Soft Instruction De-escalation Defense
Large Language Models (LLMs) are increasingly deployed in agentic systems
that interact with an external environment; this makes them susceptible to
prompt injections when dealing with untrusted data. To overcome this
limitation, we propose SIC (Soft Instruction Control)-a simple yet effective
iterative prompt sanitization loop designed for tool-augmented LLM agents. Our
method repeatedly inspects incoming data for instructions that could compromise
agent behavior. If such content is found, the malicious content is rewritten,
masked, or removed, and the result is re-evaluated. The process continues until
the input is clean or a maximum iteration limit is reached; if imperative
instruction-like content remains, the agent halts to ensure security. By
allowing multiple passes, our approach acknowledges that individual rewrites
may fail but enables the system to catch and correct missed injections in later
steps. Although immediately useful, worst-case analysis shows that SIC is not
infallible; strong adversary can still get a 15% ASR by embedding
non-imperative workflows. This nonetheless raises the bar.
68ff4d0ef3205b9e39c5f3e0
Nils Philipp Walter
68ff4d0ef3205b9e39c5f3e1
Chawin Sitawarin
68ff4d0ef3205b9e39c5f3e2
Jamie Hayes
68ff4d0ef3205b9e39c5f3e3
David Stutz
68ff4d0ef3205b9e39c5f3e4
Ilia Shumailov
claimed_verified
2025-10-27T14:16:35.925Z
6475c2794766357252e69e9f
/avatars/757ed789423113369868e972f21ce559.svg
i
iliashum
user
iliashum
Soft Instruction De-escalation Defense
Large Language Models (LLMs) are increasingly deployed in agentic systems
that interact with an external environment; this makes them susceptible to
prompt injections when dealing with untrusted data. To overcome this
limitation, we propose SIC (Soft Instruction Control)-a simple yet effective
iterative prompt sanitization loop designed for tool-augmented LLM agents. Our
method repeatedly inspects incoming data for instructions that could compromise
agent behavior. If such content is found, the malicious content is rewritten,
masked, or removed, and the result is re-evaluated. The process continues until
the input is clean or a maximum iteration limit is reached; if imperative
instruction-like content remains, the agent halts to ensure security. By
allowing multiple passes, our approach acknowledges that individual rewrites
may fail but enables the system to catch and correct missed injections in later
steps. Although immediately useful, worst-case analysis shows that SIC is not
infallible; strong adversary can still get a 15% ASR by embedding
non-imperative workflows. This nonetheless raises the bar.
SIC, an iterative prompt sanitization method, enhances the security of tool-augmented LLM agents by repeatedly inspecting and cleaning incoming data to prevent prompt injection attacks.
Large Language Models LLMs prompt injections iterative prompt sanitization tool-augmented LLM agents imperative instruction-like content worst-case analysis ASR