Improved Robustness against Indirect Prompt Injection Can Be Built into LLMs
Mehmet Özdinçer · Samuel Simko · Bernhard Schölkopf · Zhijing Jin
Odile builds indirect prompt-injection robustness into LLM agents through low-rank adaptation on paired benign and harmful traces, achieving strong security--utility tradeoffs across three benchmarks, eight backbones, and adaptive attacks.
摘要
Large language model (LLM) agents act on inputs users do not control, including tool returns, retrieved documents, and messages. Indirect prompt injection embeds instructions in these channels to redirect an agent toward unintended actions. The same tool call may be appropriate for one task and harmful for another, making this threat difficult to address with input-level defenses alone. We ask whether robustness against indirect prompt injection can be built into the LLM itself, and instantiate this idea with Odile, a low-rank adapter trained on paired benign and harmful traces generated by the base model. Odile is designed to convert attacker-directed trajectories into a no-action state before a valid malicious tool call is produced, while preserving ordinary behavior on benign inputs. In matched evaluations, this single model-level defense matches or improves upon the security–utility tradeoffs of prompt hardening, runtime detection and rewriting, and prior fine-tuning defenses. Across three prompt-injection benchmarks, eight model backbones, and two defense-aware adaptive settings, Odile consistently reduces attack success while retaining benign behavior and ordinary model capability. It transfers from a compact training dataset to longer trajectories, different tool interfaces, mixture-of-experts models, and hybrid attention architectures. We release Odile at https://github.com/memo-ozdincer/odile