AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

2026-02-26 · Source: Takara TLDR - Daily AI Papers · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, medium

Summary

AgentSentry is a new inference-time defense framework designed to mitigate indirect prompt injection (IPI) in large language model (LLM) agents that utilize external tools and retrieval systems. IPI attacks involve attacker-controlled context silently steering agent actions over multi-turn trajectories, which existing heuristic-based defenses often mishandle by prematurely terminating workflows. AgentSentry models IPI as a temporal causal takeover, localizing these takeover points through controlled counterfactual re-executions at tool-return boundaries. It then purifies the context by removing attack-induced deviations while preserving task-relevant information. Evaluated on the AgentDojo benchmark across four task suites, three IPI attack families, and multiple black-box LLMs, AgentSentry successfully eliminates attacks and achieves an average Utility Under Attack (UA) of 74.55%, improving UA by 20.8 to 33.6 percentage points over leading baselines without degrading benign performance.

Key takeaway

For AI Scientists developing or deploying LLM agents with external tools, AgentSentry offers a robust defense against indirect prompt injection. You should consider integrating its temporal causal diagnostics and context purification methods to enhance security. This approach significantly improves agent utility under attack while maintaining benign performance, addressing a critical vulnerability in autonomous agent design.

Key insights

AgentSentry mitigates indirect prompt injection in LLM agents by modeling it as a temporal causal takeover and purifying context.

Principles

• IPI is a temporal causal takeover.
• Counterfactual re-execution localizes attack points.

Method

AgentSentry uses controlled counterfactual re-executions at tool-return boundaries to localize IPI takeover points, followed by causally guided context purification to remove malicious deviations.

In practice

• Apply temporal causal diagnostics for multi-turn IPI.
• Implement context purification to preserve utility.

Topics

• LLM Agents
• Indirect Prompt Injection
• Inference-Time Defense
• Causal Diagnostics
• Context Purification

Best for: AI Scientist, Research Scientist, CTO, AI Researcher, AI Engineer, AI Security Engineer

Related on AIssential

• What is Prompt Injection? — LLM agents process all input uniformly, making them vulnerable to adversarial text that overwrites intended instructions.
• RaMem: Contextual Reinstatement for Long-term Agentic Memory — RaMem prevents "context collapse" in LLM agent memory by reinstating original episodic context to validate retrieved fragments.
• AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations — Indirect prompt injection via SaaS integrations poses a significant, under-measured threat to LLM agents, requiring specialized dynamic defenses.
• From Reward-Hack Activations to Agentic Risk States: Context-Calibrated Mechanistic Monitoring in LLM Agents — Context-calibrated internal monitoring, combining activation, entropy, and context, is crucial for detecting risky LLM agent actions.
• ToolChoiceConfusion: Causal Minimal Tool Filtering for Reliable LLM Agents — Reliable LLM agent tool selection hinges on causal necessity, not just semantic relevance or executability.
• Escaping the Self-Confirmation Trap: An Execute-Distill-Verify Paradigm for Agentic Experience Learning — Decoupling LLM agent experience learning into execute, distill, and verify stages prevents self-confirmation errors and improves reliability.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Takara TLDR - Daily AI Papers.