PlanTERS formalizes relative security of prompt injection in agents
Original title: On the Relative Security of Prompt Injection: Mechanised Definitions, Defences and Verdicts for LLM Agents
Revoking injectable tools at the first untrusted read is proved relatively secure on finite runs.
The paper argues noninterference is too strong for LLM agents that must let untrusted email or web content influence actions. PlanTERS defines relative security against a reference agent that never obeys untrusted content, using a small agent language, runtime monitors, and differing attacker observation models. A fence theorem says revoking injectable tools at the first untrusted read, without restoring them, makes every plan relatively secure on finite runs under stated assumptions. The authors prove or refute the property for fences, budgets, approvals, loops, and dual LLMs in Isabelle/HOL.
Unconfirmed: The security results hold only under the paper's stated model and attacker assumptions.
- Security is judged against a reference agent that ignores injections.
- A fairness condition extends the fence theorem to infinite runs.
- Assumptions include one call per injection and a fixed schedule.
- Relative security is proved or refuted in Isabelle/HOL.
From the original article
1 min read at arxiv.orgAn LLM agent that reads untrusted content, such as an email or a web page, may follow instructions hidden in it. Noninterference is too strong for such agents, since a useful agent lets untrusted content influence what it does and may disclose the user's data by design, and declassification needs a release policy written for each task.
By Brijesh Dongol · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.