CapLite: Prompt injection defense for small language model agents that requires no model-written security artifacts

1. 01What problem does this paper attempt to solve?

   SLM agents are bad at writing their own security artifacts, so the authors propose CapLite, which does not rely on the model to write artifacts.

   Core question: Can small language model (SLM) agents be trusted to write their own security artifacts? If not, what can still be guaranteed?

   • Problem setting: Tool-using agents read emails, files and web pages that anyone can write to, and instructions hidden in them can hijack the agent's behavior (indirect prompt injection). The authors state that the strongest defenses guarantee by handing decisions to code execution.
   • Shortcomings of existing methods: The authors point out that enforcement defenses such as CaMeL, Progent, IPIGuard and DRIFT all have the agent's own model write the security artifacts (programs, permission policies, dependency graphs, constraint lists), and the correctness of enforcement depends on artifact quality; these defenses were mainly designed and evaluated with large hosted models.
   • Core observation: The authors' measurements find that artifacts deciding "what is allowed" fail open (Progent is broken on 14/15 models), artifacts deciding "what runs" fail closed (CaMeL programs fail to run in up to 68% of episodes), and failure rates show no trend with model capability.
   • Proposed in the paper: CapLite—the policy is derived from the tool schema by fixed rules, write calls are committed before reading any tool result, and a call is allowed only if every authority parameter equals a value explicitly stated in the user request, which the authors call write integrity.
   • Threat model:
     • Goal: the attacker makes the agent perform write operations that serve the attacker's goals.
     • Knowledge/capability: the attacker controls arbitrary text in data returned by read tools (emails, files, web pages, comments, transaction subjects).
     • Trusted parties: the user, the request q that initiates the episode, the tools and their documentation.
     • Victim system: a tool-using SLM agent; the guarantee holds for any instructions the model follows, and adaptive attacks do not affect this guarantee.

   Collapse this answer

2. 02What related research exists?

   Related work falls into four categories: injection evaluation, in-model defenses, system-level enforcement, and request-grounding authorization.

   Prompt injection and its evaluation

   • Greshake et al. (2023) demonstrated indirect prompt injection on deployed LLM applications; BIPIA (Yi et al., 2025) and AgentDojo (Debenedetti et al., 2024) measure injection risk for LLM applications and agents, respectively.
   • Narisetty et al. (2026) argue that defenses outside the model have not been tested against adaptive attacks, apply an adaptive attack protocol to Progent, and argue that model-written policies make verifiability difficult.

   In-model or in-context defenses

   • Spotlighting (Hines et al., 2024) marks untrusted text; StruQ, SecAlign and Meta-SecAlign (Chen et al., 2025a/b/c) train models to ignore instructions in data.
   • MELON, AgentSentry, AttriGuard and others re-execute the task with masked user prompts or counterfactual observations to flag calls that depend on injected content; tool result parsing (Yu et al., 2026) filters what reaches the model, and ARGUS (Weng et al., 2026) has a sub-agent trace state-changing calls back to benign evidence before allowing them.

   System-level enforcement (the class this paper's baselines belong to)

   • The dual-LLM pattern (Willison, 2023) and the plan-then-execute pattern (Beurer-Kellner et al., 2025) fix control flow before reading untrusted data; the paper points out that in the naive pattern injections can still choose the parameters of already-planned calls, and CapLite closes this gap with exact request grounding.
   • CaMeL (Debenedetti et al., 2025) and FIDES track provenance with capabilities or information-flow labels, Progent and Conseca generate policies, IPIGuard and DRIFT plan graphs and constraints, and Task Shield, MiniScope and ClawGuard check goal alignment or restrict permissions at the tool boundary.

   Request-grounding parameter authorization (concurrent work)

   • PACT (Fan et al., 2026) assigns semantic roles to parameters and tracks provenance; ROPE (Ma et al., 2026b) deterministically checks the provenance of sensitive parameters; ToolFence, TraceGrant, IntentCap and MetaPermit enforce model-derived authorization plans, contracts or capability leases; SARA and CXI check parameters against protected fields declared by the user's goal or policy.

   Baselines and benchmark: the baselines are CaMeL, Progent, IPIGuard, DRIFT and the four built-in AgentDojo defenses (tool filter, spotlighting, repeat prompt, PI detector), and the benchmark is AgentDojo v1.2.2.

   Authors' positioning: CapLite's policy is derived from the tool schema by fixed rules, with no model compilation, labeling or extended authorization—the authors state that ToolFence, TraceGrant and IntentCap compile authorization with a model, PACT uses a model to handle ambiguous roles and provenance, and ROPE's sensitive-field list is written offline by a model; like TraceGrant, CapLite fixes write operations before reading, and the replanning ablation shows this is necessary.

   Collapse this answer

3. 03How does the paper address this problem?

   CapLite lets the model propose and code authorize: the policy comes from the schema, write operations are committed first, and parameters must fall within the request grounding set.

   Overall approach: CapLite does not let the model decide what is authorized—authorization comes from two things computed in code: the policy derived from the tool schema and the set of values explicitly stated in the request, G(q); the model only proposes plans, selects values among candidates, and writes text, and the Mediator enforces checks with deterministic code. All model calls share the same SLM.

   Schema-derived policy

   • The policy comes from information exposed by the tool registry: tool name, docstring and JSON parameter schema.
   • A tool is read-only when both the tool name and the first verb of the docstring are read verbs (get, search, list, etc.); it is a write tool when either is an effect verb (send, create, pay, etc.); the rest are unclassified, and the Mediator rejects unclassified tools.
   • Parameters of write tools are authority fields by default, unless the schema marks them as free text (payload), date-time (temporal), or enum/boolean (control); destinations such as URLs count as authority even in read-only tools.
   • Appendix A gives the verb and token lists and the classification of all 74 tools; compared with a blind-label audit, all 74 tool classifications agree, 57 of 79 write-tool parameters agree, and no parameter labeled authority was derived as payload (Table 4).

   Adaptive reads, committed writes

   • Planner: a single schema-constrained call that sees only the request q and the tool documentation, and returns at most 10 tool calls whose parameters are either copied from the request or left as placeholders; its write calls are committed, and later components cannot add, remove or reorder them.
   • Reader: a loop of at most 10 steps of read-only tool calls that sees the request and the committed write calls and can adjust queries based on what it reads; its calls also go through the Mediator, and reads whose destination is not in the request are rejected.
   • Binder and Composer: for each placeholder, typed candidate values are extracted from observations, and authority or control fields keep only values in G(q); the Binder selects one candidate identifier or answers none/ask under constrained decoding and never writes values itself; the Composer writes payload text based on the request and observations.

   Mediator and guarantees

   • Before each committed write operation executes, deterministic code checks: the tool is classified, no placeholders remain, parameters conform to the schema, and every authority parameter exactly equals a member of G(q) (substrings do not count). The first rejection, a confirmation request, or a tool error stops the remaining write operations.
   • When an authority value appears only in tool results, CapLite asks the user to confirm; in the evaluation no such request was answered, and that episode counts as a failure.
   • The authors state two properties hold by construction: (1) the executed write calls are an in-order prefix of the write calls the Planner committed before any read; (2) every executed write operation's authority parameters belong to G(q) or were confirmed by the user. Injected text therefore cannot add write operations, cannot change the write tool, and cannot change recipients, accounts, amounts, channels, objects or destinations to values the user did not state.
   • Free-text parameters (such as message bodies) are written by the Composer and are unconstrained; trajectory auditing re-derives the policy and G(q) outside the running agent and checks every executed call, and found no violations in 25,452 CapLite episodes.

   Success determination and evaluation method

   • The benchmark is four suites of AgentDojo v1.2.2 (Workspace, Slack, Banking, Travel), with 97 user tasks and 949 user-task×injection-task pairs.
   • ASR is computed on the 929 pairs whose injection goal requires a tool call (tool-goal); the remaining 20 pairs are Travel goals that only require a sentence in the final answer, involve no write operations, and CapLite does not defend against such goals.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On 15 open-source models, CapLite has zero successful attacks, UA 29.0% comparable to CaMeL, at 18% of its tokens.

   Experimental setup

   • Models tested: 15 open-weight models—13 small models from 1.7B–12B (Qwen3-1.7B/-4B/-4B-Instruct-2507/-8B, Qwen3.5-4B/-9B, Llama-3.1-8B-Instruct, Gemma-4-E2B/-E4B/-12B, Granite-4.2-8B, Ministral-3-8B, LFM2.5-2.6B) and two larger references (Qwen3-32B, the MoE model Qwen3.6-35B-A3B).
   • Serving configuration: vLLM 0.30.0, native tool calling, temperature 0, seed 0, thinking disabled, at most 2,048 output tokens per call (8,192 for DRIFT); each configuration is run once.
   • Benchmark: four AgentDojo v1.2.2 suites, 97 user tasks, 949 attack pairs; ASR is computed on the 929 tool-goal pairs.
   • Baselines: CaMeL, Progent, IPIGuard and DRIFT are all ported using the authors' code, changing only the model interface; the same SLM is used for all model roles of each defense; the four built-in AgentDojo defenses are run on 8 models (Appendix B).
   • Attacks: the main attack is AgentDojo's important_instructions; on 8 robustness models, tool_knowledge and two attacks designed against CapLite (read exfiltration, descriptor collision) are added.
   • Metrics: BU (success rate on 97 non-injected tasks), UA (success rate on 949 attack pairs), ASR (k/929), tokens per episode, UA/kTok.

   Main results

   According to Table 1 (important_instructions, average over 15 models; ASR is aggregated over 15×929 episodes):

   Swipe horizontally to read the table

   Defense	BU ↑	UA ↑	ASR (%) ↓	k ↓	Zero-ASR	Tokens ↓	UA/kTok ↑
   Undefended	59.4	50.2	16.66	2,322	0/15	28.0k	1.79
   Progent	43.8	40.6	4.85	676	1/15	63.4k	0.64
   IPIGuard	40.1	35.7	3.12	435	2/15	60.5k	0.59
   DRIFT	35.7	34.9	1.54	214	4/15‡	28.1k	1.24
   CaMeL	24.9	27.2	0.14	20	12/15‡	93.7k	0.29
   CapLite	28.1	29.0	0.00	0	15/15	17.1k	1.69

   ‡: includes models whose benign and attacked utility are both below 10% (4 for DRIFT, 1 for CaMeL), whose zero ASR comes from not acting.

   • The authors state that CapLite is the only defense with no successful attacks, and that it opens the ASR–UA Pareto frontier (Figure 1).
   • The authors point out that DRIFT's 4 zero-ASR models (LFM2.5-2.6B, Gemma-4-E2B/-E4B, Granite-4.2-8B) have attacked-task completion rates of only 4.7%–9.5%, and the zero comes from not acting.
   • The authors state that the failure rate of model-written artifacts shows no trend with model capability (|ρ| ≤ 0.33, p > 0.2), whereas undefended agents more easily follow injections as models get stronger; Progent's and IPIGuard's ASR rises monotonically with scale within the Qwen3 and Gemma-4 families (Figure 3).

   Robustness and targeted attacks

   • What was tested: tool_knowledge, read exfiltration and descriptor collision added on 8 robustness models (Table 2).
   • Results: CapLite has 0 successes under all three attacks (0/7,432, 0/168, 0/104); under tool_knowledge, undefended is 1,304/7,432, Progent 410, IPIGuard 358, CaMeL 1; under read exfiltration, undefended is 85/168, CaMeL 0/168; under descriptor collision, undefended is 49/104, CaMeL 2/104.
   • Authors' interpretation: URL attacks fail because the Mediator checks the destination of every read; descriptor attacks fail because identifiers are accepted only when explicitly stated in the request.

   Utility comparison and failure attribution

   • What was tested: per-model comparison of CapLite and CaMeL UA (Figure 5), and attribution of CapLite's 1,046 benign failures (Table 9).
   • Results: CapLite's UA is 21.3 percentage points higher on Granite-4.2-8B and 6.8 higher on LFM2.5-2.6B; CaMeL is 12.2 and 13.5 percentage points higher on Gemma-4-E4B and -12B respectively. CapLite's UA is 21 percentage points lower than undefended (29.0% vs. 50.2%).
   • Authors' interpretation: among benign failures, 42.8% are committed write calls that are wrong or missing, 38.4% are cases where the writes all executed or the read-only task was answered but the task still failed, and 8.0% are confirmation requests triggered because an authority value appears only in tool results; plans without code cannot loop or branch on observed data.

   Other ablations and analyses

   • − Mediator (Table 3, average over 8 models): 106/7,432 attacks succeed (ASR 1.4%), and all 8 models are compromised; BU rises 5.6 points and UA rises 3.5 points.
   • − Write commitment (replannable Planner): 53 attacks succeed (ASR 0.7%), which the authors attribute to injections adding write operations when the attacker's goal uses values already stated in the request.
   • − Candidate-only Binder (free-text Binder): security is maintained (0 attacks), BU drops 2.0 points.
   • − Reporter: BU drops from 25.6% to 12.5%, UA drops from 26.1% to 11.0%.
   • Record grounding (a rejected alternative design, Appendix F): BU changes by −2.1 to +3.1 points, but the descriptor collision attack succeeds 23 times in 103 episodes, so it is not adopted.
   • AgentDojo built-in defenses (Table 8, 8 models): tool filter ASR 3.04%, spotlighting 16.54%, repeat prompt 13.04%, PI detector 3.01%, versus CapLite's 0.00%.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors list two limitations: a single benchmark and a utility gap; the experiments cover 15 open-source models and the four AgentDojo suites.

   Limitations and future directions noted by the authors

   • Single benchmark (Limitations section): All results come from the four AgentDojo suites.
   • Utility gap (Limitations section): CapLite's UA is 21 percentage points lower than the undefended agent, and is lower than CaMeL on Gemma-4-E4B and -12B (the paper calls it significantly below).
   • Confirmation overhead (Limitations section): authority values not specified by the user require user confirmation.

   Experimental coverage

   • The models tested are 15 open-weight models, of which 13 are between 1.7B–12B, plus two larger references Qwen3-32B and Qwen3.6-35B-A3B (Section 4).
   • The benchmark is AgentDojo v1.2.2's Workspace, Slack, Banking, and Travel suites, with 97 user tasks and 949 attack pairs; ASR is computed on 929 tool-goal pairs (Section 4).
   • Attacks cover AgentDojo's important_instructions and tool_knowledge, plus read exfiltration and descriptor collision designed against CapLite; the latter three are run only on 8 robustness models (Section 4).
   • Each configuration is run once, with temperature 0 and a fixed seed (Appendix G); the paper does not report multiple repetitions or an iterative optimization budget for the attacker.
   • The 20 Travel injection goals that only require one sentence in the final answer do not involve write operations; beyond write integrity, CapLite does not defend against such goals (Section 4, Appendix H Case 5).

   Collapse this answer

6. 06Summarize the main content of the paper

   CapLite uses schema-derived policies plus request grounding, with zero successful attacks across 13,935 attacked episodes.

   A prompt injection defense paper targeting small language model (SLM) agents.

   • Problem: The authors ask whether SLM agents can be trusted to write their own security artifacts. Measurements show they cannot: Progent's policy was broken on 14/15 models (676 attacks), IPIGuard on 13 (435), DRIFT on 11 (214); CaMeL was broken only 20/13,935 times, but its program failed to run in up to 68% of episodes, costing 94k tokens per episode.
   • Method: CapLite's policy is derived from tool schemas by fixed rules; the Planner submits write calls before reading any tool results; the Binder selects values only from candidates within the request's grounding set G(q); the Mediator uses deterministic code to require each authority parameter to equal the value specified in the request. The authors claim this guarantees write integrity by construction.
   • Security: Across 15 models and 13,935 attacked episodes, no attack succeeded (Table 1); zero under the three attacks tool_knowledge, read exfiltration, and descriptor collision as well (Table 2).
   • Utility and cost: UA 29.0%, comparable to CaMeL's 27.2%; 17.1k tokens per episode, 18% of CaMeL's, lower than all other enforcement defenses and the undefended agent; UA/kTok 1.69, highest among enforcement defenses (Table 1).
   • Ablation: Removing the Mediator yields 106/7,432 successful attacks; allowing replanning after reads yields 53 successes; the authors state each is necessary (Table 3).
   • Authors' conclusion: SLM agents cannot and need not write their own defenses; CapLite's UA is 21 percentage points lower than undefended, lower than CaMeL on Gemma-4-E4B/-12B, and results come only from the four AgentDojo suites.

   Collapse this answer

Related papers