AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnosis and Context Sanitization

The researchers propose an inference-time defense method, AgentSentry, to mitigate indirect prompt injection in LLM agents. The method performs local counterfactual re-execution at tool return boundaries to determine whether the action to be executed is affected by injected content; if affected, it sanitizes the relevant context and continues execution from the sanitized state. When evaluated on four task categories in AgentDojo, three types of indirect prompt injection attacks, and three black-box LLM backbone models, no successful attacks were observed in the evaluated cases (ASR=0%), with an average attacked utility of 76.10%; this is an improvement of 1.84 to 7.60 percentage points over the strongest baseline, and the false positive rate on benign samples is 2.06% to 5.15%. The paper also evaluates long-horizon and adaptive attacks, imperfect sanitization, runtime overhead, and the OpenClaw case.