ActGuard audits the planned action instead of filtering tool output, comparing each step against a local tool prior

arXiv·low signalXBlueskyLinkedInCopy link

A September 14 arXiv paper proposes a different shape of indirect prompt injection defense for tool-using agents: rather than sanitizing suspicious external content, it predicts the likely tool usage at each step, builds a local tool prior, and flags the planned action when it deviates from that locally reasonable expectation. The authors report attack success rates comparable to state-of-the-art defenses while keeping task utility near the no-attack baseline, and released an open-source implementation. The framing is useful even apart from the numbers, since content-level filtering keeps losing to obfuscation while action-level auditing sits closer to the thing you actually want to prevent.