CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks. In this attack scenario, malicious commands hidden within untrusted content trick the agent into performing unauthorized actions. Existing defenses can reduce attack success but often suffer from the over-defense dilemma: they deploy expensive, always-on sanitization regardless of actual threat, thereby degrading utility and latency even in benign scenarios. We revisit IPI through a causal ablation perspective: a successful injection manifests as a dominance shift where the user request no longer provides decisive support for the agent's privileged action, while a particular untrusted segment, such as a retrieved document or tool output, provides disproportionate attributable influence. Based on this signature, we propose CausalArmor, a selective defense framework that (i) computes lightweight, leave-one-out ablation-based attributions at privileged decision points, and (ii) triggers targeted sanitization only when an untrusted segment dominates the user intent. Additionally, CausalArmor employs retroactive Chain-of-Thought masking to prevent the agent from acting on ``poisoned'' reasoning traces. We present a theoretical analysis showing that sanitization based on attribution margins conditionally yields an exponentially small upper bound on the probability of selecting malicious actions. Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses while improving explainability and preserving utility and latency of AI agents.
698bf1b26052d3bed9630a3b
Minbeom Kim
claimed_verified
2026-02-11T11:14:53.664Z
6440a11d757aa3c2ad87c8db
/avatars/7f4cafddc76e3720ed161dc7b5d0bb65.svg
minbeomkim
mbkim
user
mbkim
698bf1b26052d3bed9630a3c
Mihir Parmar
698bf1b26052d3bed9630a3d
Phillip Wallis
698bf1b26052d3bed9630a3e
Lesly Miculicich
698bf1b26052d3bed9630a3f
Kyomin Jung
698bf1b26052d3bed9630a40
Krishnamurthy Dj Dvijotham
698bf1b26052d3bed9630a41
Long T. Le
698bf1b26052d3bed9630a42
Tomas Pfister
CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks. In this attack scenario, malicious commands hidden within untrusted content trick the agent into performing unauthorized actions. Existing defenses can reduce attack success but often suffer from the over-defense dilemma: they deploy expensive, always-on sanitization regardless of actual threat, thereby degrading utility and latency even in benign scenarios. We revisit IPI through a causal ablation perspective: a successful injection manifests as a dominance shift where the user request no longer provides decisive support for the agent's privileged action, while a particular untrusted segment, such as a retrieved document or tool output, provides disproportionate attributable influence. Based on this signature, we propose CausalArmor, a selective defense framework that (i) computes lightweight, leave-one-out ablation-based attributions at privileged decision points, and (ii) triggers targeted sanitization only when an untrusted segment dominates the user intent. Additionally, CausalArmor employs retroactive Chain-of-Thought masking to prevent the agent from acting on ``poisoned'' reasoning traces. We present a theoretical analysis showing that sanitization based on attribution margins conditionally yields an exponentially small upper bound on the probability of selecting malicious actions. Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses while improving explainability and preserving utility and latency of AI agents.
CausalArmor is a selective defense framework for AI agents that uses causal ablation to detect and mitigate Indirect Prompt Injection attacks by identifying dominant untrusted segments and applying targeted sanitization.
Indirect Prompt Injection causal ablation leave-one-out ablation attribution selective defense tool-calling capabilities privileged decision points retroactive Chain-of-Thought masking attribution margins