Research map / Multi-agent systems and games / LLM agents

PragLocker: Protecting Agent Intellectual Property in Untrusted Deployments via Non-Portable Prompts

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Software engineering agent benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes PragLocker, a black-box prompt obfuscation scheme that turns an agent system prompt into a code-symbol form and then optimizes character-level noise using target-LLM feedback so the prompt works only on the target LLM.

Problem

Agent system prompts are valuable IP, and in untrusted deployments they can be copied and reused on other proprietary LLMs; existing watermarking, encryption, and obfuscation methods fail to proactively and portably block such reuse under black-box access.

Approach

Two-phase black-box pipeline: an LLM-driven code-symbol rewrite of the prompt for initialization, followed by random-search noise injection guided by target-model log-probs with a loss that adds edit-distance and non-language (entropy) terms, producing model-specific prompts that are non-portable.

Key results

• PragLocker reduces cross-LLM portability to 0.20x of unprotected prompts (e.g., HumanEval GPT-4o prompt scores 3.04 on Gemini 2 vs 98.78 unprotected).
• Protected prompts preserve target performance at 1.01x of original across agents and tasks.
• LLM-assisted recovery yields 3.49x relative gain and deobfuscation only 1.03x, versus 4.78x for naive prompt re-synthesis.

Surprising findings

• Naive prompt re-synthesis by the attacker recovers more utility (4.78x) than deobfuscation of the protected prompt (1.03x), suggesting attackers are better off re-eliciting prompts from the LLM.
• Code-symbol rewriting alone gives almost no protection (0.99x portability), showing the optimization stage is responsible for non-portability.

Limitations

• Requires target tokenizer with broad character coverage for character-level noise injection.
• Non-portability is shown on a limited set of agents, tasks, and models; intra-family evaluation covers only Qwen2.5.
• Does not protect against behavior-reproduction attacks such as imitation, prompt induction, or distillation from examples.

Experimental setup

Datasets: HumanEval MBPP NarrativeQA QuALITY LoCoMo DialSim

Benchmarks: HumanEval MBPP NarrativeQA QuALITY LoCoMo DialSim

Metrics: pass@1 token-level F1 accuracy mean portability loss ratio relative attack gain

Baselines: PragLocker-tune PragLocker-code EmojiPrompt PromptCARE PromptCOS

Builds on: random search Levenshtein distance PromptCARE EmojiPrompt

Closest papers by meaning

• SecureClaw: Clawing Back Control of LLM Agents (NeurIPS 2026 · similarity 0.88)
• Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents (NeurIPS 2026 · similarity 0.87)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents (NeurIPS 2025 · similarity 0.86)
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.86)
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (NeurIPS 2024 · similarity 0.86)
• Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents (ICLR 2026 · similarity 0.86)