What they found
The authors compared defences that live inside the prompt (hardened prompts, spotlighting, SI detectors) with rules enforced outside the model, human approval and taint tracking (tracking which data came from untrusted sources). They tested on 13 tasks and 12 tools, with one outcome-based judge independent of every defence. With real open-weights models, Qwen2.5-1.5B and Qwen2.5-7B, the models proposed the attacker's call in 64% and 84% of attack episodes behind the task-bound monitor. That monitor let through 1.3% and 7.7%. Guardrail effects varied by model: a prompt guardrail moved obedience from 67% to 65% and from 86% to 55%. In simulation with an assumed model, a persistent adaptive attacker or a compromised model pushed every guardrail stack to 100.0% attack success, while the task-bound monitor held severe actions at 0.0%. Taint-triggered human review cut its residual harm by 62%. Build quality mattered: a naive monitor admitted 18 of 33 effective attack variants, a hardened one 6 and a capability-bound one 1.
Why it matters
Prompt injection means an SI agent follows instructions hidden in the data it reads. The authors argue this is a structural problem, so wording a prompt more carefully is not enough. The results point to treating the model as an untrusted part and putting checks outside it. They also show that how well such a monitor is built changes the outcome a lot.
How it changes the race
If the results hold, teams building agents could get safer tool use from fixed outside rules without needing a more robust model. This is a security design point, not a capability gain.
Safety and control
The paper bears directly on security and human control of agents. The authors say the real-model evidence covers only two open-weights models and static attacks. The human approval and taint results are simulation-only. The larger model's detector stack contradicts the assumed erosion law. A human layer without a deterministic monitor failed against approval spamming unless each episode had a deterministic approval budget.
The abstract, by the authors
Tool-using LLM agents act on instructions embedded in the data they read, so prompt injection is a structural rather than a prompt-wording problem. We compare in-prompt defences (hardened prompts, spotlighting, LLM detectors) with deterministic enforcement outside the model (four reference monitors of increasing strength), human approval and taint tracking, judged by one effect-based oracle independent of every defence in an executable environment of 13 tasks and 12 tools, with argument-fuzzing attackers and severity-weighted harm. In an evaluation with real open-weights models (Qwen2.5-1.5B and Qwen2.5-7B; 156 attack episodes per defence and model), the models proposed the attacker's call in 64% and 84% of attack episodes behind the task-bound monitor, which admitted 1.3% and 7.7%; guardrail effects depended on the model (a prompt guardrail moved obedience from 67% to 65% and from 86% to 55%, spotlighting plus a detector to 12% and 0%) against static attacks. Simulation with an assumed model covers what no real run did: under the assumed erosion law a persistent adaptive attacker or a compromised model drives every guardrail stack to 100.0% attack success, whereas the task-bound monitor holds severe actions at 0.0%; its residual (harm 0.69/10) falls by 62% under taint-triggered human review, and a human layer without a deterministic monitor fails against approval spamming unless each episode has a deterministic approval budget. Implementation quality matters: a naive monitor admits 18 of 33 effective attack variants, a hardened one 6 and a capability-bound one 1. The real-model evidence is limited to two open-weights models and static attacks, the human-approval and taint results are simulation-only, and the larger model's detector stack contradicts the assumed erosion law. Code, data, a two-rater oracle audit and a notebook for repeating the real-model evaluation are provided.
Quoted from arXiv:2611.11571. The research and its words belong to its authors.