SPILLWAY defends tool-using agents from prompt injection
Original title: SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection
SPILLWAY separates target admission from sanitization using tool output fields and fixed rules, achieving zero successful injections across backbones and task suites.
Tool-using agents process emails, files, and payments, making them vulnerable to hidden instructions in web pages or documents. SPILLWAY turns tool return values into a deterministic floor for admission: it admits calls when target values in typed fields match read-only tools or fixed delegation rules. A deterministic sanitizer removes instruction-like regions before model reading and retains them as evidence. A local judge may restore refused calls only if the target is not in removed text. Across three backbones and seven task suites, no templated injection redirects actions under SPILLWAY, with forged chat templates also producing zero success and mean in-scope attack success of 0.007.
- No standard injection redirects actions to attacker targets
- Zero success on forged chat templates
- Mean in-scope attack success 0.007 under RL attacker
- No per-task model re-runs or added calls
- Holds across multiple backbones and task suites
From the original article
1 min read at arxiv.orgTool-using agents act on email, files, and payments, so an instruction hidden in a web page or a shared document can make an agent send data or money to an attacker. Many runtime defenses put a language model on the decision that lets an action through, so the decision depends on a model that may read the attacker's text and adds model calls to every step.
By Woosang Lim · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.