{"id":"https://openalex.org/W7161237769","doi":"https://doi.org/10.48550/arxiv.2605.15030","title":"WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections","display_name":"WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections","publication_year":2026,"publication_date":"2026-05-14","ids":{"openalex":"https://openalex.org/W7161237769","doi":"https://doi.org/10.48550/arxiv.2605.15030"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.15030","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15030","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.15030","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135929628","display_name":"Tri Cao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cao, Tri","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136270945","display_name":"Yulin Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Yulin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136261198","display_name":"Hieu Cao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cao, Hieu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136237033","display_name":"Yibo Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Yibo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136223341","display_name":"Khoi Le","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Le, Khoi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5107873301","display_name":"Thong Nguyen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nguyen, Thong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027761713","display_name":"Yuexin Li","orcid":"https://orcid.org/0000-0001-8525-2853"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Yuexin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136214961","display_name":"Yufei He","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"He, Yufei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136212739","display_name":"Yue Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136211909","display_name":"Shuicheng Yan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yan, Shuicheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136252450","display_name":"Bryan Hooi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hooi, Bryan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.49470001459121704,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.49470001459121704,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.14650000631809235,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.060499999672174454,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/guard","display_name":"Guard (computer science)","score":0.8492000102996826},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5752999782562256},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.4390000104904175},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.41100001335144043},{"id":"https://openalex.org/keywords/web-service","display_name":"Web service","score":0.3621000051498413},{"id":"https://openalex.org/keywords/latency","display_name":"Latency (audio)","score":0.3610000014305115}],"concepts":[{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.8492000102996826},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7630000114440918},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6040999889373779},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5752999782562256},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.4390000104904175},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.41100001335144043},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.3621000051498413},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.3610000014305115},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.33500000834465027},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.31779998540878296},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.3046000003814697},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.29100000858306885},{"id":"https://openalex.org/C2779797433","wikidata":"https://www.wikidata.org/wiki/Q632959","display_name":"Blacklisting","level":2,"score":0.2793999910354614},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26989999413490295},{"id":"https://openalex.org/C2776452267","wikidata":"https://www.wikidata.org/wiki/Q1503443","display_name":"Secrecy","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.15030","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15030","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.15030","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15030","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Web":[0],"agents":[1],"can":[2],"autonomously":[3],"complete":[4],"online":[5],"tasks":[6],"by":[7],"interacting":[8],"with":[9,110,194],"websites,":[10],"but":[11],"their":[12],"exposure":[13],"to":[14,21,40,57,65,174],"open":[15],"web":[16,100],"environments":[17],"makes":[18],"them":[19],"vulnerable":[20],"prompt":[22,128],"injection":[23,129],"attacks":[24,67,130,184],"embedded":[25],"in":[26,192],"HTML":[27],"content":[28],"or":[29,72],"visual":[30],"interfaces.":[31],"Existing":[32],"guard":[33,76,94,133,154],"models":[34],"still":[35],"suffer":[36],"from":[37,115],"limited":[38],"generalization":[39],"unseen":[41],"domains":[42],"and":[43,63,98,119,121,153,182,189],"attack":[44,142],"patterns,":[45],"high":[46],"false":[47,171],"positive":[48,172],"rates":[49,173],"on":[50,105,166],"benign":[51],"content,":[52],"reduced":[53],"deployment":[54],"efficiency":[55],"due":[56],"added":[58],"latency":[59],"at":[60],"each":[61],"step,":[62],"vulnerability":[64],"adversarial":[66,141],"that":[68,145,160],"evolve":[69],"over":[70],"time":[71],"directly":[73],"target":[74],"the":[75,132,195],"itself.":[77],"To":[78],"address":[79],"these":[80],"limitations,":[81],"we":[82],"propose":[83],"WARD":[84,102,148,161],"(Web":[85],"Agent":[86],"Robust":[87],"Defense":[88],"against":[89,180],"Prompt":[90],"Injection),":[91],"a":[92,107,123,150],"practical":[93],"model":[95],"for":[96,127],"secure":[97],"efficient":[99],"agents.":[101],"is":[103],"built":[104],"WARD-Base,":[106],"large-scale":[108],"dataset":[109,125],"around":[111],"177K":[112],"samples":[113],"collected":[114],"719":[116],"high-traffic":[117],"URLs":[118],"platforms,":[120],"WARD-PIG,":[122],"dedicated":[124],"designed":[126],"targeting":[131],"model.":[134],"We":[135],"further":[136],"introduce":[137],"A3T,":[138],"an":[139],"adaptive":[140,183],"training":[143],"framework":[144],"iteratively":[146],"strengthens":[147],"through":[149],"memory-based":[151],"attacker":[152],"co-evolution":[155],"process.":[156],"Extensive":[157],"experiments":[158],"show":[159],"achieves":[162],"nearly":[163],"perfect":[164],"recall":[165],"out-of-distribution":[167],"benchmarks,":[168],"maintains":[169],"low":[170],"preserve":[175],"agent":[176,196],"utility,":[177],"remains":[178],"robust":[179],"guard-targeted":[181],"under":[185],"substantial":[186],"distribution":[187],"shifts,":[188],"runs":[190],"efficiently":[191],"parallel":[193],"without":[197],"introducing":[198],"additional":[199],"latency.":[200]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-16T00:00:00"}