SIEVE: Selective Integrity Verification and Escalation for Defending LLM Agents against Indirect Prompt Injection

arXiv:2512.06716v3 Announce Type: replace Abstract: Large Language Models (LLMs) are increasingly used as the core of agentic systems due to their strong reasoning, planning, and tool-use capabilities. By interacting with external environments, LLM agents can execute real-world tasks on behalf of users rather than merely generate text. This expanded capability also amplifies the threat of indirect prompt injection (IPI), where malicious external content can manipulate agent behavior and trigger unauthorized actions, privacy leakage, or financial loss. Existing defenses generally follow two approaches. Plan- or rule-based methods constrain agent execution using predefined plans or execution rules, but may block legitimate actions that arise from dynamic runtime context. Semantic auditing methods offer greater flexibility, yet repeatedly re-evaluating proposed actions incurs substantial token and latency overhead. These limitations motivate a selective verification strategy that applies deterministic checks whenever reliable structural evidence is available and escalates only ambiguous cases. Accordingly, we propose SIEVE, which verifies tool transitions and argument sources against an Intent Graph, escalating actions that cannot pass deterministic verification to semantic adjudication. This selective design preserves flexibility while avoiding continuous semantic auditing. We evaluate SIEVE on AgentLure and AgentDojo against MELON, DRIFT, IPIGuard, and ARGUS. SIEVE achieves 5.94% ASR with 97.5% clean utility on AgentLure, and 0.34% ASR with 87.63% clean utility on AgentDojo. Compared with DRIFT and ARGUS, SIEVE incurs the lowest token consumption and the fewest API calls.

Abstract:Large Language Models (LLMs) are increasingly used as the core of agentic systems due to their strong reasoning, planning, and tool-use capabilities. By interacting with external environments, LLM agents can execute real-world tasks on behalf of users rather than merely generate text. This expanded capability also amplifies the threat of indirect prompt injection (IPI), where malicious external content can manipulate agent behavior and trigger unauthorized actions, privacy leakage, or financial loss. Existing defenses generally follow two approaches. Plan- or rule-based methods constrain agent execution using predefined plans or execution rules, but may block legitimate actions that arise from dynamic runtime context. Semantic auditing methods offer greater flexibility, yet repeatedly re-evaluating proposed actions incurs substantial token and latency overhead. These limitations motivate a selective verification strategy that applies deterministic checks whenever reliable structural evidence is available and escalates only ambiguous cases. Accordingly, we propose SIEVE, which verifies tool transitions and argument sources against an Intent Graph, escalating actions that cannot pass deterministic verification to semantic adjudication. This selective design preserves flexibility while avoiding continuous semantic auditing. We evaluate SIEVE on AgentLure and AgentDojo against MELON, DRIFT, IPIGuard, and ARGUS. SIEVE achieves 5.94% ASR with 97.5% clean utility on AgentLure, and 0.34% ASR with 87.63% clean utility on AgentDojo. Compared with DRIFT and ARGUS, SIEVE incurs the lowest token consumption and the fewest API calls.

Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Cryptography and Security (cs.CR)

arXiv:2512.06716 [cs.AI]

(or arXiv:2512.06716v3 [cs.AI] for this version)

https://doi.org/10.48550/arXiv.2512.06716 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

aiqbench analysis

SIEVE: Selective Integrity Verification and Escalation for Defending LLM Agents against Indirect Prompt Injection

Related coverage