Reproduce “SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Woosang Lim, Yeseul Chang, Jaewoo Lee
SPILLWAY protects tool-using agents from indirect prompt injections by checking action targets against typed tool returns and the user’s task, while sanitizing matched instructions before the agent reads them. A judge can reconsider refusals. On AgentDojo attacks, it records zero in-scope attack success across 12 cells and mean under-attack utility of .484; this covers identity targets within its threat model.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.