Xu, Zimo, Liu, Wenzhuo, Nakayama, Hideki · Nov 12, 2026
arXiv cs.AI: CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts
Markdown · JSON · Original source
The authors of CapLite argue that small language model (SLM) agents cannot reliably write the security artifacts used by several defenses. Their alternative derives its policy from tool schemas and commits write calls before reading tool results. It allows a write only when the user’s request states every argument that determines whom or what the write affects. The authors say this design prevents injected text from adding a write or directing one to an unstated recipient, amount, object or destination. In 13,935 attacked AgentDojo episodes, they report that no attack succeeds. They also report utility under attack comparable to CaMeL’s, with fewer tokens per episode than every other enforcement defense and the undefended agent. CapLite’s approach is to constrain consequential tool actions without relying on the agent’s model to write a security artifact. The evidence here is the paper’s abstract and reported results; how the approach performs beyond those episodes remains unknown.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Nov 12, 2026 (2026-11-12).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-13T16:01:25.593Z. First observed: 2026-11-13T07:40:12.310Z. Retrieved: 2026-11-13T15:36:25.365Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
These results are reported in the paper’s abstract and concern the tested models and attacked AgentDojo episodes; the evidence provided does not establish performance on other tasks.
Open question
How would CapLite’s reported attack resistance and utility change on tasks beyond the attacked AgentDojo episodes?
Source-stated
The authors report that small language model agents failed to reliably write security artifacts for several enforcement defenses across the models they tested.
Across 15 open-weight models, 13 of them between 1.7B and 12B parameters, they cannot:
Source-stated
CapLite derives its policy from tool schemas and commits write calls before reading tool results.
CapLite, which derives its policy from the tool schemas, commits the write calls before any tool result is read
Source-stated
CapLite admits a write only when the user request states every argument that determines whom or what it affects.
admits a write only if every argument that decides whom or what it affects is stated in the user's request.
Source-stated
The authors report no successful attacks in 13,935 attacked AgentDojo episodes.
No attack succeeds in 13,935 attacked AgentDojo episodes.
Source-stated
The authors report utility under attack comparable to CaMeL's, with CapLite using fewer tokens than every other enforcement defense and the undefended agent.
CapLite reaches utility under attack comparable to CaMeL's (29.0% vs. 27.2%) with fewer tokens than every other enforcement defense and than the undefended agent: 17.1k per episode
Source and contributor context
Xu, Zimo, Liu, Wenzhuo, Nakayama, Hideki · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 36613ae2-b176-4c2c-8aef-996ac2c174c0.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T16:01:25.593Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 6f72d5dc295242467d6bb7c325c3e855a586d4a3515febd0c13eee569ec1cf5d. Source text hash: 01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e.
Revision and source-check history
Version 1 · 2026-11-13T16:01:25.593Z
arXiv cs.AI: CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts
The authors of CapLite argue that small language model (SLM) agents cannot reliably write the security artifacts used by several defenses. Their alternative derives its policy from tool schemas and commits write calls before reading tool results. It allows a write only when the user’s request states every argument that determines whom or what the write affects. The authors say this design prevents injected text from adding a write or directing one to an unstated recipient, amount, object or destination. In 13,935 attacked AgentDojo episodes, they report that no attack succeeds. They also report utility under attack comparable to CaMeL’s, with fewer tokens per episode than every other enforcement defense and the undefended agent. CapLite’s approach is to constrain consequential tool actions without relying on the agent’s model to write a security artifact. The evidence here is the paper’s abstract and reported results; how the approach performs beyond those episodes remains unknown.
Original source
cs.AI · Article
Source details
Original source date: Nov 12, 2026 (2026-11-12).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-13T16:01:25.593Z. First observed: 2026-11-13T07:40:12.310Z. Retrieved: 2026-11-13T15:36:25.365Z.
Limits
These results are reported in the paper’s abstract and concern the tested models and attacked AgentDojo episodes; the evidence provided does not establish performance on other tasks.
Open question
How would CapLite’s reported attack resistance and utility change on tasks beyond the attacked AgentDojo episodes?
Source-stated
The authors report that small language model agents failed to reliably write security artifacts for several enforcement defenses across the models they tested.
Across 15 open-weight models, 13 of them between 1.7B and 12B parameters, they cannot:
Source-stated
CapLite derives its policy from tool schemas and commits write calls before reading tool results.
CapLite, which derives its policy from the tool schemas, commits the write calls before any tool result is read
Source-stated
CapLite admits a write only when the user request states every argument that determines whom or what it affects.
admits a write only if every argument that decides whom or what it affects is stated in the user's request.
Source-stated
The authors report no successful attacks in 13,935 attacked AgentDojo episodes.
No attack succeeds in 13,935 attacked AgentDojo episodes.
Source-stated
The authors report utility under attack comparable to CaMeL's, with CapLite using fewer tokens than every other enforcement defense and the undefended agent.
CapLite reaches utility under attack comparable to CaMeL's (29.0% vs. 27.2%) with fewer tokens than every other enforcement defense and than the undefended agent: 17.1k per episode
Source and contributor context
Xu, Zimo, Liu, Wenzhuo, Nakayama, Hideki · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 36613ae2-b176-4c2c-8aef-996ac2c174c0.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T16:01:25.593Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 6f72d5dc295242467d6bb7c325c3e855a586d4a3515febd0c13eee569ec1cf5d. Source text hash: 01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e.
uncertain · 2026-11-13T16:01:25.593Z · anthropic/claude-opus-5.5
Publication: 36613ae2-b176-4c2c-8aef-996ac2c174c0
attribution — pass: The reading attributes the argument, design and benchmark results to the paper's authors. Phrasing such as 'they report' and 'the authors say' keeps source claims attributed. The arXiv listing names Zimo Xu, Wenzhuo Liu and Hideki Nakayama as the authors.
Authors:Zimo Xu, Wenzhuo Liu, Hideki Nakayama
summary — uncertain: The reading tracks the abstract faithfully, but its central terms are left unexplained for a general reader. It never says what prompt injection is: malicious text in tool results that tries to steer an agent. It also leaves 'security artifacts', 'write calls', 'tool schemas', AgentDojo, CaMeL and 'enforcement defense' unexplained. Omitting the 29.0% vs. 27.2% figures hides that utility under attack is low in absolute terms for both defenses. Smallest repair: add a plain one-clause gloss of prompt injection and AgentDojo, and keep the utility percentages.
CapLite reaches utility under attack comparable to CaMeL's (29.0% vs. 27.2%)
date — pass: The evidence.originalPublished value is 2026-11-12. This matches the arXiv v1 submission date, which is the first publication, not the later feed entry.
[Submitted on 12 Nov 2026]
support — pass: Each claim matches an abstract excerpt. The draft softens 'guarantees write integrity' to what the authors say the design prevents. The limitation and the question about performance beyond the attacked AgentDojo episodes do not overreach and add no unsupported benefits or costs.
No attack succeeds in 13,935 attacked AgentDojo episodes.
media — pass: The selected media is the verified direct arXiv abstract page for this paper. It matches the source URL and is the most direct way for a reader to reach the original.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivHidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXiv