CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?

2026-08-28

AI Summary

该研究提出CAITLYN系统，通过双层库即时防御现有攻击，并自主合成新防御应对新兴注入攻击，解决LLM代理面临的恶意指令问题。

Abstract

Prompt injection attacks on Large Language Model (LLM) agents seek to introduce malicious instructions or content into external text sources retrieved by agents, forcing the underlying LLMs to execute harmful actions outside their benign scope. While current defenses effectively counter known injection attacks, deploying them in LLM agent environments remains challenging due to attack variants and emerging threats. Moreover, existing solutions typically suffer from an inherent trilemma, i.e., a constant trade-off among runtime efficiency, contextual precision, and adaptability. To bridge this gap, we propose Continuous Agents for Injection Threats via Lifelong Yielding Nexus (CAITLYN), an agent-agnostic defense middleware. CAITLYN integrates two systems. System I focuses on immediate defense against existing attacks using a two-tiered library: Tier-0 for rule-based detection scripts and Tier-1 for optimized LLM-based accurate inference. System II, in contrast, is deployed to monitor potential abnormal signals and attempt to synthesize new defenses. On standard benchmarks, CAITLYN matches the detection performance of state-of-the-art defenses at lower token overhead than LLM-as-a-judge baselines. On Emerging, our new delivery-aware benchmark featuring novel injection techniques, static baselines and the standalone System I configuration remain vulnerable. In contrast, System II autonomously synthesizes verified defense capabilities, substantially lowering the attack success rate across three diverse agent environments.

Problem

• Injection Attacks
• Large Language Models
• Defense Middleware
• Emerging Threats
• Adaptability

Innovation

• Continuous Agents for Injection Threats
• Lifelong Yielding Nexus
• autonomous defense synthesis
• optimized LLM-based inference
• emerging injection attacks