DISARM: Taint-gated counterfactual auditing for efficient defense against indirect prompt injection

Summary

DISARM is a training-free defense against indirect prompt injection in LLM agents, mediating actions at the tool boundary between internal planning and external tool execution. On AgentDojo with GPT-4o, it reduces the four-attack average attack success rate from 23.01% to 0.37% and raises utility under attack from 63.69% to 73.63%, at 4.29s benign latency. The authors note that semantic parameter pollution still retains 1.11% ASR, exposing limits of cue-based gating.

Topics

• Prompt injection and jailbreaks

Related items

• InfoOpenAI built an AI pipeline to find, exploit and patch Linux flawsSame vendor · CSO Online
• InfoAI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI ResearchSame vendor · SecurityWeek
• InfoOpenAI’s GPT-6 Cyber ups the ante on vulnerability discoverySame vendor · CSO Online
• InfoOpenAI says its new cybersecurity model is better at not hacking other companiesSame vendor · The Verge (AI)
• MediumChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationSame vendor · Check Point Research