SIEVE: Defending Autonomous LLM Agents Against Indirect Prompt Injection

As LLM agents transition from text generation to autonomous tool execution, they face heightened risks from Indirect Prompt Injection (IPI), where malicious external data manipulates agent reasoning to execute unauthorized actions. Current defenses are either too rigid (rule-based) or computationally expensive (constant semantic auditing). Researchers from Emory University have developed SIEVE, a hybrid defense framework that utilizes an "Intent Graph" for deterministic verification of tool transitions and argument sources. By escalating only ambiguous or non-deterministic actions to a high-level Semantic Adjudication Module, SIEVE significantly reduces Attack Success Rate (ASR) across AgentLure and AgentDojo benchmarks while maintaining high operational utility and minimizing token overhead compared to state-of-the-art baselines like DRIFT and ARGUS.

• Threat Model: The Rise of Agentic Indirect Prompt Injection
  • LLM agents are evolving from static text generators to autonomous actors capable of executing real-world tool calls and task management.
  • This transition introduces the Indirect Prompt Injection (IPI) vector, where malicious actors embed payloads in external data sources.
  • IPI targets the agent's internal reasoning process rather than direct user input, bypassing traditional input sanitization protocols.
• Attack Mechanics: Manipulating Autonomous Tool-Use
  • Maliciously crafted content—residing in web pages, emails, or documents—triggers unintended logic branches within the LLM.
  • Payloads can force agents to perform unauthorized API calls, facilitate data exfiltration, or trigger fraudulent financial transactions.
  • Attacks exploit the agent's inherent trust in retrieved external information to override developer-set operational constraints.
• Systemic Impact: Autonomy vs. Security Risks
  • High-autonomy agents create a massive, unpredictable attack surface within enterprise automated workflows.
  • Traditional rule-based defenses suffer from "brittleness," often blocking legitimate, dynamic agent behaviors and reducing utility.
  • Full semantic auditing via constant LLM re-evaluation introduces prohibitive latency and unsustainable API token costs.
• Countermeasures: The SIEVE Hybrid Defense Framework
  • Intent Graph: Employs a structural representation for deterministic verification of tool-call sequences and argument provenance.
  • Selective Escalation: Minimizes computational overhead by only escalating non-deterministic or ambiguous actions to higher-level scrutiny.
  • Semantic Adjudication Module: Utilizes a dedicated LLM layer to resolve complex, ambiguous execution paths that fail deterministic checks.
• Conclusion: The Shift Toward Selective Verification
  • SIEVE demonstrates superior security performance, achieving a 5.94% ASR on AgentLure and a 0.34% ASR on AgentDojo.
  • The framework maintains high operational utility (97.5% on AgentLure) while significantly outperforming DRIFT and ARGUS in resource efficiency.
  • The research provides a scalable architectural blueprint for deploying secure, high-performance autonomous agentic systems in production.