CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution

AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks. In this attack scenario, malicious commands hidden within untrusted content trick the agent into performing unauthorized actions. Existing defenses can reduce attack success but often suffer from the over-defense dilemma: they deploy expensive, always-on sanitization regardless of actual threat, thereby degrading utility and latency even in benign scenarios. We revisit IPI through a causal ablation perspective: a successful injection manifests as a dominance shift where the user request no longer provides decisive support for the agent's privileged action, while a particular untrusted segment, such as a retrieved document or tool output, provides disproportionate attributable influence. Based on this signature, we propose CausalArmor, a selective defense framework that (i) computes lightweight, leave-one-out ablation-based attributions at privileged decision points, and (ii) triggers targeted sanitization only when an untrusted segment dominates the user intent. Additionally, CausalArmor employs retroactive Chain-of-Thought masking to prevent the agent from acting on ``poisoned" reasoning traces. We present a theoretical analysis showing that sanitization based on attribution margins conditionally yields an exponentially small upper bound on the probability of selecting malicious actions. Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses while improving explainability and preserving utility and latency of AI agents.

AI agents can now browse websites, read emails, and call external tools on behalf of users. This makes them useful, but also creates a new security risk: a webpage, email, or tool output can hide malicious instructions that trick the agent into sending data, writing files, or taking other unauthorized actions. Existing defenses often try to stay safe by checking or cleaning everything the agent sees, but this can slow the agent down and sometimes remove useful information even when there is no attack. We propose CausalArmor, a guardrail that intervenes only at high-risk moments. When an agent is about to take an important action, CausalArmor asks a simple question: is this action mainly supported by the user’s request, or by some untrusted content the agent recently read? If untrusted content appears to be driving the action, CausalArmor cleans only that suspicious part and removes any earlier reasoning that may have been contaminated by the attack before the agent tries again. On two agent-security benchmarks, this selective approach blocks almost all successful prompt-injection attacks while keeping normal task performance and speed close to an undefended agent. This suggests that safer AI agents do not always need heavier defenses; they can instead use targeted checks that explain where malicious influence is coming from.