# SIEVE: Selective Integrity Verification and Escalation for Defending LLM Agents against Indirect Prompt Injection

arXiv: https://arxiv.org/abs/2512.06716 · HTML: https://mlsanity.com/paper/2512.06716/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 11 of its 35 references that are in the map.
- First posted on arXiv 7 Dec 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)
- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 11 of 11)

- [The Rise and Potential of Large Language Model Based Agents: A Survey](https://mlsanity.com/paper/2309.07864/) (2023)
- [Mind2Web: Towards a Generalist Agent for the Web](https://mlsanity.com/paper/2306.06070/) (2023)
- [The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions](https://mlsanity.com/paper/2404.13208/) (2024)
- [StruQ: Defending Against Prompt Injection with Structured Queries](https://mlsanity.com/paper/2402.06363/) (2024)
- [Defending Against Indirect Prompt Injection Attacks With Spotlighting](https://mlsanity.com/paper/2403.14720/) (2024)
- [EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage](https://mlsanity.com/paper/2409.11295/) (2024)
- [IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems](https://mlsanity.com/paper/2403.04960/) (2024)
- [The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents](https://mlsanity.com/paper/2412.16682/) (2024)
- [DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents](https://mlsanity.com/paper/2506.12104/) (2025)
- [Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS](https://mlsanity.com/paper/2508.03125/) (2025)
- [DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents](https://mlsanity.com/paper/2503.23804/) (2025)

## Abstract (arXiv)

Large Language Models (LLMs) are increasingly used as the core of agentic systems due to their strong reasoning, planning, and tool-use capabilities. By interacting with external environments, LLM agents can execute real-world tasks on behalf of users rather than merely generate text. This expanded capability also amplifies the threat of indirect prompt injection (IPI), where malicious external content can manipulate agent behavior and trigger unauthorized actions, privacy leakage, or financial loss. Existing defenses generally follow two approaches. Plan- or rule-based methods constrain agent execution using predefined plans or execution rules, but may block legitimate actions that arise from dynamic runtime context. Semantic auditing methods offer greater flexibility, yet repeatedly re-evaluating proposed actions incurs substantial token and latency overhead. These limitations motivate a selective verification strategy that applies deterministic checks whenever reliable structural evidence is available and escalates only ambiguous cases. Accordingly, we propose SIEVE, which verifies tool transitions and argument sources against an Intent Graph, escalating actions that cannot pass deterministic verification to semantic adjudication. This selective design preserves flexibility while avoiding continuous semantic auditing. We evaluate SIEVE on AgentLure and AgentDojo against MELON, DRIFT, IPIGuard, and ARGUS. SIEVE achieves 5.94% ASR with 97.5% clean utility on AgentLure, and 0.34% ASR with 87.63% clean utility on AgentDojo. Compared with DRIFT and ARGUS, SIEVE incurs the lowest token consumption and the fewest API calls.