SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection

📌 Highlights

SPILLWAY's central claim is that the destination of a tool-mediated effect can often be decided from typed tool returns and the user's task, without a model-generated per-task routing policy.

The strongest reported result is zero in-scope attack success across all 12 AgentDojo backbone-suite cells under the standard attack, with mean UAU .484, NRP (UAU) .484, and ERS .684.

The component study shows that the deterministic floor provides the safety property, while the sanitizer improves utility without reopening targets removed from the model's context.

The main caveat is scope: the guarantee concerns unauthorized effect targets and assumes attackers cannot control tool implementations or typed identity fields.

• Three backbones: gpt-4o-mini, qwen3-coder:30b, and qwen3:8b.
• Four AgentDojo suites in the breadth grid: Banking, Slack, Travel, and Workspace.
• Seven-suite delegated-routing comparison across AgentDojo and AgentDyn: zero in-scope ASR for SPILLWAY.
• Mean PISmith in-scope ASR: .007; no defense-triggered backbone rerun.

🎯 Introduction

The paper addresses indirect prompt injection in agents that read attacker-controlled text through email, web pages, shared documents, chat, and other tool results. Existing runtime defenses may place a language model on the final admission decision or repeatedly rerun the backbone, while provenance defenses may require an earlier model-based planner or router. The paper argues that these designs either expose a model-based decision to injected text or add substantial inference work.

SPILLWAY instead separates ingress and egress. At ingress, it decides which regions of tool output should be treated as instructions. At egress, it checks whether the recipient, account, participant, file, or other target of a proposed effect is named by the user, was returned in a trusted typed identity field, or is covered by a fixed delegation rule. The architecture figure presents these as separate boundaries connected by retained sanitizer spans.

🔬 Methodology

The egress floor computes taint-novel values from proposed target and principal arguments. The identity index is built from typed fields of trusted read-only tool returns before serialization; body, subject, and description fields are excluded. A target is admitted when it is user-named, appears in the typed index without also appearing in untrusted free text, or satisfies deterministic delegation rules such as a user-named contact attribute or a resource owned by the user's account.

The ingress sanitizer removes forged chat-template turns, benchmark injection regions, agent-addressing instructions, dictated tool calls, and payee-account-change claims using fixed rules. It preserves the removed spans as evidence. A local judge can recover only calls refused by the floor that are not grants or unauthorized destructive operations and whose refused target is outside the removed spans. Its routing and payload views must both approve, and a missing verdict is treated as a refusal.

Algorithm 1 and the architecture figure make the ordering important: deterministic checks establish the safety floor first, sanitization constrains what the model reads and what recovery can inspect, and model-based recovery is applied only to the residual refusal set.

📊 Experiments

The breadth evaluation uses AgentDojo v1.2.2 with the full grid of user and injection tasks across Banking, Slack, Travel, and Workspace, evaluated on gpt-4o-mini, qwen3-coder:30b, and qwen3:8b. The delegated-routing evaluation uses the same AgentDojo suites plus AgentDyn's GitHub, DailyLife, and Shopping suites on gpt-4o-mini, comparing SPILLWAY with ROPE. Stress tests include ChatInject, an attacker-as-sender Workspace variant, AutoDojo optimizer-generated injections, and open-loop replay of the released PISmith reinforcement-learning attacker.

The primary metrics are benign utility (BU, higher is better), under-attack utility (UAU, higher is better), and in-scope attack success rate (ASR, lower is better). The paper also reports NRP = BU × (1 − ASR) and ERS, the harmonic mean of BU and 1 − ASR. In-scope scoring counts executed effects redirected to attacker-named identities and excludes content-manipulation tasks that have no bounded target.

In the standard AgentDojo grid, SPILLWAY reports .000 mean ASR across all 12 cells, compared with .094 for MELON, .031 for Progent, .016 for DRIFT, .005 for ROPE, .283 for Spotlighting, and .060 for the PI detector. Its mean UAU is .484, compared with .417 for the undefended agent, and its ERS is .684. The paper reports zero in-scope ASR on all seven delegated-routing suites; ROPE leaks on Slack (.048), DailyLife (.010), and Shopping (.044) when using its authors' Claude Opus 4.8 router.

The qwen3:8b ablation shows that the floor alone yields zero ASR on all four AgentDojo suites, while adding the judge without sanitization creates leaks on Banking (.028) and Workspace (.002). Adding the sanitizer preserves zero ASR and improves Slack and Travel utility; the complete system reaches .438, .286, .343, and .414 UAU on Banking, Slack, Travel, and Workspace. On benign qwen3:8b traffic, the reported SPILLWAY overhead is small relative to model-rerun defenses, with Figure 3 showing roughly +.4 model calls on Slack and +.2 on Workspace and less than 0.5 seconds of added wall-clock time in those plotted cases.

fig:architecture

Caption: SPILLWAY's two boundaries. (A) The egress floor admits a call whose targets are named in $T$, typed in the index $I$, or covered by a delegation rule (Alg.~alg:spillway). Only a refused call reaches the fail-closed two-view judge. (B) The sanitizer (three rule groups shown) removes matched instruction-like regions before the model reads them and keeps them as spans $S$. A refused target inside $S$ never reaches the judge.

Why It Matters: This is the clearest system-level view of how deterministic admission, sanitization, retained evidence, and judge-based recovery interact.

fig:position-cost

Caption: Per-episode cost (qwen3:8b benign, four suites). Bars: added model invocations per episode over the undefended agent, backbone plus any defense model, machine-independent. For SPILLWAY the defense model is its local judge. Added wall-clock (serving-stack dependent) in gray. MELON, Progent, and DRIFT re-invoke the backbone several times. SPILLWAY adds almost none.

Why It Matters: It visualizes the principal systems tradeoff: SPILLWAY's deterministic floor avoids the repeated backbone calls used by several comparison defenses.

tab:rope

Caption: Utility under attack, per suite.

Why It Matters: The per-suite comparison makes the delegated-routing utility differences between SPILLWAY and ROPE easy to inspect.

Figure ure

Caption: Figure 4: Delegated-routing grid. AgentDyn (Li et al., 2026b) and AgentDojo suite v1.2.2, gpt-4o- mini, standard attack, full grid. ROPE (Ma et al., 2026b) uses its authors’ Claude Opus 4.8 router and cached scopes (Workspace scopes produced once by the same router).

Why It Matters: It summarizes the cross-benchmark delegated-routing comparison and shows SPILLWAY's zero in-scope attack success across all seven suites.

🔮 Conclusion

The paper presents a structurally constrained defense for tool-using agents: typed identity admission supplies the refusal floor, sanitization prevents the model from reading matched instruction-like regions, and the two-view judge recovers only a restricted set of legitimate refusals. Across the reported standard AgentDojo grid, SPILLWAY combines zero in-scope ASR with the highest mean UAU among the evaluated defenses.

The results support the practical value of separating target safety from general content understanding, but they should be interpreted as a target-admission guarantee under the stated tool and attacker assumptions rather than a complete solution to prompt injection.

🛠️ Future Research Improvements

A natural next step is to evaluate the construction against attackers that can influence typed identity fields, tool metadata, or tool-provider behavior, because those conditions are explicitly excluded from the current threat model. The same tests should distinguish target redirection from content manipulation and causality laundering rather than collapsing them into one ASR.

The fixed lexicon and sanitizer rules should be tested across heterogeneous production APIs, multilingual or obfuscated injections, new serialization formats, and tool schemas with ambiguous routing roles. More independent seeds and adaptive online attackers would strengthen claims about reliability beyond the reported grids and replay settings.

🏭 Potential Industry Use Scenarios

SPILLWAY is a plausible control layer for personal agents that read email and documents and then send messages, create calendar events, share files, invite participants, or initiate payments. Typed sender, recipient, account, participant, and ownership fields can provide an auditable allowlist foundation while deterministic delegation rules preserve common workflows such as sending a report to a contact found in meeting notes.

Enterprise agent platforms could use the floor as a low-latency policy boundary around MCP-style tools, with sanitizer spans retained for incident review and the local judge reserved for ambiguous but potentially legitimate delegated actions. Deployment would require a careful tool-role lexicon, explicit treatment of destructive and granting operations, and monitoring for providers that populate identity fields from untrusted sources.

💬 Critical Analysis

The strongest aspect of SPILLWAY is its decomposition of the security problem. The deterministic floor removes backbone dependence from the basic target check, while the sanitizer and span veto address the otherwise dangerous interaction between model-based recovery and attacker-controlled text. The ablation supports this mechanism: the judge alone recovers utility but introduces executed leaks, whereas combining it with sanitization retains zero ASR in the tested arms.

The evidence is strong within the reported benchmark boundaries but not universal. The main grid uses AgentDojo's target-oriented oracle and excludes content-manipulation tasks; the delegated-routing comparison uses one reported seed; and the stress tests include replayed or released attackers rather than every adaptive strategy. The reliance on fixed tool-role lexicons also creates an engineering dependency: deployment quality will depend on whether typed fields genuinely represent trusted identities and whether sanitizer rules match the platform's injection surface.

For builders, the most important verification question is not whether the aggregate ASR is zero on these grids, but whether the target taxonomy, typed-return provenance, delegation rules, and removed-span semantics remain correct under the exact tools and authority boundaries of the intended product.