mlsanityData to 14 Oct 2026

Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks

arXiv 2511.15203 ↗First posted 19 Nov 2025cs.CR cs.AIcited by 9

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Large Language Model (LLM)-based agents with function-calling capabilities are increasingly deployed, but remain vulnerable to Indirect Prompt Injection (IPI) attacks that hijack their tool calls. In response, numerous IPI-centric defense frameworks have emerged. However, these defenses are fragmented, lacking a unified taxonomy and comprehensive evaluation. In this Systematization of Knowledge (SoK), we present the first comprehensive analysis of IPI-centric defense frameworks. We introduce a comprehensive taxonomy of these defenses, classifying them along five dimensions. We then thoroughly assess the security and usability of representative defense frameworks. Through analysis of defensive failures in the assessment, we identify six root causes of defense circumvention. Based on these findings, we design three novel adaptive attacks that significantly improve attack success rates targeting specific frameworks, demonstrating the severity of the flaws in these defenses. Our paper provides a foundation and critical insights for the future development of more secure and usable IPI-centric agent defense frameworks.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 50 of its 58 references that are in the map. First posted on arXiv 19 Nov 2025.

Builds on

50 of 58 references.

Closest ancestors · 20

Same direction, newest first

  1. 2025ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents26 Sep
  2. 2025LLMZ+: Contextual Prompt Whitelist Principles for Agentic LLMs23 Sep
  3. 2025IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents21 Aug
  4. 2025AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection2 Aug
  5. 2025PromptArmor: Simple yet Effective Prompt Injection Defenses21 Jul
  6. 2025DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents13 Jun
  7. 2025SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systems9 Jun
  8. 2025To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt6 Jun
  9. 2025AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents9 May
  10. 2025LlamaFirewall: An open source guardrail system for building secure AI agents6 May
  11. 2025Progent: Securing AI Agents with Privilege Control16 Apr
  12. 2025Defeating Prompt Injections by Design24 Mar
8 more
  1. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents17 Mar
  2. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents27 Feb
  3. 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents21 Dec
  4. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  5. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents19 Jun
  6. 2024Combining Fine-Tuning and LLM-based Agents for Intuitive Smart Contract Auditing with Justifications24 Mar
  7. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
  8. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar

Other references · 30

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  4. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  5. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  6. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  7. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  8. 2023Detecting Language Model Attacks with Perplexitycited by 431
  9. 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directionscited by 265
  10. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 264
  11. 2025WebSailor: Navigating Super-human Reasoning for Web Agentcited by 229
  12. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 210
18 more
  1. 2025WebDancer: Towards Autonomous Information Seeking Agencycited by 188
  2. 2025WebWalker: Benchmarking LLMs in Web Traversalcited by 175
  3. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 129
  4. 2025Securing AI Agents with Information-Flow Controlcited by 121
  5. 2025WebShaper: Agentically Data Synthesizing via Information-Seeking Formalizationcited by 121
  6. 2024Automatic and Universal Prompt Injection Attacks against Large Language Modelscited by 119
  7. 2025WebWatcher: Breaking New Frontier of Vision-Language Deep Research Agentcited by 119
  8. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
  9. 2024Editable Scene Simulation for Autonomous Driving via Collaborative LLM-Agentscited by 91
  10. 2025WebSailor-V2: Bridging the Chasm to Proprietary Agents via Synthetic Data and Scalable Reinforcement Learningcited by 61
  11. 2025Contextual Agent Security: A Policy for Every Purposecited by 59
  12. 2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 55
  13. 2025Can Indirect Prompt Injection Attacks Be Detected and Removed?cited by 52
  14. 2025Defending Against Prompt Injection With a Few DefensiveTokenscited by 33
  15. 2024DriVLMe: Enhancing LLM-based Autonomous Driving Agents with Embodied and Social Experiencescited by 27
  16. 2024FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attackscited by 22
  17. 2025SecInfer: Preventing Prompt Injection via Inference-time Scalingcited by 10
  18. 2025VortexPIA: Indirect Prompt Injection Attack against LLMs for Efficient Extraction of User Privacycited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 9.

9 papers.

  1. 2026MemLineage: Lineage-Guided Enforcement for LLM Agent Memorycited by 16
  2. 2026Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malwarecited by 10
  3. 2026Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attackscited by 9
  4. 2026Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memorycited by 7
  5. 2026ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injectioncited by 2
  6. 2026Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Callscited by 1
  7. 2026Workspace Topology as an Attack Vector in Agentic Coding Assistantscited by 0
  8. 2026CounterSteer: Suppressing Indirect Prompt Injection with Activation Steeringcited by 0
  9. 2026APEX: Active Protection at Execution Boundaries for LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks
  2. 2026The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis
  3. 2025Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms
  4. 2026Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs
  5. 2026AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents
  6. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
  7. 2026Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks
  8. 2025Design Patterns for Securing LLM Agents against Prompt Injections