{"id":"https://openalex.org/W7154468276","doi":"https://doi.org/10.48550/arxiv.2604.12284","title":"WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents","display_name":"WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents","publication_year":2026,"publication_date":"2026-04-14","ids":{"openalex":"https://openalex.org/W7154468276","doi":"https://doi.org/10.48550/arxiv.2604.12284"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.12284","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.12284","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.12284","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5004591431","display_name":"Y Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Yulin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102842505","display_name":"Tri Cao","orcid":"https://orcid.org/0000-0001-7865-8476"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cao, Tri","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133716287","display_name":"Haoran Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Haoran","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133653874","display_name":"Yue Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130026192","display_name":"Yibo Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Yibo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126310136","display_name":"Yufei He","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"He, Yufei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133671193","display_name":"Le Minh Khoi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Khoi, Le Minh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133701641","display_name":"Yangqiu Song","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Song, Yangqiu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133652970","display_name":"Shuicheng Yan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yan, Shuicheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133697277","display_name":"Bryan Hooi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hooi, Bryan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.41339999437332153,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.41339999437332153,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.12700000405311584,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.12359999865293503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/guard","display_name":"Guard (computer science)","score":0.7759000062942505},{"id":"https://openalex.org/keywords/web-page","display_name":"Web page","score":0.5454999804496765},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.4853000044822693},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.45559999346733093},{"id":"https://openalex.org/keywords/web-application","display_name":"Web application","score":0.3806000053882599},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.3772999942302704},{"id":"https://openalex.org/keywords/web-service","display_name":"Web service","score":0.3513999879360199}],"concepts":[{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.7759000062942505},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7598000168800354},{"id":"https://openalex.org/C21959979","wikidata":"https://www.wikidata.org/wiki/Q36774","display_name":"Web page","level":2,"score":0.5454999804496765},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.4853000044822693},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.45559999346733093},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.3806000053882599},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.3772999942302704},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.3513999879360199},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.32280001044273376},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3224000036716461},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3059000074863434},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.30149999260902405},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.2957000136375427},{"id":"https://openalex.org/C205606062","wikidata":"https://www.wikidata.org/wiki/Q5249645","display_name":"Decoupling (probability)","level":2,"score":0.2865999937057495},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.26989999413490295},{"id":"https://openalex.org/C13565553","wikidata":"https://www.wikidata.org/wiki/Q804206","display_name":"Spamdexing","level":5,"score":0.2667999863624573},{"id":"https://openalex.org/C2983909278","wikidata":"https://www.wikidata.org/wiki/Q6368","display_name":"Web browser","level":3,"score":0.26600000262260437},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.26080000400543213},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.26030001044273376},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.25429999828338623}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.12284","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.12284","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.12284","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.12284","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7559221982955933,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Web":[0],"agents":[1],"powered":[2],"by":[3,13,148],"vision-language":[4],"models":[5],"(VLMs)":[6],"enable":[7],"autonomous":[8],"interaction":[9],"with":[10,91],"web":[11,86],"environments":[12],"perceiving":[14],"and":[15,20,50,65,132,135,139],"acting":[16],"on":[17,106],"both":[18],"visual":[19,134],"textual":[21],"webpage":[22],"content":[23],"to":[24,33,52],"accomplish":[25],"user-specified":[26],"tasks.":[27],"However,":[28],"they":[29],"are":[30],"highly":[31],"vulnerable":[32],"prompt":[34,63,97,118],"injection":[35,98,119],"attacks,":[36],"where":[37],"adversarial":[38],"instructions":[39],"embedded":[40],"in":[41,83,89],"HTML":[42],"or":[43],"rendered":[44],"screenshots":[45],"can":[46],"manipulate":[47],"agent":[48,87,164],"behavior":[49],"lead":[51],"harmful":[53],"outcomes":[54],"such":[55],"as":[56],"information":[57],"leakage.":[58],"Existing":[59],"defenses,":[60],"including":[61],"system":[62],"defenses":[64],"direct":[66],"fine-tuning":[67,146],"of":[68],"agents,":[69],"have":[70],"shown":[71],"limited":[72],"effectiveness.":[73],"To":[74],"address":[75],"this":[76,107],"issue,":[77],"we":[78,109],"propose":[79],"a":[80,85,92,112,123],"defense":[81],"framework":[82],"which":[84],"operates":[88],"parallel":[90],"dedicated":[93],"guard":[94,115],"agent,":[95],"decoupling":[96],"detection":[99],"from":[100],"the":[101,141],"agent's":[102],"own":[103],"reasoning.":[104],"Building":[105],"framework,":[108],"introduce":[110],"WebAgentGuard,":[111],"reasoning-driven,":[113],"multimodal":[114,125],"model":[116,142],"for":[117],"detection.":[120],"We":[121],"construct":[122],"synthetic":[124],"dataset":[126],"using":[127],"GPT-5":[128],"spanning":[129],"164":[130],"topics":[131],"230":[133],"UI":[136],"design":[137],"styles,":[138],"train":[140],"via":[143],"reasoning-intensive":[144],"supervised":[145],"followed":[147],"reinforcement":[149],"learning.":[150],"Experiments":[151],"across":[152],"multiple":[153],"benchmarks":[154],"show":[155],"that":[156],"WebAgentGuard":[157],"consistently":[158],"outperforms":[159],"strong":[160],"baselines":[161],"while":[162],"preserving":[163],"utility,":[165],"without":[166],"introducing":[167],"additional":[168],"latency.":[169]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-16T00:00:00"}