A new defense blocks prompt injection by checking origin, not wording

Researchers behind a paper called ROPE built a filter that ignores what a tool call says and checks where its data came from. Before an agent can pass a value into a sensitive parameter, that value has to trace back unforgeably to the user, to a source the user named up front, or to the user's own authoritative records. Everything else gets blocked, no matter how it's phrased.

That matters because most injection defenses work the other way around. They ask a model to read text and judge whether it looks malicious, which means an attacker just has to find phrasing the judge hasn't seen. ROPE skips the judgment call. The check runs on a fixed, audited list of sensitive parameters, and the only place a model touches the process at all is on the original trusted request, before an attacker's text ever enters the picture.

The numbers back it up: injection attempts succeeded only 1.6% to 2.6% of the time in testing, while the system still completed 82% to 100% of legitimate tasks. That's a real tradeoff, not a free lunch. Some clean requests get blocked too, because provenance checking doesn't know a request is safe, only that it came from somewhere the user vouched for.

The guarantee comes from keeping the model out of the loop on anything an attacker can touch. Because the model never rules on the injected content, no rewording changes the outcome. That's a structural claim, not a benchmark score, different from testing against a list of known attack patterns.

Building anything that lets an agent call tools on a user's behalf means checking whether each sensitive parameter traces to a source you'd trust with write access, before reaching for a content filter at all.