CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts
The authors report zero successful attacks across 13,935 attacked AgentDojo episodes.
CapLite derives its policy from tool schemas and commits write calls before reading any tool results. It permits a write only when the user’s request states every argument determining whom or what it affects, blocking injected text from adding writes or redirecting them. In the reported evaluation, utility under attack reached 29.0%, compared with CaMeL’s 27.2%, while token use was 17.1k per episode—18% of CaMeL’s. Across the models tested, competing defenses also suffered from attack-admitting security artifacts or programs that failed to run.
ArXiv · AI/CL/LG's note
CapLite derives its policy from tool schemas and commits write calls before reading any tool results. It permits a write only when the user’s request states every argument determining whom or what it affects, blocking injected text from adding writes or redirecting them. In the reported evaluation, utility under attack reached 29.0%, compared with CaMeL’s 27.2%, while token use was 17.1k per episode—18% of CaMeL’s. Across the models tested, competing defenses also suffered from attack-admitting security artifacts or programs that failed to run.
ArXiv · AI/CL/LG's note
score 5