Lim, Woosang, Chang, Yeseul, Lee, Jaewoo · Nov 4, 2026
arXiv cs.AI: Lim and coauthors propose SPILLWAY to limit prompt injection in tool-using agents
Markdown · JSON · Original source
Woosang Lim, Yeseul Chang and Jaewoo Lee propose SPILLWAY, a defense for agents that use tools to act on email, files and payments. Their central move is to separate deciding where an action may go from sanitizing text the agent reads. SPILLWAY checks target values—such as an email sender or payment account—against values returned by read-only tools in typed fields, or against fixed delegation rules. Typed fields are structured tool outputs; injected instructions, the authors say, arrive as free text. A deterministic sanitizer removes instruction-like regions matching fixed rules and keeps the removed spans as evidence. A local judge may restore a refused call, but not if its target appears in removed text. The authors report that across three backbones and seven task suites on one backbone, no standard templated injection redirected an action to an attacker’s target. Under that attack, they report the highest observed mean utility and composite scores among the defenses they ran; a forged chat template produced a raw zero, and mean in-scope attack success under a released attacker was .007. They also say SPILLWAY adds almost no model call and triggers no defense-related backbone re-run. The proposal’s practical appeal is its stated aim: constrain where actions go without making a model decide every security check. These results describe the tested tasks
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Nov 4, 2026 (2026-11-04).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-08T17:02:19.307Z. First observed: 2026-11-06T05:01:04.337Z. Retrieved: 2026-11-08T16:48:41.612Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The reported results concern the tested attacks and task suites; the supplied abstract does not give per-suite results or further detail about the evaluation conditions. The authors describe the results as applying to the defenses they ran; the supplied text does not identify those defenses or provide their individual scores.
Open question
How do SPILLWAY’s results vary across the seven task suites, and what details do the authors report about those differences?
Source-stated
The authors propose SPILLWAY, which separates checking action targets from sanitizing instruction-like text, using tool outputs and fixed rules in its admission check.
SPILLWAY turns this observation into a deterministic floor with no per-task plan.
Source-stated
The authors say the check admits a call when target values found in tool output but not the user’s task come from a read-only tool’s typed field or a fixed delegation rule.
was returned by a read-only tool in a typed field or is covered by a fixed delegation rule.
Source-stated
Across three backbones and seven task suites on one, the authors report no standard templated injection redirected an action to an attacker’s target.
Across three backbones, and seven task suites on one of them, no standard templated injection redirects an action to an attacker's target
Source-stated
The authors report mean in-scope attack success of .007 under a released reinforcement-learning attacker.
mean in-scope attack success under a released reinforcement-learning attacker is .007.
Source-stated
The authors say SPILLWAY uses no defense-triggered backbone re-run and almost no added model call.
SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call.
Source and contributor context
Lim, Woosang, Chang, Yeseul, Lee, Jaewoo · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Reinforcement learning
Training by trial and error, in which a system is rewarded for the outcomes its designers want.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 01262f99-84c1-47a0-88f6-333b3edf5055.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-08T17:02:19.307Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 23b64b52789a6befd50d3b283ad638570f251f89b9e52135954065af80d08082. Source text hash: e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2.
Revision and source-check history
Version 1 · 2026-11-08T17:02:19.307Z
arXiv cs.AI: Lim and coauthors propose SPILLWAY to limit prompt injection in tool-using agents
Woosang Lim, Yeseul Chang and Jaewoo Lee propose SPILLWAY, a defense for agents that use tools to act on email, files and payments. Their central move is to separate deciding where an action may go from sanitizing text the agent reads. SPILLWAY checks target values—such as an email sender or payment account—against values returned by read-only tools in typed fields, or against fixed delegation rules. Typed fields are structured tool outputs; injected instructions, the authors say, arrive as free text. A deterministic sanitizer removes instruction-like regions matching fixed rules and keeps the removed spans as evidence. A local judge may restore a refused call, but not if its target appears in removed text. The authors report that across three backbones and seven task suites on one backbone, no standard templated injection redirected an action to an attacker’s target. Under that attack, they report the highest observed mean utility and composite scores among the defenses they ran; a forged chat template produced a raw zero, and mean in-scope attack success under a released attacker was .007. They also say SPILLWAY adds almost no model call and triggers no defense-related backbone re-run. The proposal’s practical appeal is its stated aim: constrain where actions go without making a model decide every security check. These results describe the tested tasks
Original source
cs.AI · Article
Source details
Original source date: Nov 4, 2026 (2026-11-04).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-08T17:02:19.307Z. First observed: 2026-11-06T05:01:04.337Z. Retrieved: 2026-11-08T16:48:41.612Z.
Limits
The reported results concern the tested attacks and task suites; the supplied abstract does not give per-suite results or further detail about the evaluation conditions. The authors describe the results as applying to the defenses they ran; the supplied text does not identify those defenses or provide their individual scores.
Open question
How do SPILLWAY’s results vary across the seven task suites, and what details do the authors report about those differences?
Source-stated
The authors propose SPILLWAY, which separates checking action targets from sanitizing instruction-like text, using tool outputs and fixed rules in its admission check.
SPILLWAY turns this observation into a deterministic floor with no per-task plan.
Source-stated
The authors say the check admits a call when target values found in tool output but not the user’s task come from a read-only tool’s typed field or a fixed delegation rule.
was returned by a read-only tool in a typed field or is covered by a fixed delegation rule.
Source-stated
Across three backbones and seven task suites on one, the authors report no standard templated injection redirected an action to an attacker’s target.
Across three backbones, and seven task suites on one of them, no standard templated injection redirects an action to an attacker's target
Source-stated
The authors report mean in-scope attack success of .007 under a released reinforcement-learning attacker.
mean in-scope attack success under a released reinforcement-learning attacker is .007.
Source-stated
The authors say SPILLWAY uses no defense-triggered backbone re-run and almost no added model call.
SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call.
Source and contributor context
Lim, Woosang, Chang, Yeseul, Lee, Jaewoo · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Reinforcement learning
Training by trial and error, in which a system is rewarded for the outcomes its designers want.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 01262f99-84c1-47a0-88f6-333b3edf5055.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-08T17:02:19.307Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 23b64b52789a6befd50d3b283ad638570f251f89b9e52135954065af80d08082. Source text hash: e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2.
uncertain · 2026-11-08T17:02:19.307Z · anthropic/claude-opus-5.5
Publication: 01262f99-84c1-47a0-88f6-333b3edf5055
attribution — pass: The reading correctly credits Woosang Lim, Yeseul Chang and Jaewoo Lee as authors and keeps the results as their reported claims. Labeling the publisher as arXiv cs.AI matches the feed; the paper is primarily cs.CR and cross-listed to cs.AI.
Authors:Woosang Lim (1 and 2), Yeseul Chang (3), Jaewoo Lee (3)
summary — uncertain: The summary is cut off mid-sentence at 'These results describe the tested tasks', with no period or completion. Smallest repair: finish the sentence. It also never explains prompt injection in plain terms, although the abstract supplies it: hidden instructions in a web page or document can make an agent send data or money to an attacker. Adding that would show general readers the stakes. 'Backbones' (the underlying language models) and 'raw zero' also need term-library tooltips. The question about per-suite variation is a legitimate unresolved issue.
an instruction hidden in a web page or a shared document can make an agent send data or money to an attacker
date — pass: originalPublished 2026-11-04 matches the v1 submission date. The feed date of 2026-11-06 is correctly not used.
[Submitted on 4 Nov 2026]
support — pass: All the claims are attributed and supported by the abstract, including the admission rule, the sanitizer and judge behavior, the zero redirects under templated injection, the .007 RL-attacker success rate and the minimal added model calls. The stated aim of constraining action targets without per-check model decisions matches the abstract's deterministic floor. The limitations appropriately note that per-suite results and the competing defenses are not identified.
SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call.
media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Training by trial and error, in which a system is rewarded for the outcomes its designers want.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivTraining by trial and error, in which a system is rewarded for the outcomes its designers want.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXiv