AttriGuard: Defending against Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Calls

The researchers propose AttriGuard, a runtime defense based on parallel counterfactual testing for blocking indirect prompt injection in LLM agents. The method shifts defense from semantic discrimination at the input level to causal attribution at the action level: for each tool call to be executed, it re-executes the agent after attenuating the control of external observations, to determine whether the call is supported by user intent or driven by untrusted observations. Technically, it combines teacher-forced shadow replay to avoid attribution confounding, hierarchical control attenuation to suppress multiple control channels while preserving task-relevant information, and a fuzzy survival criterion robust to LLM randomness. On four LLMs and two agent benchmarks, AttriGuard achieves a 0% attack success rate under static attacks, with negligible utility loss and moderate overhead, and remains resilient under adaptive optimization attack settings where mainstream defenses degrade significantly.