Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection
cs.CR, cs.AI
Submitted: 2026-10-04
Updated: 2026-10-04
Comments: 29 pages, 10 figures, 20 tables. Code and data: https://anonymous.4open.science/r/audit-artifact-E593
Code: https://github.com/pallets/itsdangerous
License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
Sources
- AgentSecBench: Measuring Prompt Injection, Privacy Leakage, and Tool-Use Integrity in LLM Agents
- Design Patterns for Securing LLM Agents against Prompt Injections
- SecAlign: Defending Against Prompt Injection with Preference Optimization
- TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories
- ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning
- IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization
- LlamaFirewall: An open source guardrail system for building secure AI agents
- Defeating Prompt Injections by Design
- Memory Injection Attacks on LLM Agents via Query-Only Interaction
- Imprompter: Tricking LLM Agents into Improper Tool Use
- Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
- PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections
- Defending Against Indirect Prompt Injection Attacks With Spotlighting
- Assessing Automated Prompt Injection Attacks in Agentic Environments
- AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks
- AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?
- TRACES: Proactive Safety Auditing for Multi-Turn LLM Agents via Trajectory-State Modeling
- Auditing Provenance Sensitivity in LLM Agent Action Selection
- AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security
- Prompt Injection attack against LLM-integrated Applications
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs