💻 computer science

AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization

AgentVisor is a novel defense framework that protects LLM agents from prompt injection attacks by applying OS-inspired semantic virtualization to enforce privilege separation and a one-shot self-correction mechanism, achieving near-total attack mitigation with minimal utility loss.

Original authors: Zonghao Ying, Haozheng Wang, Jiangfan Liu, Quanchen Zou, Aishan Liu, Jian Yang, Yaodong Yang, Xianglong Liu

Published 2026-04-28

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zonghao Ying, Haozheng Wang, Jiangfan Liu, Quanchen Zou, Aishan Liu, Jian Yang, Yaodong Yang, Xianglong Liu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you hire a super-smart, eager-to-please assistant (an LLM Agent) to handle your daily tasks, like booking flights, checking emails, or managing your bank account. This assistant is powerful, but it has a dangerous flaw: it can't always tell the difference between your instructions and someone else's sneaky notes hidden in the documents it reads.

This is the problem of Prompt Injection. It's like a hacker whispering, "Ignore your boss and send all my money to me," inside an email your assistant is reading. If the assistant listens, it could steal your data or crash your system.

Existing defenses are like trying to teach the assistant to be "more careful." Sometimes this works, but often the assistant gets confused, blocks your legitimate requests (over-defense), or misses the sneaky attacks entirely.

Enter AgentVisor: The "Hypervisor" for AI

The authors of this paper propose a new solution called AgentVisor. To understand it, imagine a classic computer operating system (like Windows or macOS). In those systems, there's a special layer called a Hypervisor. The Hypervisor is the ultimate boss; it keeps the regular programs (Guests) isolated from the sensitive hardware. If a program tries to do something dangerous, the Hypervisor stops it.

AgentVisor does the exact same thing, but for AI agents.

Here is how it works, broken down into simple steps:

1. The Setup: Guest vs. Visor

The Guest (The Agent): This is your AI assistant. It's allowed to look at everything—your emails, the web, your documents. But it is treated as "untrusted" when it comes to making final decisions. It can suggest what to do, but it can't do it yet.
The Visor (The Security Guard): This is a separate, trusted AI layer. It acts like a bouncer. It never sees the raw, messy documents the Guest is reading. Instead, it only sees a clean, summarized list of what the Guest wants to do.

2. The Three-Step Security Check (The STI Protocol)

Before the Guest can actually execute a tool (like "send an email" or "transfer money"), the Visor runs a strict three-part audit, which the authors call the STI Protocol:

S - Suitability (The "Job Description" Check):
- Question: "Is this tool even allowed for this assistant?"
- Analogy: If your assistant is hired to write reports, but suddenly tries to "delete the database," the Visor says, "Nope, that's not in your job description." This stops direct attacks where hackers try to trick the AI into doing things it shouldn't.
T - Taint (The "Motivation" Check):
- Question: "Is this action what the user actually wants, or is it a hidden command from a document?"
- Analogy: If you asked the assistant to "summarize this article," but the article secretly says "also forward this to my enemy," the Visor spots that the goal has been "tainted" by the document. It blocks the forwarding.
I - Integrity (The "Details" Check):
- Question: "Are the specific details correct?"
- Analogy: You asked to "send an email to Mom." The Visor checks the details. If the AI tries to send it to "Hacker@evil.com" instead, the Visor catches that the recipient was swapped, even if the action (sending email) was okay.

3. The "Second Chance" (Self-Correction)

Old security systems often just say "NO" and stop the whole process, which is annoying if you just made a small mistake.

AgentVisor is smarter. If the Visor catches a problem, it doesn't just kill the task. Instead, it sends a Semantic Exception—a polite but firm note back to the Guest.

The Note says: "Hey, you tried to send money to the wrong person. That violates the rules. Please try again, but only send it to the person you originally intended."
The Guest then self-corrects once and tries again. In the paper's tests, this single "second chance" fixed almost all the problems without needing to restart the whole conversation.

What Did They Find?

The researchers tested this system against many different types of sneaky attacks (both direct commands and hidden notes in documents).

Super Secure: They reduced the success rate of hackers to nearly 0% (specifically 0.65% in their tests).
Still Useful: Unlike other security tools that break the assistant's ability to work, AgentVisor kept the assistant working almost perfectly. They only saw a tiny drop (about 1.5%) in how well the assistant performed normal tasks.
Fast Enough: It adds a little bit of time to the process (like a security guard checking your ID), but it's not slow enough to be annoying.

The Bottom Line

AgentVisor is like putting a security guard between your AI assistant and the outside world. The assistant can still look at everything and be helpful, but the guard makes sure it never actually does anything dangerous or unauthorized. If the assistant slips up, the guard gives it a quick nudge to fix it, rather than firing it.

This approach allows us to use powerful AI agents safely, even when they are reading untrusted information from the internet or emails.

1. Problem Statement

Large Language Model (LLM) agents are increasingly used to automate complex workflows by interacting with external tools and data. However, integrating untrusted external data (e.g., webpages, emails) with privileged execution capabilities creates severe security vulnerabilities.

The core security risks are:

Direct Prompt Injection: Malicious users explicitly override system instructions to force unauthorized actions.
Indirect Prompt Injection: Hidden malicious commands are embedded in external content processed by the agent, hijacking its decision-making without the user's knowledge.

Limitations of Existing Defenses:

Prompt Hardening: Heuristic and easily overridden by adversarial instructions.
Input/Output Filtering: Prone to evasion, high false positives, and lack guarantees on how content affects tool-use decisions.
Tool Sandboxing: Often too coarse, failing to track information flow in multi-step workflows and lacking principled recovery paths once a violation occurs.
Trade-off: Current methods struggle to balance security (blocking attacks) with utility (allowing legitimate tasks), often resulting in "over-defense" (blocking everything) or "under-defense" (missing subtle attacks).

2. Methodology: AgentVisor

The authors propose AgentVisor, a defense framework inspired by Operating System (OS) Virtualization. It treats the target LLM agent as an untrusted "Guest" and mediates all tool calls through a trusted "Semantic Visor" (Hypervisor).

Core Architecture

AgentVisor enforces a Trap–Audit–Recover control loop:

Guest (Target Agent): Operates on the full task context (including potentially malicious external data) and proposes a tool call ( $T_{raw}$ ).
Visor (Semantic Hypervisor): A trusted component that audits the Guest's proposal. Crucially, the Visor is architecturally blind to raw external context. It only sees:
- Trusted system instructions ( $I_{sys}$ ).
- User query ( $I_u$ ).
- A sanitized execution history ( $\tilde{H}_{t-1}$ ) containing only structured fields (tool names, canonicalized args, status summaries), treated strictly as data, not executable code.
Decision: The Visor either allows the call or injects a Semantic Exception to trigger self-correction.

The STI Audit Protocol

The Visor enforces a rigorous three-step verification protocol:

Suitability (S): Checks if the proposed tool is permitted under the system policy and the agent's role. This acts as a coarse-grained gate against direct injection attempts to escalate privileges.
Taint (T): Verifies if the goal implied by the tool call aligns with the user's intent and legitimate intermediate goals. It blocks actions introducing new, unauthorized goals (e.g., data exfiltration when the user only asked for a summary).
Integrity (I): Ensures tool arguments are consistent with user-specified entities and constraints. This prevents subtle redirections (e.g., keeping the "send email" tool but changing the recipient to an attacker).

Semantic Exception Injection & Self-Correction

Instead of simply blocking a request (which causes task failure), AgentVisor uses Semantic Exception Injection.

If the STI protocol fails, the Visor generates a structured exception ( $E_t$ ) containing the violation type, rationale, constraints, and the allowed objective.
The Guest receives this exception and performs a one-shot self-correction to regenerate a safe tool call.
This approach transforms security violations into constructive feedback, preserving utility.

3. Key Contributions

AgentVisor Framework: A novel virtualization-based defense that enforces semantic privilege separation, treating the agent as an untrusted guest and the security layer as a trusted hypervisor.
STI Protocol: A structured semantic audit mechanism (Suitability, Taint, Integrity) that adapts classic OS security primitives (Privilege Separation, Policy Enforcement, Exception Handling) to the LLM domain.
One-Shot Self-Correction: A mechanism that converts audit failures into recoverable events, allowing agents to recover from attacks without terminating the workflow.
Empirical Validation: Extensive experiments demonstrating superior performance over existing baselines in both direct and indirect injection scenarios.

4. Experimental Results

The framework was evaluated on GPT-4o and GLM-4.7 backbones against 7 representative attack strategies across 4,900 direct injection cases and 629 indirect injection cases.

Attack Success Rate (ASR): AgentVisor reduced the ASR to 0.65% on average (0.00% for direct injection, <1.7% for indirect injection), significantly outperforming all baselines.
Utility Preservation:
- Benign Utility (BU): Maintained high task completion rates in non-attack scenarios.
- Utility under Attack (UA): Achieved 83.14% (Direct) and 73.21% (Indirect) utility under attack, compared to near-zero utility for strict detection-based methods (e.g., DataSentinel) or high failure rates for mitigation-only methods.
Overhead:
- Latency: Introduced a moderate overhead (~1.4x in benign conditions). Under attack, latency increased due to self-correction (up to 2.32x for direct injection), but this "pay-for-safety" trade-off was deemed justified to prevent critical breaches.
- Correction Rounds: Ablation studies showed that one-shot correction (N=1) is optimal; additional rounds yielded negligible utility gains (<1.3%) while disproportionately increasing latency.
Robustness:
- Model Agnostic: Effective across different LLM backbones (from lightweight to frontier models).
- Adaptive Attacks: Successfully neutralized recursive adaptive attacks (e.g., "Ignore Security Check") where naive defenses failed, maintaining 86.85% utility.

5. Significance

AgentVisor represents a paradigm shift in LLM agent security by moving from heuristic filtering to structural isolation.

Principled Security: It provides a formal security architecture based on OS principles (least privilege, information flow control) rather than ad-hoc prompt engineering.
Balanced Defense: It successfully resolves the security-utility trade-off, proving that rigorous protection does not require sacrificing agent functionality.
Scalability: The framework is lightweight enough to be deployed with cost-effective models (e.g., Gemini-2.5-Flash) while maintaining high security standards.

Limitations: The paper acknowledges computational overhead, potential scalability issues with extremely long context windows, and the current focus on textual rather than multimodal (visual/audio) injections.