arxiv-2608-27496 · paper

ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection

Created: 2026-08-27 · Ingested: 2026-09-09

Indirect prompt injection (IPI) plants instructions in the content a tool-using LLM agent reads, steering the agent into harmful tool calls. The strongest defenses are system-level, leveraging techniques such as task-conditional tool screening to prevent execution of malicious tools, and information-flow control to avoid tool execution with untrusted parameters. However, as agents grow more capable, users delegate more to automation. Consequently, tool execution sequences and parameter values are increasingly determined at runtime and cannot be reliably screened from solely user's query withou

In brief

Enforcing where a value came from, rather than judging what it says, can block indirect prompt injection without the utility collapse that plan-conformance and static trust-boundary defenses suffer. ROPE precomputes an offline table of state-changing tools and their sensitive parameters, then uses 1 LLM call that reads only the user request to set, per parameter, which of 3 trust anchors (the request, a named unforgeable sender identity, the user's own authoritative records) may supply a value; a deterministic origin tracker and matcher enforce it at runtime with no model in the enforcement loop.

Across 4 agent models (GPT-4o-mini, GPT-4o, Gemini-2.5-Flash, Qwen3-235B) on AgentDyn and AgentDojo, against 11 baseline defenses, ROPE holds ASR to 1.6–2.6% while keeping 82–100% of undefended clean utility, and beats DRIFT by 7–25 CU points at comparable ASR. AutoDojo's adaptive optimizer barely moves ROPE (1.8 to 1.6 on GPT-4o-mini) while roughly quadrupling DRIFT on Qwen3-235B (7.1 to 28.5). AgentLAB long-horizon staged attacks reach 0.0 ASR on all 3 tested models.

Evidence includes a policy ablation isolating the router (fixed strict pin: CU 26.7; fixed loose pin: ASR 44.0; routed: 43.3 CU at 1.8 ASR) and a router-swap study down to gpt-oss-20b. Residual failures are enumerated: 90 attack successes, 46 from parameters delegated wholly to attacker-writable content, plus harm carried in free-text message bodies that no origin rule pins. Soundness assumes platforms expose unforgeable origin metadata, which real stacks provide unevenly.

If you build agent guardrails, this argues to spend effort on provenance plumbing rather than better LLM judges.

Written from the abstract by claude-opus-5 on 2026-09-09, with every figure checked against it. Not a substitute for the paper.

Referenced by

Claims in this catalog that draw on this source, and whether as support or counterpoint.

supportsFor tool-using agents, enforcing injection defense as a deterministic provenance check on sensitive tool parameters — with the only model call reading the trusted user request and never fetched content — makes admission decisions invariant to how an injection is worded, whereas defenses that judge the agent's runtime plan or behavior with a model can be steered by reworded injections.