Research map / Multi-agent systems and games / LLM agents

CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes CausalArmor, a guardrail that uses batched leave-one-out attribution from a small proxy model to detect when an untrusted span dominates a privileged tool call, and only then sanitizes that span and masks reasoning history.

Problem

Indirect prompt injection (IPI) can make tool-calling agents execute unauthorized privileged actions, but existing defenses are always-on and degrade benign utility and latency (the over-defense dilemma).

Approach

Detect IPI as a "dominance shift" at privileged decision points: compute normalized leave-one-out attributions for the user request and each untrusted span, and trigger targeted sanitization plus retroactive CoT masking only when a span's attribution exceeds the user's by a margin tau.

Key results

• On DoomArena with Gemini-3-Pro, CausalArmor reduces ASR from 88.87% (no defense) to 3.65% while keeping benign utility at 70.96% vs 73.57% no-defense.
• Ablation on AgentDojo: removing retroactive CoT masking raises average ASR from 0.29% to 1.75% with BU dropping from 75.11 to 74.61.
• Proxy models above 8B parameters catch most IPI attacks, and those above 12B approach the oracle defense rate, per the paper's proxy study.

Surprising findings

• Sanitization with a threshold of tau=0 already reduces ASR to near zero while preserving most benign utility and latency.
• Small proxy models (Gemma-3-12B) can replicate large-model LOO attributions for detecting IPI, despite being about 30x smaller than the agent.

Limitations

• Causality is operational (leave-one-out span removal), not a full structural causal model; split-context attacks that spread influence thinly could evade detection.
• Guarantees depend on backbone capability and sanitizer effectiveness; the bound in the proposition is conditional on assumptions.
• In heavily adversarial settings where many steps are flagged, overhead approaches always-on sanitization.

Experimental setup

Datasets: AgentDojo DoomArena TauBench-Retail

Benchmarks: AgentDojo DoomArena

Metrics: Benign Utility Benign Latency Utility under Attack Attack Success Rate

Baselines: Repeat Prompt DeBERTa-pi-detector PiGuard MELON DRIFT

Builds on: AgentDojo DRIFT MELON CaMeL DoomArena

Closest papers by meaning

• AI Agents May Always Fall for Prompt Injections (NeurIPS 2026 · similarity 0.88)
• Optimizing Agent Planning for Security and Autonomy (ICLR 2026 · similarity 0.87)
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (NeurIPS 2024 · similarity 0.86)
• Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning (ICML 2026 · similarity 0.86)
• Learning to Inject: Automated Prompt Injection via Reinforcement Learning (NeurIPS 2026 · similarity 0.86)
• It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents (ICML 2026 · similarity 0.86)