Research map / Multi-agent systems and games / LLM agents
DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DRIFT, a system-level prompt-injection defense for LLM agents combining a Secure Planner (minimal function trajectory and parameter checklists), a Dynamic Validator (privilege-aware deviation checks), and an Injection Isolator (masks conflicting instructions in memory).
Problem
Prompt injection attacks in tool-using LLM agents can mislead actions and contaminate memory; existing system-level defenses use static policies that hurt utility, and injected content persists in memory over long interactions.
Approach
Combine control-flow and data-flow constraints planned from the user query only, dynamically update them via a privilege-aware (Read/Write/Execute) intent-alignment check on deviations, and isolate injected instructions from the memory stream using an LLM-based detector and external masking.
Key results
- On AgentDojo with GPT-4o-mini, DRIFT reduces ASR from 30.7% to 1.4% (1.35%) while Utility Under Attack reaches 50.93%, above CaMeL by 15.5 points.
- On ASB with GPT-4o-mini, DRIFT achieves 4.8% ASR versus 15.8% for the runner-up Progent.
- Ablation on AgentDojo: Secure Planner alone lowers ASR to 2.14% but drops benign utility to 43.22%; adding Validator and Isolator restores utility to 57.29% with ASR 1.35%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add Secure Planner to Native Agent (ablation) | GPT-4o-mini ReAct agent · AgentDojo under attack | ASR: 30.67 -> 2.14 | Helped |
| add Secure Planner to Native Agent (ablation) | GPT-4o-mini ReAct agent · AgentDojo without attack | Benign Utility: 63.55 -> 43.22 | Hurt |
| add Dynamic Validator to Secure Planner (ablation) | GPT-4o-mini agent with Secure Planner · AgentDojo | Benign Utility: 43.22 -> 58.48 | Helped |
| add Dynamic Validator to Secure Planner (ablation) | GPT-4o-mini agent with Secure Planner · AgentDojo under attack | ASR: 2.14 -> 5.41 | Hurt |
| add Injection Isolator to Planner + Validator (ablation) | GPT-4o-mini DRIFT · AgentDojo under attack | ASR: 5.41 -> 1.35 | Helped |
| add Injection Isolator to Native Agent (ablation) | GPT-4o-mini ReAct agent · AgentDojo under attack | ASR: 30.67 -> 8.96 | Helped |
| use DRIFT instead of ReAct | GPT-4o-mini agent · AgentDojo under attack | ASR: 30.67 -> 1.35 | Helped |
| use DRIFT instead of Progent | GPT-4o-mini agent · ASB under attack | ASR: 15.75 -> 4.75 | Helped |
| use DRIFT instead of ReAct | GPT-4o-mini agent · AgentDojo without attack | Benign Utility: 63.55 -> 57.29 | Hurt |
| use DRIFT instead of ReAct | GPT-4o-mini agent · AgentDojo under attack | Utility: 48.27 -> 50.93 | Helped |
| use DRIFT instead of ReAct | GPT-4o agent · AgentDojo under attack | ASR: 51.68 -> 1.66 | Helped |
| use dynamic policy instead of static policy | AgentDojo agent · AgentDojo | Success Rate | Helped |
Surprising findings
- Control and data constraints alone do not stop all injections; an injection can alter the final answer without changing tool calls, which motivated the Injection Isolator.
- Progent's security degrades markedly with GPT-4o-mini (9.39% ASR on AgentDojo) while DRIFT stays low, which the authors attribute to decomposing the dynamic module into simpler subtasks.
Limitations
- Evaluation limited to AgentDojo-style domains, which do not cover all real-world tasks and attack scenarios.
- CaMeL and most defenses show severe over-defense on open-ended AgentDyn tasks; DRIFT's performance there remains weak.
- Open-ended task completion drops from 25.7% (base) to 17.8% under DRIFT.
Experimental setup
Datasets: AgentDojo ASB AgentDyn
Benchmarks: AgentDojo ASB AgentDyn
Metrics: Benign Utility Utility Under Attack Targeted ASR token cost efficiency
Baselines: repeat_user_prompt spotlighting_with_delimiting tool_filter transformers_pi_detector CaMeL Progent delimiters_defense ob_sandwich_defense
Builds on: ReAct CaMeL Progent chain-of-thought
Closest papers by meaning
- Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.90)
- A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory (ICML 2026 · similarity 0.89)
- SafeHarbor: Defining Precise Decision Boundaries via Hierarchical Memory-Augmented Guardrail for LLM Agent Safety (ICML 2026 · similarity 0.89)
- SecureClaw: Clawing Back Control of LLM Agents (NeurIPS 2026 · similarity 0.89)
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (NeurIPS 2024 · similarity 0.88)
- Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents (ICLR 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.