PIPES cuts state-corruption attack success to 2.3%

A defense called PIPES cut the success rate of state-corruption attacks on AI agents from 84.7% to 2.3%, per a new paper on arXiv.

State-corruption attacks exploit an agent's trust in its own tools. They slip fabricated environment claims into tool output that reads like an ordinary result, bypassing filters built to catch bad instructions, not bad facts.

PIPES screens each response unit two ways. Fields with a stable schema get checked against that schema's contract. Open-ended content is checked using metadata about where it came from. Depending on what it finds, PIPES removes the content, warns the agent, blocks the response, or escalates it.

The researchers tested PIPES across six benchmark splits using Gemma 4 31B IT, under an adaptive attacker that knew the defense was there. Attack success fell to 2.3%. Benign utility, how often the agent still completed legitimate tasks, rose slightly too, from 90.6% to 92.5%.

That utility gain is the number worth sitting with. Most security defenses cost you something in accuracy or speed. PIPES didn't, at least on this benchmark, which is rare enough to be worth checking against other models before anyone assumes it generalizes.

The paper tested one model family. It doesn't say whether the approach holds up on other agent architectures, or what the schema and metadata checks cost at scale.