenses that judge the agent's runtime plan or behavior with a model can be steered by reworded injections.
Ingested from a paper but not yet reviewed by a human. It is deliberately inert: it does not move any technique’s standing, does not count toward the backtest, and is excluded anywhere a claim would carry weight. Read the source before relying on it.
Capability: Following instructions hidden in data
Observed on
Holds where the platform exposes unforgeable origin metadata (signed senders, user-owned records) for values the agent reads, and where the harm passes through a state-changing too.
Sources
- Measured on AgentDyn (three open-ended suites) and AgentDojo with four agent models against eleven baselines. Static attack success held to 1.6-2.6% with 82-100% of undefended clean utility; under AutoDojo injection optimization the origin check moved by under a point while DRIFT roughly doubled on two API models and rose from 7.1 to 28.5 on Qwen3-235B. Long-horizon staged attacks reached 0% against it. Paraphrase invariance is also argued formally, conditional on stated deployment assumptions. Author-run comparison; [truncated]
Disagreeing is the most useful thing you can do here. Both sides of every contested claim in this catalog were assembled by the same person, which is its weakest point.
Related claims
- For computer-use agents operating on a real OS, indirect-injection success rates measured with a fixed hand-written injection template understate vulnerability, because an attacker that adapts phrasing from the agent's own refusal trajectories can reach substantial success on models the fixed template never penetrates.Following instructions hidden in data · unreviewed
- For tool-using agents, restricting capabilities at the harness level after untrusted content enters the context — revoking or tightening the parameter envelopes of skills that lie on graph paths to deployer-defined forbidden states — cuts indirect-injection attack success further than prompt-level or per-action authorization defenses, and does so with no extra model calls or tokens, because enforcement reads the transition graph rather than the natural-language content.Following instructions hidden in data · unreviewed
- Prompt injection defenses that report near-zero attack success on short-context benchmarks lose most of that protection when the injected instruction sits inside a document of thousands to tens of thousands of tokens: fine-tuned separation defenses and detect-localize-remove pipelines still let a large share of injections through on paper review, resume screening, code review and email threads.Following instructions hidden in data · unreviewed
- A linear probe on a tool-calling model's hidden state at the last generated token detects incorrect tool-calls — including wrong-but-well-typed argument values that parsers and logs do not catch — and works better on larger models and at middle-to-late layers than at the final layer.Using the tools it is given · unreviewed
- For open-weight agents where attention matrices are accessible, detecting injection by asking which context span actually drove the tool call — aggregating attention over the decision tokens and localizing the guiding span, then checking whether that span's provider has authority for the action — catches unauthorized tool invocations at higher true-positive and lower false-positive rates than static scanners that look for malicious-looking text, because benign-looking injected text is only harmful when it is what the model actually attends to.Following instructions hidden in data · unreviewed
Notes
Drafted from the paper by a model and filed unreviewed. Visible here so it can be read, not because anyone has vouched for it: it does not move any technique's standing and does not count toward the internal scorecard. Drafted confidence: medium. Falsifier as drafted: An adaptive attacker that raises attack success against the origin-check defense by rewording injections alone, without altering the origin of the value it plants; or a model-in-the-loop plan-conformance defense that proves equally unmoved by injection optimization at comparable clean utility. Proposed technique, not catalogued: deterministic origin check on sensitive tool parameters.