All four standard guardrails fail against XSPI: 0–14.8% detection in injection session, 0.4–36.2% in activation session

Auto-published from arXiv:2606.04425 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.76, flags: [no-prompt-excerpt])

Category

agent-misbehavior

Model

GLM-5.1, GPT-5-mini, MiniMax-M2.7, Llama-3.1-8B, DeepSeek-V4-Pro

Surface

agent harness

Setup

Four prompt-injection guardrails—Llama-Guard-3-8B, Prompt-Guard-86M, Llama-Prompt-Guard-2-86M, and PIGuard—were applied to XSPI-Bench attack cases, evaluated both at the injection session (S1, where adversarial content enters persistent state) and the activation session (S2, where persisted content re-enters execution). Tests whether conventional single-turn guardrails can detect the split-phase structure of cross-session attacks.

Observed behavior

Detection rates in S1: Llama-Guard-3-8B 3.7%, Prompt-Guard-86M 3.7%, Llama-Prompt-Guard-2-86M 0.0%, PIGuard 14.8%. Detection rates in S2: Llama-Guard-3-8B 0.4%, Prompt-Guard-86M 15.3%, Llama-Prompt-Guard-2-86M 0.4%, PIGuard 36.2%. The best-performing guardrail (PIGuard) still missed over 63% of attacks at activation time.

Expected behavior

A guardrail suitable for agentic deployments should reliably detect adversarial instructions whether they appear inline in a prompt or are retrieved from persistent storage into a later session's execution context.

Reproducibility

medium

Threat model

Operators who deploy existing prompt-injection guardrails assuming they provide meaningful protection against agentic injection are left with a near-zero effective defense. Adversaries aware of this gap can reliably bypass deployed guardrails by routing payloads through persistent agent state rather than direct prompt input, making the attack invisible to the entire current generation of classifiers.

Novelty

Demonstrates that the entire class of existing prompt-injection classifiers is structurally blind to the split-phase (write-then-activate) pattern of cross-session attacks, establishing a concrete and measurable defense gap rather than a marginal degradation.

Source

• arXiv: 2606.04425
• PDF: https://arxiv.org/pdf/2606.04425v2
• Categories: cs.CR, cs.AI
• Authors: Yuanbo Xie, Wenlei Zhu, Tianyun Liu, Yingjie Zhang, Suchen Liu, Yulin Li, Liya Su, Tingwen Liu

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Introduces and systematically characterizes cross-session stored prompt injection as a novel attack class on agentic systems; develops taxonomy of persistence channels and sandbox toolkit with evaluation findings demonstrating concrete failures.

─────────────────────────────────────────────────────────────────────