AgentWatcher: A rule-based prompt injection monitor

The researchers propose AgentWatcher, a rule-based prompt injection monitoring method for detecting prompt injection attacks against large language models and their agent applications. To address two limitations of existing detection methods—their effectiveness drops markedly when the context grows longer, and the lack of explicit rules makes judgments implicit and hard to explain—AgentWatcher first attributes LLM outputs (such as agent actions) to a small number of causally influential context segments, performing detection only on shorter text to scale to long contexts, and then has a monitoring LLM reason according to a set of explicit rules defining what constitutes prompt injection, making judgments more interpretable. Experiments on tool-use agent benchmarks and long-context understanding datasets show that the method can effectively detect prompt injection and maintain utility when there is no attack. Code is open-sourced at https://github.com/wang-yanting/AgentWatcher。