PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification

2026-04-11

AI Summary

This work addresses the vulnerability of large language model (LLM) agents to indirect prompt injection attacks during external tool invocation, where adversaries manipulate retrieved content to induce malicious actions. The authors propose a training-free defense framework that introduces, for the first time, an isolated planner coupled with a hierarchical verification mechanism. The isolated planner independently generates a reference set of legitimate actions, while the hierarchical verifier enforces hard constraint filtering and intent-level semantic validation to ensure behavioral consistency. Evaluated on the InjecAgent benchmark, the method reduces attack success rates from 72.8% to 0% with a low false positive rate of 1.49%, demonstrating strong generality, compatibility, and model-agnostic applicability.

Technology Category

• Multiagent Systems: Adversarial Agents
• Machine Learning: Large Multimodal Models (LMMs)
• Planning, Routing, and Scheduling: Planning with Language Models

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation

Abstract

Large Language Model (LLM) agents are increasingly integrated into critical systems, leveraging external tools to interact with the real world. However, this capability exposes them to Indirect Prompt Injection (IPI), where attackers embed malicious instructions into retrieved content to manipulate the agent into executing unauthorized or unintended actions. Existing defenses predominantly focus on the pre-processing stage, neglecting the monitoring of the model's actual behavior. In this paper, we propose PlanGuard, a training-free defense framework based on the principle of Context Isolation. Unlike prior methods, PlanGuard introduces an isolated Planner that generates a reference set of valid actions derived solely from user instructions. In addition, we design a Hierarchical Verification Mechanism that first enforces strict hard constraints to block unauthorized tool invocations, and subsequently employs an Intent Verifier to validate whether parameter deviations are benign formatting variances or malicious hijacking. Experiments on the InjecAgent benchmark demonstrate that PlanGuard effectively neutralizes these attacks, reducing the Attack Success Rate (ASR) from 72.8% to 0%, while maintaining an acceptable False Positive Rate of 1.49%. Furthermore, our method is model-agnostic and highly compatible.

Problem

• Indirect Prompt Injection
• LLM agents
• security
• tool interaction
• malicious instructions

Innovation

• Indirect Prompt Injection
• Context Isolation
• Planning-based Verification
• Hierarchical Verification Mechanism
• Model-agnostic Defense