Technical Summary: Spider-Sense: Intrinsic Risk Sensing for Efficient Agent Defense with Hierarchical Adaptive Screening

1. Problem Statement

As Large Language Models (LLMs) evolve into autonomous agents capable of environment perception, task planning, and tool execution, their applicability has expanded into critical domains such as finance, coding, and web interaction. However, this expanded action space introduces significant security risks, including prompt injection, memory poisoning, and tool-based exploits that can lead to real-world consequences like data exfiltration and unauthorized system operations.

The authors identify a fundamental flaw in existing defense mechanisms: they predominantly adopt a mandatory checking paradigm. In these systems, security validation is forcibly triggered at predefined stages of the agent lifecycle (e.g., action generation or tool invocation) regardless of whether a risk is actually present. This approach leads to:

• High Latency: Each additional planning step or tool call incurs a security check, causing rapidly accumulating overhead in complex, multi-step workflows.
• False Positives: Frequent, unnecessary checks disrupt normal user interactions.
• Scalability Issues: Many approaches rely on external verifier models, incurring significant computational costs and introducing system dependencies that limit practical deployment.

The paper argues that effective agent security should be intrinsic and selective, intervening only when genuine risk is perceived, rather than being an architecturally decoupled, mandatory procedure.

2. Methodology: The SPIDER-SENSE Framework

The proposed SPIDER-SENSE framework introduces an event-driven defense paradigm based on Intrinsic Risk Sensing (IRS) and Hierarchical Adaptive Screening (HAS).

2.1 Intrinsic Risk Sensing (IRS)

IRS internalizes security as a native cognitive function of the agent, allowing it to maintain a "latent state of vigilance" throughout its execution flow.

• Mechanism: The agent autonomously evaluates a risk-sensing indicator ($\phi_t^{(k)}$) at each of the four security-critical stages: Query ($q$), Plan ($P_t$), Action ($a_t$), and Observation ($o_t$).
• Triggering: Based on the current artifact, interaction history, and system instructions, the agent decides whether to produce a sensing indicator. If a potential risk is perceived, the agent pauses the standard flow.
• Implementation: The agent wraps the suspicious artifact in a specialized template (e.g., <|sanitize_observation|> for tool outputs) and routes it to the security checking mechanism. This process is endogenous, requiring no external supervision or architectural overhead.

2.2 Hierarchical Adaptive Screening (HAS)

Once triggered, the suspicious artifact undergoes a two-tiered verification process designed to balance efficiency and precision:

1. Coarse-grained Detection (Fast Screening):
   • The system maintains stage-specific attack vector databases ($D^{(k)}$) containing vectorized representations of known attack patterns.
   • The current artifact is embedded and compared against stored patterns using cosine similarity.
   • If the similarity score exceeds a threshold ($\tau^{(k)}$), a high-confidence result is returned immediately, resolving known patterns with minimal latency.
2. Fine-grained Analysis (Deep Reasoning):
   • If the similarity score is below the threshold (indicating ambiguity or unknown patterns), the system escalates to a deep reasoning stage.
   • A Large Language Model (LLM) performs explicit reasoning over the current artifact and the top-$K$ most similar retrieved cases to produce a reasoned outcome.
3. Decision Making: The main agent receives the verification result and autonomously decides to ACCEPT, REJECT, or SANITIZE the execution.

3. Key Contributions

1. Intrinsic Risk Sensing (IRS): The authors propose a paradigm that embeds risk awareness directly into the agent's execution flow via instruction-level conditioning. This enables endogenous, event-driven defense without external guard models or constant stage-wise inspection.
2. Hierarchical Adaptive Screening (HAS): A novel mechanism that adaptively balances efficiency and accuracy. It utilizes stage-specific attack vector databases to resolve known threats via fast vector matching while routing ambiguous cases to deep internal reasoning, eliminating reliance on external models for every check.
3. S2Bench Benchmark: The authors introduce S2Bench, a lifecycle-aware benchmark designed to rigorously evaluate in-situ agent interception. Unlike existing static benchmarks, S2Bench features:
   • Multi-stage and Multi-scenario: Coverage of four agent stages across eight application domains and 79 sub-task scenarios.
   • Real Tool Execution: Integration of a large-scale tool library (~300 functions) and realistic return contents (over 100 types) rather than placeholder text.
   • Hard Benign Prompts: 153 carefully constructed benign samples that mimic attack structures to test for over-defense and false positives.
   • Realistic Attack Simulation: An external injector that manipulates tool outputs and memory retrieval dynamically to induce state-dependent execution deviations.

4. Experimental Results

The authors evaluated SPIDER-SENSE against static guardrails (e.g., LLaMA-Guard 3, gpt-oss-safeguard) and agentic defenses (e.g., GuardAgent, AGrail) using the Mind2Web, eICU, and S2Bench datasets.

• Defense Performance: SPIDER-SENSE achieved the lowest Attack Success Rate (ASR) and False Positive Rate (FPR) across all benchmarks.
  • On Mind2Web, using Claude-3.5, SPIDER-SENSE improved Label Prediction Accuracy (LPA) from 84.8% (baseline) to 95.8% and F1 from 90.3% to 92.1%.
  • On S2Bench, it significantly reduced ASR in the "Plan" stage (a known blind spot for other defenses) to 17.7% (Claude-3.5) and 20.0% (Qwen-max), while maintaining low FPR.
• Efficiency: The framework achieved a superior trade-off between security and utility. It incurred a marginal latency overhead of only 8.3% compared to the baseline, whereas existing "always-on" defenses incurred overheads ranging from 197% to 381%.
• Ablation Studies:
  • Removing sensing at any single stage caused a significant surge in ASR (e.g., +29.9% when action-stage sensing was disabled), confirming the necessity of full-lifecycle monitoring.
  • Removing the fine-grained analysis stage dropped defense precision significantly, while removing coarse-grained detection severely degraded efficiency, validating the hierarchical design.

5. Significance and Claims

The paper claims that Spider-Sense represents a shift from external, mandatory security procedures to intrinsic, selective risk awareness. By treating security as a native cognitive function, the framework allows agents to maintain "latent vigilance" and trigger defenses only upon risk perception.

The authors assert that this approach:

• Preserves Utility: By avoiding constant, repetitive checks, it prevents the latency and false positives that hinder the practical deployment of complex agents.
• Enhances Scalability: By relying on internal reasoning and lightweight similarity matching rather than external verifier models for every step, it reduces computational costs and system dependencies.
• Provides Robust Evaluation: Through S2Bench, the work offers a more realistic evaluation standard that accounts for the dynamic, state-dependent nature of agent attacks, moving beyond static text-level injection tests.

The work concludes that intrinsic risk awareness is a practical foundation for scalable agent security, enabling agents to operate safely in real-world environments without compromising their efficiency or autonomy.