PromptArmor: Simple yet Effective Prompt Injection Defenses
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , , , , , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866908457707241472 |
|---|---|
| author | Shi, Tianneng Zhu, Kaijie Wang, Zhun Jia, Yuqi Cai, Will Liang, Weida Wang, Haonan Alzahrani, Hend Lu, Joshua Kawaguchi, Kenji Alomair, Basel Zhao, Xuandong Wang, William Yang Gong, Neil Guo, Wenbo Song, Dawn |
| author_facet | Shi, Tianneng Zhu, Kaijie Wang, Zhun Jia, Yuqi Cai, Will Liang, Weida Wang, Haonan Alzahrani, Hend Lu, Joshua Kawaguchi, Kenji Alomair, Basel Zhao, Xuandong Wang, William Yang Gong, Neil Guo, Wenbo Song, Dawn |
| contents | Despite their potential, recent research has demonstrated that LLM agents are vulnerable to prompt injection attacks, where malicious prompts are injected into the agent's input, causing it to perform an attacker-specified task rather than the intended task provided by the user. In this paper, we present PromptArmor, a simple yet effective defense against prompt injection attacks. Specifically, PromptArmor prompts an off-the-shelf LLM to detect and remove potential injected prompts from the input before the agent processes it. Our results show that PromptArmor can accurately identify and remove injected prompts. For example, using GPT-4o, GPT-4.1, or o4-mini, PromptArmor achieves both a false positive rate and a false negative rate below 1% on the AgentDojo benchmark. Moreover, after removing injected prompts with PromptArmor, the attack success rate drops to below 1%. We also demonstrate PromptArmor's effectiveness against adaptive attacks and explore different strategies for prompting an LLM. We recommend that PromptArmor be adopted as a standard baseline for evaluating new defenses against prompt injection attacks. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2507_15219 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | PromptArmor: Simple yet Effective Prompt Injection Defenses Shi, Tianneng Zhu, Kaijie Wang, Zhun Jia, Yuqi Cai, Will Liang, Weida Wang, Haonan Alzahrani, Hend Lu, Joshua Kawaguchi, Kenji Alomair, Basel Zhao, Xuandong Wang, William Yang Gong, Neil Guo, Wenbo Song, Dawn Cryptography and Security Artificial Intelligence Despite their potential, recent research has demonstrated that LLM agents are vulnerable to prompt injection attacks, where malicious prompts are injected into the agent's input, causing it to perform an attacker-specified task rather than the intended task provided by the user. In this paper, we present PromptArmor, a simple yet effective defense against prompt injection attacks. Specifically, PromptArmor prompts an off-the-shelf LLM to detect and remove potential injected prompts from the input before the agent processes it. Our results show that PromptArmor can accurately identify and remove injected prompts. For example, using GPT-4o, GPT-4.1, or o4-mini, PromptArmor achieves both a false positive rate and a false negative rate below 1% on the AgentDojo benchmark. Moreover, after removing injected prompts with PromptArmor, the attack success rate drops to below 1%. We also demonstrate PromptArmor's effectiveness against adaptive attacks and explore different strategies for prompting an LLM. We recommend that PromptArmor be adopted as a standard baseline for evaluating new defenses against prompt injection attacks. |
| title | PromptArmor: Simple yet Effective Prompt Injection Defenses |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2507.15219 |