AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2025
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866911272744779776 |
|---|---|
| author | Wang, Peiran Liu, Yang Lu, Yunfei Cai, Yifeng Chen, Hongbo Yang, Qingyou Zhang, Jie Hong, Jue Wu, Ye |
| author_facet | Wang, Peiran Liu, Yang Lu, Yunfei Cai, Yifeng Chen, Hongbo Yang, Qingyou Zhang, Jie Hong, Jue Wu, Ye |
| contents | Large Language Model (LLM) agents offer a powerful new paradigm for solving various problems by combining natural language reasoning with the execution of external tools. However, their dynamic and non-transparent behavior introduces critical security risks, particularly in the presence of prompt injection attacks. In this work, we propose a novel insight that treats the agent runtime traces as structured programs with analyzable semantics. Thus, we present AgentArmor, a program analysis framework that converts agent traces into graph intermediate representation-based structured program dependency representations (e.g., CFG, DFG, and PDG) and enforces security policies via a type system. AgentArmor consists of three key components: (1) a graph constructor that reconstructs the agent's runtime traces as graph-based intermediate representations with control and data flow described within; (2) a property registry that attaches security-relevant metadata of interacted tools \& data, and (3) a type system that performs static inference and checking over the intermediate representation. By representing agent behavior as structured programs, AgentArmor enables program analysis for sensitive data flow, trust boundaries, and policy violations. We evaluate AgentArmor on the AgentDojo benchmark, the results show that AgentArmor can reduce the ASR to 3\%, with the utility drop only 1\%. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2508_01249 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection Wang, Peiran Liu, Yang Lu, Yunfei Cai, Yifeng Chen, Hongbo Yang, Qingyou Zhang, Jie Hong, Jue Wu, Ye Cryptography and Security Artificial Intelligence Computation and Language Machine Learning Software Engineering Large Language Model (LLM) agents offer a powerful new paradigm for solving various problems by combining natural language reasoning with the execution of external tools. However, their dynamic and non-transparent behavior introduces critical security risks, particularly in the presence of prompt injection attacks. In this work, we propose a novel insight that treats the agent runtime traces as structured programs with analyzable semantics. Thus, we present AgentArmor, a program analysis framework that converts agent traces into graph intermediate representation-based structured program dependency representations (e.g., CFG, DFG, and PDG) and enforces security policies via a type system. AgentArmor consists of three key components: (1) a graph constructor that reconstructs the agent's runtime traces as graph-based intermediate representations with control and data flow described within; (2) a property registry that attaches security-relevant metadata of interacted tools \& data, and (3) a type system that performs static inference and checking over the intermediate representation. By representing agent behavior as structured programs, AgentArmor enables program analysis for sensitive data flow, trust boundaries, and policy violations. We evaluate AgentArmor on the AgentDojo benchmark, the results show that AgentArmor can reduce the ASR to 3\%, with the utility drop only 1\%. |
| title | AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection |
| topic | Cryptography and Security Artificial Intelligence Computation and Language Machine Learning Software Engineering |
| url | https://arxiv.org/abs/2508.01249 |