Technical Summary: WARD – Adversarially Robust Defense of Web Agents Against Prompt Injections

1. Problem Formulation

Web agents, which autonomously execute user goals through web interactions (clicking, typing, browsing), face significant security risks due to their exposure to open web environments. Adversaries can embed deceptive instructions within HTML content or visual interfaces (screenshots) to manipulate the agent's decision-making, leading to unsafe behaviors such as data leakage or unauthorized actions. These are known as prompt injection attacks.

Existing defense strategies, including system prompt modifications and fine-tuning vision-language models, often suffer from limited robustness. A more promising approach involves using a separate guard model to inspect webpage states before the agent acts. However, current guard models face four critical limitations hindering practical deployment:

1. Limited Generalization: They fail to generalize to unseen domains (e.g., high-risk platforms like email or social media) and struggle with shifts in injection modalities (text-only vs. visual-only vs. both).
2. High False Positives: They frequently misclassify benign content with instruction-like language (e.g., tutorials) as malicious, disrupting agent workflows.
3. Efficiency Limitations: Some defenses introduce latency by requiring sequential execution or rely on large, costly models.
4. Vulnerability to Adversarial Attacks: Existing guards are susceptible to Prompt Injection on Guard (PIG), where attackers target the guard's decision logic directly, and Adaptive Adversarial Attacks (AAA), where attackers iteratively adapt strategies to bypass the guard.

2. Methodology

The authors propose WARD (Web Agent Robust Defense against Prompt Injection), a practical guard framework designed to address these limitations through a three-stage training pipeline and a comprehensive data framework.

2.1 Data Framework

WARD relies on two primary datasets constructed to maximize diversity across domains, modalities, and attack vectors:

• WARD-Base: A large-scale dataset containing approximately 177,585 samples collected from 719 high-traffic URLs and 10 simulated high-risk platforms. It utilizes a two-branch pipeline:
  • Overlay Branch: Captures interface-level patterns by injecting attacks into real webpages (HTML modification or screenshot overlays) across 7 channels (e.g., popups, banners).
  • Native Branch: Simulates high-risk platforms (social media, messaging, email) to embed attacks naturally within user-generated content (comments, posts, messages).
  • The dataset covers 6 attack goals (e.g., data exfiltration, unauthorized actions) and 4 injection locations (HTML, Screenshot, Both, None).
• WARD-PIG: A specialized dataset derived from WARD-Base, containing 10,500 malicious samples where prompts explicitly target the guard's decision process (e.g., instructing the guard to ignore suspicious content), alongside 10,500 benign samples.

2.2 Training Pipeline

WARD is trained in three sequential stages:

1. Supervised Fine-Tuning (SFT) on WARD-Base: The model learns to detect prompt injections across diverse domains, modalities, and attack goals. It is trained to output a label (malicious/benign), injection location, attack goal, and a reasoning trace grounded in the HTML and screenshot.
2. SFT on WARD-PIG: The model is further fine-tuned to recognize and resist guard-targeted instructions, learning to treat such inputs as adversarial signals rather than valid commands.
3. Adaptive Adversarial Attack Training (A3T): An iterative co-evolution framework involving an adaptive attacker, a validator, and the guard.
   • Inner Loop: An attacker (using memory of past successes/failures and guard feedback) generates new candidate attacks designed to bypass the current guard. A validator filters for realistic and effective malicious samples.
   • Outer Loop: Successful adversarial samples that bypass the guard are used to update the guard via Group Relative Policy Optimization (GRPO).
   • This loop repeats, progressively strengthening the guard against increasingly sophisticated adaptive attacks.

2.3 Model Architecture

The framework utilizes compact, open-source Vision-Language Models (specifically Qwen-3.5-0.8B and Qwen-3.5-2B) as backbones, enabling efficient parallel deployment alongside the web agent without introducing significant latency.

3. Key Contributions

• WARD-Base and WARD-PIG Datasets: The creation of the first large-scale, multimodal dataset for prompt injection detection that explicitly models injection channels, locations, and guard-targeted attacks, covering both real-world webpages and simulated high-risk platforms.
• A3T Framework: The introduction of an adaptive adversarial training scheme that iteratively evolves attack strategies and guard defenses, addressing the vulnerability of static training distributions to adaptive attackers.
• Practical Guard Model: A defense system that achieves near-perfect detection while maintaining low false positive rates and operating efficiently in parallel with the agent.

4. Experimental Results

Extensive evaluations demonstrate WARD's superiority over 25 baselines, including closed-source APIs, open-source models, and existing guard models (e.g., WebAgentGuard, PromptGuard).

• Detection Performance: On out-of-distribution (OOD) benchmarks (Popup, EIA, VPI, WASP), WARD achieves near-perfect recall (100%) and high accuracy (99.33% on WARD-Test), significantly outperforming baselines which often struggle with generalization.
• Robustness against PIG: When tested against guard-targeted prompts, WARD maintains 100% recall across all modalities (HTML, Screenshot, Both), whereas existing models suffer drastic performance drops (e.g., recall dropping to <1% for some baselines).
• Robustness against Adaptive Attacks: Under the A3T stress test with up to 10 attack attempts per sample, WARD maintains low Sample Success Rates (SSR) and Attempt Success Rates (ASR). For instance, WARD-2B achieves an SSR of only 3.12% at a trial budget of 10, compared to much higher rates for baselines.
• Cross-Domain Robustness: In the PIArena framework (a text-based, non-web adaptive attack setting), WARD maintains a low Average Attack Success Rate (ASR) of ~3.08%, while other defenses fail with ASRs exceeding 45–90%.
• Utility Preservation: WARD exhibits negligible false positive rates (FPR < 0.5%) and minimal performance degradation (PD) on WebArena tasks, preserving agent utility better than existing guards which often introduce high FPRs (>7%).
• Efficiency: WARD runs in parallel with the agent, requiring fewer output tokens and lower inference time than the agent models themselves, avoiding additional latency.

5. Significance and Claims

The paper claims that WARD provides a strong and practical foundation for securing real-world web-agent systems. By combining large-scale, diverse data with a co-evolutionary training strategy, WARD addresses the fundamental trade-offs between detection accuracy, robustness against adaptive adversaries, and deployment efficiency.

The authors emphasize that WARD is designed for realistic prompt injection attacks that appear as natural webpage content. They modestly acknowledge limitations, noting that WARD may not be effective against pixel-level environmental attacks (e.g., imperceptible perturbations) which require stronger threat models and access to the agent's internal gradients. The work positions itself as a critical step toward deploying autonomous web agents in sensitive domains like finance and healthcare, where reliable defense against instruction manipulation is paramount.