AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification

1. Problem Statement

Indirect Prompt Injection (IPI) is a critical security vulnerability in Large Language Model (LLM) agents that utilize external tools (e.g., search, email, calendars, APIs). Unlike direct prompt injection, where the attacker controls the user's input, IPI occurs when an attacker embeds malicious instructions into untrusted external content (e.g., a retrieved webpage, an email body, or a database record).

• The Mechanism: The agent retrieves this untrusted content as part of its task execution. The malicious instructions within the content are then incorporated into the agent's context state, silently steering the agent to perform unauthorized actions (e.g., data exfiltration, deleting files) that deviate from the user's original intent.
• The Challenge: Existing defenses (e.g., heuristic detection, strict tool filtering, or trajectory re-execution) often fail in multi-turn, multi-tool workflows.
  • Delayed Takeover: Malicious instructions may be introduced in an early "read" step but only trigger harmful actions several turns later.
  • False Positives/Negatives: Conservative defenses often terminate legitimate workflows prematurely to avoid risk, drastically reducing utility. Conversely, detection-only systems often miss subtle, context-dependent injections.
  • Black-Box Constraints: Defenses must work without access to model internals (weights/activations) and must not trigger irreversible side effects during the detection process.

2. Methodology: AgentSentry

AgentSentry is a novel inference-time defense framework that models multi-turn IPI as a temporal causal takeover. Instead of relying on surface-level pattern matching, it uses controlled counterfactual re-executions to determine if the agent's next action is causally driven by the user's goal or by the untrusted context.

The framework operates in two tightly coupled stages at tool-return boundaries (the moment a tool response is added to the context but before the next action is generated):

A. Temporal Causal Diagnostics

AgentSentry localizes the "takeover point" by estimating causal effects using four counterfactual regimes executed in a dry-run mode (no external side effects):

1. Original: Standard execution with user input and untrusted mediator content.
2. Masked: User input is replaced with a neutral probe; mediator content remains.
3. Masked + Sanitized: User input is neutral; mediator content is "sanitized" (instructions removed, facts retained).
4. Original + Sanitized: Standard user input; mediator content is sanitized.

Using these regimes, AgentSentry calculates:

• Average Causal Effect (ACE): Measures the dominance of the user goal.
• Indirect Effect (IE): Measures the causal contribution of the untrusted mediator content.
• Temporal Trend: It tracks these effects over a sliding window of tool-return boundaries. If the user's causal dominance attenuates (ACE decreases) while the mediator's influence strengthens (IE increases), a takeover is detected.

B. Causally Gated Context Purification

Once a takeover is detected at a specific boundary:

1. Purification: The system applies a causal purification transformation to the untrusted context. This process:
   • Retains task-relevant factual evidence (e.g., dates, names, prices).
   • Removes imperative instructions, priority overrides, and tool-capability directives embedded in the untrusted content.
   • Projects the content into a "non-actionable evidence" form.
2. Safe Continuation: The agent re-evaluates the next step using the purified context.
   • Low-impact, task-essential tool calls are preserved.
   • High-impact actions that were contingent on the malicious instructions are blocked or replanned.
   • The workflow continues rather than terminating, preserving utility.

3. Key Contributions

1. First Temporal Causal Defense: AgentSentry is the first inference-time defense to model IPI as a temporal causal takeover, enabling the localization of exactly when untrusted context becomes the dominant driver of agent behavior.
2. Counterfactual Diagnostic Protocol: It introduces a boundary-anchored protocol using controlled re-executions to estimate causal quantities (ACE, IE) without relying on lexical matching or similarity thresholds.
3. Causally Gated Purification: It enables safe continuation by selectively suppressing attack-induced control signals while preserving the evidence necessary for task completion, avoiding the "all-or-nothing" failure of previous defenses.
4. Black-Box Compatibility: The system is designed for black-box LLMs, requiring no model retraining or internal access, and operates via dry-run diagnostics to prevent side effects during detection.

4. Experimental Results

The authors evaluated AgentSentry on the AgentDojo benchmark across four task suites (Travel, Workspace, Banking, Slack), three IPI attack families (Important Instructions, Tool Knowledge, InjecAgent), and three black-box LLMs (GPT-4o, GPT-3.5-turbo, Qwen-3-Max).

• Security Performance: AgentSentry achieved an Attack Success Rate (ASR) of 0% across all attack families and models, effectively eliminating successful indirect prompt injections.
• Utility Performance: It maintained a high Utility Under Attack (UA) of 74.55% on average.
  • This represents a 20.8 to 33.6 percentage point improvement over the strongest existing baselines (e.g., Task Shield, MELON).
  • Unlike baselines that often degrade benign performance (Clean Utility), AgentSentry maintained or slightly improved Clean Utility (CU).
• Comparison:
  • vs. MELON: MELON often terminates tasks to ensure safety (low UA). AgentSentry allows tasks to complete by purifying context.
  • vs. Task Shield: Task Shield blocks benign preparatory steps due to strict alignment rules. AgentSentry distinguishes between causal drivers, allowing necessary steps to proceed.

5. Significance

• Paradigm Shift: The paper moves the field from heuristic detection (looking for suspicious keywords or patterns) to causal attribution (determining why an action was chosen). This is crucial for complex, multi-turn agents where the link between injection and action is non-linear.
• Practical Deployability: By operating at inference time without model retraining and supporting black-box APIs, AgentSentry offers a practical solution for enterprise deployments of LLM agents.
• Balancing Security and Utility: The most significant contribution is demonstrating that high security (0% ASR) does not require sacrificing task utility. By enabling "safe continuation," AgentSentry solves the fundamental trade-off that has plagued previous defenses, where protecting against IPI often meant breaking the agent's ability to work.

In summary, AgentSentry provides a robust, theoretically grounded, and empirically superior framework for securing tool-augmented LLM agents against indirect prompt injection, ensuring that agents remain aligned with user intent even when processing untrusted external data.