ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection
Source: https://arxiv.org/abs/2604.11790 Authors: Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun Published: 2026-04-13 Updated: 2026-05-11 Categories: cs.CR, cs.AI
中文摘要
这篇论文提出 ClawGuard, 将间接提示注入防御放到每个工具调用边界. 方法是先从用户目标推导任务约束, 再在工具执行前拦截违规调用. 摘要报告其在 web, local, MCP, skill 等六类注入基准上验证, 同时用 OS, web, code 任务检查效用损失和 token 开销.
英文摘要（Abstract）
Tool-augmented Large Language Model (LLM) agents have demonstrated impressive capabilities in automating complex, multi-step real-world tasks, yet remain vulnerable to indirect prompt injection. Adversaries exploit this weakness by embedding malicious instructions within tool-returned content, which agents directly incorporate into their conversation history as trusted observations. To address these vulnerabilities, we introduce \textsc{ClawGuard}, a novel runtime security framework that enforces a user-confirmed rule set at every tool-call boundary, transforming unreliable alignment-dependent defense into a deterministic, auditable mechanism that intercepts adversarial tool calls before any real-world effect is produced. By automatically deriving task-specific access constraints from the user's stated objective prior to any external tool invocation, \textsc{ClawGuard} blocks all three injection pathways without model modification or infrastructure change. Experiments across five state-of-the-art language models on six injection benchmarks covering web, local, MCP, and skill channels, as well as three utility benchmarks covering OS, web, and code tasks, demonstrate that \textsc{ClawGuard} achieves robust protection against indirect prompt injection without compromising agent utility or introducing significant token overhead. This work establishes deterministic tool-call boundary enforcement as an effective defense mechanism for secure agentic AI systems. Code is publicly available at github.com/Claw-Guard/ClawGuard/.
一句评点
ClawGuard 把工具调用边界变成间接提示注入的确定性防线.
来源与元数据
- arXiv: https://arxiv.org/abs/2604.11790
- PDF: https://arxiv.org/pdf/2604.11790v2
- Authors: Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun
- Published: 2026-04-13
- Updated: 2026-05-11
- Categories: cs.CR, cs.AI
本文件由 content-fetcher 通过 opencli arxiv paper 获取论文元数据和摘要后回填，不包含未读取全文的额外推断。