Two Tool-Level Defenses Drive Prompt Injection and Memory Poisoning to 0% Attack Success in Many Settings

arXiv 2609.16098·medium signalXBlueskyLinkedInCopy link

Universal Defenses for Tool-Integrated LLM Agents (arXiv 2609.16098, submitted 14 Sep 2026) tackles direct injection, indirect injection, memory poisoning, and backdoors in one framework via two tool-level mechanisms: Attacker Tool Filtering, which uses anomaly detection such as Isolation Forest to remove suspicious tools, and Normal Tool Recalling, a white-box method that restores the agent's original toolset before planning. Across four open-source models (Gemma2-9B, Qwen2-7B, LLaMA3-8B, LLaMA3.1-8B) and three proprietary ones (GPT-3.5, GPT-4, GPT-5), attack success rates fell to 0% in many settings while original task success was preserved or improved. Code is released, and the practical read is that guarding the toolset is cheaper than guarding the prompt.