Make prompt-injection defense stateful: a persistent 'antibody' library learns the user's security boundary from each encounter

arXiv 2608.04053·medium signalXBlueskyLinkedInCopy link

AgentAntibody's premise is that user requests are underspecified — they state the desired outcome without enumerating acceptable behavior — and injections live in exactly that ambiguity, completing the stated task in a way the user would reject. Instead of treating each task as self-contained, it keeps a persistent library representing its current understanding of the user's boundary, recognizes threats against it at runtime, and evolves across encounters. Across three benchmarks and four backbone LLMs it beat existing defenses at preventing harmful actions while preserving legitimate completion, including cases where harmful and legitimate actions were both consistent with the stated task.