UC Berkeley proposes PromptArmor: a modular, easy-to-deploy, efficient prompt injection defense driven by an off-the-shelf LLM

UC Berkeley proposes PromptArmor, a prompt injection defense that uses an off-the-shelf LLM as a front-end guardrail to detect and remove injected content from agent inputs, without retraining or changing the agent architecture. On the AgentDojo benchmark (4 agent categories—banking, Slack, travel, workspace—and 629 adversarial scenarios), the paper reports: with GPT-4.1 as the guardrail, attack success rate drops to 0% and utility under attack is 72.02%; with o4-mini as the guardrail, attack success rate is 0.08% and utility is 76.35%, the highest among all methods. Among compared methods, the detection-based Deberta has a false positive rate of 28.41%, the prompt-enhancement Repeat Prompt still has an attack success rate of 29.89%, and the system-level Tool Filter has utility of only 18.80%. The authors state that against fuzzing-style adaptive attacks, the attack success rate remains below 0.5%, and recommend preferring medium-to-large LLMs as guardrails, while for older models such as GPT-3.5, terminology definitions need to be added to the prompt.