{"id":"https://openalex.org/W7147128569","doi":"https://doi.org/10.48550/arxiv.2603.30016","title":"Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks","display_name":"Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks","publication_year":2026,"publication_date":"2026-03-31","ids":{"openalex":"https://openalex.org/W7147128569","doi":"https://doi.org/10.48550/arxiv.2603.30016"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.30016","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.30016","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.30016","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5132632209","display_name":"Chong Xiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiang, Chong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013955474","display_name":"Drew Zagieboylo","orcid":"https://orcid.org/0000-0001-6847-6599"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zagieboylo, Drew","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027156022","display_name":"Shaona Ghosh","orcid":"https://orcid.org/0000-0003-4658-5174"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ghosh, Shaona","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5132608687","display_name":"Sanjay Kariyappa","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kariyappa, Sanjay","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084917133","display_name":"Kai Greshake","orcid":"https://orcid.org/0009-0005-0460-5327"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Greshake, Kai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101702107","display_name":"Hanshen Xiao","orcid":"https://orcid.org/0000-0003-3380-4518"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiao, Hanshen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5132663836","display_name":"Chaowei Xiao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiao, Chaowei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5132715392","display_name":"G. Edward Suh","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Suh, G. Edward","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7077000141143799,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7077000141143799,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.051500000059604645,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.04349999874830246,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/personalization","display_name":"Personalization","score":0.5857999920845032},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5580999851226807},{"id":"https://openalex.org/keywords/position-paper","display_name":"Position paper","score":0.4706999957561493},{"id":"https://openalex.org/keywords/structuring","display_name":"Structuring","score":0.46880000829696655},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.387800008058548},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.3495999872684479}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7167999744415283},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6873000264167786},{"id":"https://openalex.org/C183003079","wikidata":"https://www.wikidata.org/wiki/Q1000371","display_name":"Personalization","level":2,"score":0.5857999920845032},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5580999851226807},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.49900001287460327},{"id":"https://openalex.org/C78780964","wikidata":"https://www.wikidata.org/wiki/Q7233193","display_name":"Position paper","level":2,"score":0.4706999957561493},{"id":"https://openalex.org/C2775945657","wikidata":"https://www.wikidata.org/wiki/Q381442","display_name":"Structuring","level":2,"score":0.46880000829696655},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.387800008058548},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3495999872684479},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.32690000534057617},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3215000033378601},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.31690001487731934},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3156999945640564},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.3034999966621399},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.3034999966621399}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.30016","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.30016","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.30016","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.30016","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.7322933673858643,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"AI":[0],"agents,":[1],"predominantly":[2],"powered":[3],"by":[4,147],"large":[5],"language":[6],"models":[7],"(LLMs),":[8],"are":[9,53],"vulnerable":[10],"to":[11,111],"indirect":[12,38],"prompt":[13,39],"injection,":[14],"in":[15,20,94],"which":[16,139],"malicious":[17],"instructions":[18],"embedded":[19],"untrusted":[21],"data":[22],"can":[23,89,122],"trigger":[24],"dangerous":[25],"agent":[26,151],"actions.":[27],"This":[28],"position":[29],"paper":[30],"discusses":[31],"our":[32,112],"vision":[33],"for":[34,56],"system-level":[35,137],"defenses":[36],"against":[37],"injection":[40],"attacks.":[41],"We":[42,131],"articulate":[43],"three":[44],"positions:":[45],"(1)":[46],"dynamic":[47,57],"replanning":[48],"and":[49,59,91,99,129,149,155,159,167],"security":[50,65,157],"policy":[51],"updates":[52],"often":[54],"necessary":[55],"tasks":[58],"realistic":[60],"environments;":[61],"(2)":[62],"certain":[63],"context-dependent":[64],"decisions":[66],"would":[67],"still":[68],"require":[69],"LLMs":[70],"(or":[71],"other":[72],"learned":[73],"models),":[74],"but":[75],"should":[76,102],"only":[77],"be":[78,103],"made":[79],"within":[80],"system":[81],"designs":[82],"that":[83,121],"strictly":[84],"constrain":[85],"what":[86],"the":[87,134,142],"model":[88,165],"observe":[90],"decide;":[92],"(3)":[93],"inherently":[95],"ambiguous":[96],"cases,":[97],"personalization":[98],"human":[100,168],"interaction":[101],"treated":[104],"as":[105,141],"core":[106],"design":[107],"considerations.":[108],"In":[109],"addition":[110],"main":[113],"positions,":[114],"we":[115],"discuss":[116],"limitations":[117],"of":[118,127,136,144],"existing":[119],"benchmarks":[120],"create":[123],"a":[124],"false":[125],"sense":[126],"utility":[128],"security.":[130],"also":[132],"highlight":[133],"value":[135],"defenses,":[138],"serve":[140],"skeleton":[143],"agentic":[145],"systems":[146],"structuring":[148],"controlling":[150],"behaviors,":[152],"integrating":[153],"rule-based":[154],"model-based":[156],"checks,":[158],"enabling":[160],"more":[161],"targeted":[162],"research":[163],"on":[164],"robustness":[166],"interaction.":[169]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-02T00:00:00"}