ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection

Abstract

Indirect prompt injection (IPI) plants instructions in the content a tool-using LLM agent reads, steering the agent into harmful tool calls. The strongest defenses are system-level, leveraging techniques such as task-conditional tool screening to prevent execution of malicious tools, and information-flow control to avoid tool execution with untrusted parameters. However, as agents grow more capable, users delegate more to automation. Consequently, tool execution sequences and parameter values ar

Categories

Framework mappings

Suggested from the entry's categories.

@misc{ma2026rope,
  title = {{ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection}},
  author = {Xinhang Ma and Chaowei Xiao and William Yeoh and Ning Zhang and Yevgeniy Vorobeychik},
  year = {2026},
  month = aug,
  eprint = {2608.27496},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27496}
}