SEAL cuts AgentDojo prompt-injection success from 34.6% to 0.1%
Original title: SEAL: Sealed Queries for Local Sanitization against Indirect Prompt Injection
Joint task completion without attack success rises from 51.4% to 77.5%, using about 127 times fewer defense tokens than PISanitizer.
SEAL learns an offline soft prompt and scoring readout to sanitize untrusted tool outputs with a frozen task model. Scoring queries use trusted initial context, so the reference stays independent of inspected tool text, and no separate verifier or defense-generated tokens are required. On AgentDojo and AgentDyn it suppresses indirect prompt injection while improving task completion under attack. The same training recipe was replicated on a second, unnamed backbone.
Unconfirmed: The second backbone used for replication is not named.
- Preservation regularization encourages keeping useful evidence during localized deletion.
- SEAL uses approximately 127 times fewer defense-related tokens than PISanitizer.
- Scores are computed without normalization across context tokens.
- Replication used the same training recipe on a second model family.
- Products
- SEALPISanitizerAgentDojoAgentDyn
From the original article
1 min read at arxiv.orgIndirect prompt injection threatens local LLM agents through untrusted tool outputs, motivating defenses that suppress attacks while preserving task evidence under limited inference budgets. We introduce SEAL, which learns a soft prompt and scoring readout offline to sanitize tool outputs using a frozen task model.
By Doohyun Kim · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.