Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents

Abstract

Recent work (2024 to 2026) has converged on a strategy for defending tool-using LLM agents against indirect prompt injection: rather than training the model to refuse malicious instructions, enforce security outside the model with a deterministic policy that mediates the agent's actions. Systems such as CaMeL, FIDES, Progent, RTBAS, and FORGE realize this with capabilities, information-flow labels, and reference monitors, and several report near-elimination of attacks on the AgentDojo benchmark.

Categories

Framework mappings

Suggested from the entry's categories.

@misc{narisetty2026adaptive,
  title = {{Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents}},
  author = {Praneeth Narisetty and Shiva Nagendra Babu Kore and Uday Kumar Reddy Kattamanchi and Jayaram Kumarapu},
  year = {2026},
  month = jun,
  eprint = {2606.26479},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.26479}
}