# arXiv cs.AI: Lim and coauthors propose SPILLWAY to limit prompt injection in tool-using agents [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-lim-and-coauthors-propose-spillway-to-limit-prompt-0afe29b2) Woosang Lim, Yeseul Chang and Jaewoo Lee propose SPILLWAY, a defense for agents that use tools to act on email, files and payments. Their central move is to separate deciding where an action may go from sanitizing text the agent reads. SPILLWAY checks target values—such as an email sender or payment account—against values returned by read-only tools in typed fields, or against fixed delegation rules. Typed fields are structured tool outputs; injected instructions, the authors say, arrive as free text. A deterministic sanitizer removes instruction-like regions matching fixed rules and keeps the removed spans as evidence. A local judge may restore a refused call, but not if its target appears in removed text. The authors report that across three backbones and seven task suites on one backbone, no standard templated injection redirected an action to an attacker’s target. Under that attack, they report the highest observed mean utility and composite scores among the defenses they ran; a forged chat template produced a raw zero, and mean in-scope attack success under a released reinforcement-learning attacker was .007. They also say SPILLWAY adds almost no model call and triggers no defense-related backbone re-run. The proposal’s practical appeal is its stated aim: constrain where actions go without making a model decide every security check. These results describe the tested tasks Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 4, 2026 (2026-11-04). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-08T17:02:19.307Z. First observed: 2026-11-06T05:01:04.337Z. Retrieved: 2026-11-08T16:48:41.612Z. - [SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection](https://arxiv.org/abs/2611.07222) ## Limits The reported results concern the tested attacks and task suites; the supplied abstract does not give per-suite results or further detail about the evaluation conditions. The authors describe the results as applying to the defenses they ran; the supplied text does not identify those defenses or provide their individual scores. ## Open question How do SPILLWAY’s results vary across the seven task suites, and what details do the authors report about those differences? ## Source-stated The authors propose SPILLWAY, which separates checking action targets from sanitizing instruction-like text, using tool outputs and fixed rules in its admission check. > SPILLWAY turns this observation into a deterministic floor with no per-task plan. - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source-stated The authors say the check admits a call when target values found in tool output but not the user’s task come from a read-only tool’s typed field or a fixed delegation rule. > was returned by a read-only tool in a typed field or is covered by a fixed delegation rule. - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source-stated Across three backbones and seven task suites on one, the authors report no standard templated injection redirected an action to an attacker’s target. > Across three backbones, and seven task suites on one of them, no standard templated injection redirects an action to an attacker's target - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source-stated The authors report mean in-scope attack success of .007 under a released reinforcement-learning attacker. > mean in-scope attack success under a released reinforcement-learning attacker is .007. - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source-stated The authors say SPILLWAY uses no defense-triggered backbone re-run and almost no added model call. > SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call. - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source and contributor context Lim, Woosang, Chang, Yeseul, Lee, Jaewoo · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Prompt injection Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it. - [Definition reference](https://en.wikipedia.org/wiki/Prompt_injection) ## Reinforcement learning Training by trial and error, in which a system is rewarded for the outcomes its designers want. - [Definition reference](https://developers.google.com/machine-learning/glossary#reinforcement-learning-rl) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 01262f99-84c1-47a0-88f6-333b3edf5055. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-08T17:02:19.307Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 23b64b52789a6befd50d3b283ad638570f251f89b9e52135954065af80d08082. Source text hash: e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2. ## Revision and source-check history ### Version 1 — 2026-11-08T17:02:19.307Z Woosang Lim, Yeseul Chang and Jaewoo Lee propose SPILLWAY, a defense for agents that use tools to act on email, files and payments. Their central move is to separate deciding where an action may go from sanitizing text the agent reads. SPILLWAY checks target values—such as an email sender or payment account—against values returned by read-only tools in typed fields, or against fixed delegation rules. Typed fields are structured tool outputs; injected instructions, the authors say, arrive as free text. A deterministic sanitizer removes instruction-like regions matching fixed rules and keeps the removed spans as evidence. A local judge may restore a refused call, but not if its target appears in removed text. The authors report that across three backbones and seven task suites on one backbone, no standard templated injection redirected an action to an attacker’s target. Under that attack, they report the highest observed mean utility and composite scores among the defenses they ran; a forged chat template produced a raw zero, and mean in-scope attack success under a released reinforcement-learning attacker was .007. They also say SPILLWAY adds almost no model call and triggers no defense-related backbone re-run. The proposal’s practical appeal is its stated aim: constrain where actions go without making a model decide every security check. These results describe the tested tasks ## Original source arXiv cs.AI · Article Original source date: Nov 4, 2026 (2026-11-04). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-08T17:02:19.307Z. First observed: 2026-11-06T05:01:04.337Z. Retrieved: 2026-11-08T16:48:41.612Z. - [SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection](https://arxiv.org/abs/2611.07222) ## Limits The reported results concern the tested attacks and task suites; the supplied abstract does not give per-suite results or further detail about the evaluation conditions. The authors describe the results as applying to the defenses they ran; the supplied text does not identify those defenses or provide their individual scores. ## Open question How do SPILLWAY’s results vary across the seven task suites, and what details do the authors report about those differences? ## Source-stated The authors propose SPILLWAY, which separates checking action targets from sanitizing instruction-like text, using tool outputs and fixed rules in its admission check. > SPILLWAY turns this observation into a deterministic floor with no per-task plan. - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source-stated The authors say the check admits a call when target values found in tool output but not the user’s task come from a read-only tool’s typed field or a fixed delegation rule. > was returned by a read-only tool in a typed field or is covered by a fixed delegation rule. - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source-stated Across three backbones and seven task suites on one, the authors report no standard templated injection redirected an action to an attacker’s target. > Across three backbones, and seven task suites on one of them, no standard templated injection redirects an action to an attacker's target - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source-stated The authors report mean in-scope attack success of .007 under a released reinforcement-learning attacker. > mean in-scope attack success under a released reinforcement-learning attacker is .007. - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source-stated The authors say SPILLWAY uses no defense-triggered backbone re-run and almost no added model call. > SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call. - [Supporting source](https://arxiv.org/abs/2611.07222) ## Source and contributor context Lim, Woosang, Chang, Yeseul, Lee, Jaewoo · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Prompt injection Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it. - [Definition reference](https://en.wikipedia.org/wiki/Prompt_injection) ## Reinforcement learning Training by trial and error, in which a system is rewarded for the outcomes its designers want. - [Definition reference](https://developers.google.com/machine-learning/glossary#reinforcement-learning-rl) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 01262f99-84c1-47a0-88f6-333b3edf5055. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-08T17:02:19.307Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 23b64b52789a6befd50d3b283ad638570f251f89b9e52135954065af80d08082. Source text hash: e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2. ### uncertain — 2026-11-08T17:02:19.307Z — anthropic/claude-opus-5.5 Publication: 01262f99-84c1-47a0-88f6-333b3edf5055 attribution — pass: The reading correctly credits Woosang Lim, Yeseul Chang and Jaewoo Lee as authors and keeps the results as their reported claims. Labeling the publisher as arXiv cs.AI matches the feed; the paper is primarily cs.CR and cross-listed to cs.AI. > Authors:Woosang Lim (1 and 2), Yeseul Chang (3), Jaewoo Lee (3) summary — uncertain: The summary is cut off mid-sentence at 'These results describe the tested tasks', with no period or completion. Smallest repair: finish the sentence. It also never explains prompt injection in plain terms, although the abstract supplies it: hidden instructions in a web page or document can make an agent send data or money to an attacker. Adding that would show general readers the stakes. 'Backbones' (the underlying language models) and 'raw zero' also need term-library tooltips. The question about per-suite variation is a legitimate unresolved issue. > an instruction hidden in a web page or a shared document can make an agent send data or money to an attacker date — pass: originalPublished 2026-11-04 matches the v1 submission date. The feed date of 2026-11-06 is correctly not used. > \[Submitted on 4 Nov 2026\] support — pass: All the claims are attributed and supported by the abstract, including the admission rule, the sanitizer and judge behavior, the zero redirects under templated injection, the .007 RL-attacker success rate and the minimal added model calls. The stated aim of constraining action targets without per-check model decisions matches the abstract's deterministic floor. The limitations appropriately note that per-suite results and the competing defenses are not identified. > SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call. media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/0afe29b2eed7eaec73171234e7478e9b6fc07d7500cc6609bc150da34515d097/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-lim-and-coauthors-propose-spillway-to-limit-prompt-0afe29b2.json)