SPILLWAY: Separating Goal Admission and Sanitization to Defend Tool-Using Agents Against Prompt Injection

The researchers propose SPILLWAY, a deterministic defense method against prompt injection for tool-using agents; in tests on three backbone models, no standard templated injection could redirect actions to an attacker's goal. The method reads the action destination from typed fields returned by tools (such as email sender and payment account), and only permits a call when a target value that appears in tool output but not in the user task comes from a typed field of a read-only tool or conforms to fixed delegation rules; a fixed-rule sanitizer removes instruction-like text before the model reads it and preserves it as evidence, and a local judge can restore rejected calls, except calls whose target lies in the removed text. On seven task suites for one of the backbones, SPILLWAY achieves the highest average utility and composite scores (NRP, ERS) among the tested defenses under this attack, with an average attack success rate of 0.007 in scope under the released reinforcement-learning attacker, zero attack success rate for forged chat template attacks, and almost no additional model calls and no backbone reruns.