Mitigating Indirect Prompt Injection via Instruction-following Intent Analysis

The researchers propose IntentGuard, a defense framework that mitigates indirect prompt injection against LLM agents by analyzing whether the model intends to execute instructions from untrusted data. Its Instruction-following Intent Analyzer (IIA) first identifies which parts of the input prompt the model treats as executable instructions, then flags or neutralizes the overlap between these instructions and untrusted data segments. To implement this analyzer, the paper designs three thought intervention strategies—thought-start prefilling, thought-end refinement, and adversarial in-context examples—to make reasoning-capable LLMs produce a structured list of intent instructions. Evaluated on the two agent benchmarks AgentDojo and Mind2Web with Qwen-3-32B and gpt-oss-20B, it shows no utility degradation except in one setting, and maintains strong robustness against adaptive prompt injection attacks, for example reducing the attack success rate from 100% to 8.5% in a certain Mind2Web scenario.