This paper presents Untrusted Content Masking (UCM), a simple and effective approach that restores the trust boundary in web environments by leveraging a key structural insight: a webpage's Document Object Model encodes sufficient information to distinguish trusted from untrusted regions without reading their content.
Abstract
Defenses that provide security guarantees against prompt injection attacks rely on strict isolation between trusted instructions and untrusted data. In text-based environments such as tool-use APIs, this separation arises naturally: agents can reason from interface definitions without ever processing untrusted content. Extending these guarantees to web agents faces a fundamental challenge: to perceive and interact with their environment, web agents must first observe the rendered page, which intermingles trusted content with untrusted content. This structural entanglement removes the trust boundary on which security guarantees depend, undermining provable defenses for web agents. In this paper, we present Untrusted Content Masking (UCM), a simple and effective approach that restores this boundary in web environments. We leverage a key structural insight: a webpage's Document Object Model (DOM) encodes sufficient information to distinguish trusted from untrusted regions without reading their content. Our framework exploits this by redacting untrusted regions before they reach the agent and routing interaction through a sandboxed interface with strict privilege separation, thereby enabling agents to observe and interact with their environment while remaining isolated from adversarial content. The code is publicly available.
Confidential MCP is presented, a set of backward-compatible extensions to MCP that enable standardized, auditable tool calling within and across TEE boundaries and introduces a three-zone enclave-partitioned server topology, a programmable Anonymization Transform Layer (ATL) with formal parameter classification and entropy bounds, and Attested Egress Policies (AEPs) that extend behavioral transparency.
Ankur Aggarwal· International journal of com...· 0 citations
Service uptime monitoring infrastructure is a high-value target for data-integrity attacks: a single compromised or dishonest monitoring provider can fabricate availability records, retroactively suppress outage evidence, or silently alter historical data, and clients today have no cryptographic means of detecting such manipulation. This study develops a threat model for monitoring-data integrity attacks—covering provider-side tampering, evidence suppression, Sybil-identity flooding, and submission replay—and presents a verification architecture engineered to resist each threat in that model. Independent validator nodes sign availability observations with Ed25519 keys; a quorum-based aggregation rule tolerates up to f < Q/2 Byzantine validators, SHA-256 content-hash commitments bind off-chain evidence to an immutable on-ledger record that any third party can independently re-derive and check without trusting the aggregator; and stake-bonded registration imposes a quantifiable capital cost on Sybil identities. We formalize the adversary model, prove signature unforgeability under the Elliptic Curve Discrete Logarithm assumption, derive the capital cost of quorum capture, and bound the residual attack surface—selective evidence inclusion and round-stalling—that persists even under a semi-honest aggregator. A seven-day, five-validator, three-region deployment achieves 99.7% quorum agreement, sub-6-second worst-case attestation latency, and zero false positives or negatives across 200 independently re-verified historical rounds, confirming that the architecture removes the central point of trust that lets a single compromised provider corrupt monitoring evidence undetected.
M. Anusuya, Chayadevi M. L., S. C. et al.· International Journal of Adv...· 0 citations
This study designs a comprehensive testbed and a layered defense, Spotlight-Guard, that combines spotlighting-based input isolation, an LLM detection-and-quarantine pipeline, and instruction integrity based on a Hash-based Message Authentication Code into a single framework, and it is evaluated jointly along two axes: security and LLM performance.
Doygun Demirol, Murat Aydoğan· Applied Sciences· 0 citations
Autonomous LLM agents can turn untrusted content into effectful actions such as payments and permission changes. If the same process interprets this content and controls a reusable signing credential, prompt injection can cross the judgment boundary and reach execution authority. We present KITA, a review-to-authorization architecture that keeps the user's personal secret signing key and every threshold signing-key share outside all LLM processes. Under threshold signature unforgeability and our system assumptions, compromising the proposer and fewer than t reviewer-signer domains cannot produce a valid authorization for a new action without signing contributions from t distinct domains. Thus, any such authorization includes a share from an uncompromised domain, bound to the canonical action and released only after authenticated reviewer approval. This establishes execution-bound authorization integrity. We implement the complete reviewer-to-executor path with a structured-output LLM adapter and threshold BLS. Six system tests validate quorum gating and message binding at this interface, while cryptographic microbenchmarks measure the online signing path and its scaling behavior.
LLM-based web agents automate user tasks by observing webpages and executing browser actions on behalf of users. As these agents operate on real web services, login becomes a sensitive authentication boundary because it involves credentials and sensitive information. Existing work shows that malicious webpage content can manipulate web agent actions, but it has not fully examined whether such content can induce login and cause end-to-end private data leakage. We study this attack surface and present LoginTrap, a task-agnostic login-inducing attack against LLM-based web agents. LoginTrap assumes a black box attacker that controls the webpage context and the induced login flow without knowing the user task or web agent internals. Under this threat model, LoginTrap uses webpage context to generate page-specific indirect injections through a fuzzing-inspired process, making login appear as a plausible prerequisite for continuing the task and guiding the agent to a controlled login page. We conduct a comprehensive analysis of LoginTrap across realistic web agent executions. The results show that LoginTrap reaches 86\% average end-to-end attack success across LLM backbones and remains effective across agent architectures and defenses. These findings identify login inducement as a systematic authentication boundary risk and motivate further research on authentication-aware defenses for web agents.
Longtao Guo, Zelin Zhang, Kaifeng Huang et al.· 0 citations
Agentic large language model (LLM) networks are increasingly used in safety-critical settings where autonomous agents invoke tools, exchange context, and coordinate decisions. Prompt-injection attacks remain a significant threat to these multi-agent pipelines because they can compromise data flows between agents, bypass instruction hierarchies, and corrupt output integrity. Although defenses against injected prompts and mechanisms for cryptographically verifying model-related computations have been studied independently, no common framework unifies these complementary security perspectives in a protocol suitable for real-time agentic deployments. From the perspective of symmetry, secure inter-agent communication requires the preservation of an invariant integrity relationship between a message at its source and the corresponding message accepted at its destination. A benign communication path therefore exhibits a form of integrity symmetry, whereas prompt injection or message manipulation creates an asymmetric state in which the received payload, its semantic effect, or the receiving model’s internal activation pattern deviates from the trusted reference state. In this paper, we propose SecurePrompt-IntegrityNet (SPI-Net), a prompt-injection-resilient data integrity verification protocol that combines cryptographic attestation with anomaly-aware activation monitoring. SPI-Net provides three closely related mechanisms: a Merkle-tree-based commitment system that verifies the provenance and integrity of data payloads exchanged between agents; a layer-wise Mahalanobis-scoring Activation Anomaly Detector (AAD) that identifies distributional shifts in the intermediate representations of LLMs; and a Trust Propagation Consensus (TPC) mechanism that combines cryptographic and behavioral evidence into per-payload integrity verdicts. In this formulation, the Cryptographic Attestation Module (CAM) tests whether message-level structural symmetry is preserved between the sender and receiver, whereas the AAD detects behavioral symmetry breaking in activation space. Experiments on three multi-agent benchmarks under five adaptive attack strategies show that SPI-Net achieves a 96.8% detection rate with a 1.7% false positive rate, reduces the attack success rate by 94.3% relative to undefended baselines, verifies data integrity with 99.2% accuracy, and introduces only 38 ms of median per-message latency. These results demonstrate that jointly preserving cryptographic integrity symmetry and identifying activation-level asymmetry provides substantially stronger prompt-injection resilience than either verification mechanism alone.
Faisal Alhwikem, A. Khan, Fawwad Hassan Jaskani· Symmetry· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
