ResearchPod Summary
How can LLM agents defend against indirect prompt injection attacks that are technically aligned with the user's stated goal but violate the user's implicit, private security boundaries? Current defenses often fail here because they treat tasks as isolated events, lacking the memory required to learn what a specific user considers acceptable behavior.
Inspired by the adaptive immune system, the authors propose AgentAntibody. Instead of relying on static rules, the system maintains a persistent, evolving library of 'antibodies.' Each antibody represents a learned security boundary, capturing transferable attack structures (epitopes) rather than literal attack strings.
When an agent encounters a task, the system:
AgentAntibody significantly outperforms existing task-local defenses. In experiments across four backbone LLMs and three benchmarks, the system demonstrated strong performance even when starting with an empty library. By the 80th encounter, the cumulative attack success rate dropped to 6.1%. The system effectively balances security and utility, as it learns to distinguish between benign and malicious requests that appear identical at the task level, such as distinguishing between a legitimate payment and an unauthorized one to a new payee.
As LLM agents become more autonomous, they are increasingly vulnerable to 'goal-compatible' attacks—where an attacker uses the agent's own tools to perform actions that are technically correct but contextually unsafe. AgentAntibody provides a scalable way to personalize agent security, allowing systems to adapt to individual user preferences without requiring constant retraining or rigid, one-size-fits-all safety policies.
AI-generated third-party summary by ResearchPod. Not official content or an endorsement by the paper authors or affiliated organizations.