mlsanityData to 14 Oct 2026

PromptArmor: Simple yet Effective Prompt Injection Defenses

arXiv 2507.15219 ↗First posted 21 Jul 2025cs.CR cs.AIcited by 108

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Despite their potential, recent research has demonstrated that LLM agents are vulnerable to prompt injection attacks, where malicious prompts are injected into the agent's input, causing it to perform an attacker-specified task rather than the intended task provided by the user. In this paper, we present PromptArmor, a simple yet effective defense against prompt injection attacks. Specifically, PromptArmor prompts an off-the-shelf LLM to detect and remove potential injected prompts from the input before the agent processes it. Our results show that PromptArmor can accurately identify and remove injected prompts. For example, using GPT-4o, GPT-4.1, or o4-mini, PromptArmor achieves both a false positive rate and a false negative rate below 1% on the AgentDojo benchmark. Moreover, after removing injected prompts with PromptArmor, the attack success rate drops to below 1%. We also demonstrate PromptArmor's effectiveness against adaptive attacks and explore different strategies for prompting an LLM. We recommend that PromptArmor be adopted as a standard baseline for evaluating new defenses against prompt injection attacks.

Key facts. Cited by 108 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 29 of its 45 references that are in the map. First posted on arXiv 21 Jul 2025.

Builds on

29 of 45 references.

Closest ancestors · 10

Same direction, newest first

  1. 2025WebInject: Prompt Injection Attack to Web Agents16 May
  2. 2025AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents9 May
  3. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  4. 2025Progent: Securing AI Agents with Privilege Control16 Apr
  5. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage17 Sep
  6. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  7. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  8. 2024R-Judge: Benchmarking Safety Risk Awareness for LLM Agents18 Jan
  9. 2023Testing Language Model Agents Safely in the Wild17 Nov
  10. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep

Other references · 19

  1. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2020Extracting Training Data from Large Language Modelscited by 2,189
  4. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
  5. 2024SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineeringcited by 1,737
  6. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  7. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  8. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  9. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 375
  10. 2024CodeAgent: Enhancing Code Generation with Tool-Integrated Agent Systems for Real-World Repo-level Coding Challengescited by 282
  11. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 267
  12. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 210
7 more
  1. 2024Optimization-based Prompt Injection Attack to LLM-as-a-Judgecited by 143
  2. 2025DataSentinel: A Game-Theoretic Detection of Prompt Injection Attackscited by 143
  3. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
  4. 2025PromptShield: Deployable Detection for Prompt Injection Attackscited by 50
  5. 2025A Critical Evaluation of Defenses against Prompt Injection Attackscited by 36
  6. 2025Frontier AI's Impact on the Cybersecurity Landscapecited by 21
  7. 2025Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instructioncited by 16

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 23; 2026: 85.

108 papers.

Sort:

By area:

  1. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 129
  2. 2026Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Frameworkcited by 54
  3. 2025AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injectioncited by 46
  4. 2026AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocationscited by 38
  5. 2025Defending Against Prompt Injection with DataFiltercited by 35
  6. 2026From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agentscited by 33
  7. 2025ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agentscited by 31
  8. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 31
  9. 2026The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysiscited by 30
  10. 2026Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threatscited by 29
  11. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 28
  12. 2026The Attack and Defense Landscape of Agentic AI: A Comprehensive Surveycited by 28
38 more
  1. 2025WAInjectBench: Benchmarking Prompt Injection Detections for Web Agentscited by 24
  2. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agentscited by 24
  3. 2025PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Featurescited by 20
  4. 2026MalTool: Malicious Tool Attacks on LLM Agentscited by 20
  5. 2025OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflowscited by 19
  6. 2026Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agentscited by 19
  7. 2025Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?cited by 18
  8. 2025ceLLMate: Sandboxing Browser AI Agentscited by 16
  9. 2026Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systemscited by 16
  10. 2026PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defensescited by 16
  11. 2026A Framework for Formalizing LLM Agent Securitycited by 16
  12. 2026Agentic Artificial Intelligence (AI): Architectures, Taxonomies, and Evaluation of Large Language Model Agentscited by 14
  13. 2026CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attributioncited by 14
  14. 2025TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detectioncited by 12
  15. 2025Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systemscited by 12
  16. 2026WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agentscited by 11
  17. 2026When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shiftcited by 11
  18. 2025SecInfer: Preventing Prompt Injection via Inference-time Scalingcited by 10
  19. 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Managementcited by 10
  20. 2025Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworkscited by 9
  21. 2025Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysiscited by 9
  22. 2026Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attackscited by 9
  23. 2026When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agentscited by 8
  24. 2026Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agentscited by 8
  25. 2026RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agentscited by 7
  26. 2026Structured Security Auditing and Robustness Enhancement for Untrusted Agent Skillscited by 7
  27. 2026Dynamic Malicious Skills in Agentic AIcited by 7
  28. 2026Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden Statescited by 7
  29. 2025Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domaincited by 6
  30. 2025Takedown: How It's Done in Modern Coding Agent Exploitscited by 6
  31. 2026Reasoning Models Will Sometimes Lie About Their Reasoningcited by 6
  32. 2026AgentWatcher: A Rule-based Prompt Injection Monitorcited by 6
  33. 2026When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agentscited by 6
  34. 2026A Security Analysis of the OpenClaw AI Agent Frameworkcited by 5
  35. 2026No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skillscited by 5
  36. 2026Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screeningcited by 5
  37. 2026AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agentscited by 5
  38. 2025On Surjectivity of Neural Networks: Can you elicit any behavior from your model?cited by 4

50 most cited of 108 All 108 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2026Defense Against Indirect Prompt Injection via Tool Result Parsing
  2. 2025To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt
  3. 2026Assessing Automated Prompt Injection Attacks in Agentic Environments
  4. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defenses
  5. 2025A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks
  6. 2024Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
  7. 2026Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents
  8. 2025Enhancing Security in LLM Applications: A Performance Evaluation of Early Detection Systems