SEAL: Sealed Queries for Local Sanitization against Indirect Prompt Injection

What it is

SEAL (KAIST, arXiv 2610.39758, October 2026) is a sanitizer for tool outputs in local LLM agents. It deletes injected text before the agent continues. The task model stays frozen. Only a short soft prompt E (continuous input embeddings), per-layer/head mixing logits θ and a scalar bias b are trained offline. It needs no defense-generated tokens and no separate verifier model. It was evaluated on AgentDojo and AgentDyn, with a replication on a second backbone (the excerpt names Qwen and Gemma).

How it works

The paper builds SEAL around three failures it measured in PISanitizer, an attention-based sanitizer, which it re-ran on the same backbone.

• Scoring reference depends on the inspected text. PISanitizer's scoring token is generated from the context that includes the tool output. On 242 Banking/Slack pairs, 185 were detected with a control suffix. With an optimized 20-token suffix, detection fell to 120/185. Restoring only the control query vectors brought it back to 170/185. SEAL's fix, query sealing, computes queries from the trusted initial context C0 (system and user messages, tool definitions) plus E, in a separate branch that never enters task generation. The queries are cached once per trusted context.
• Softmax normalization makes scores relative. Repeating the payload five times made PISanitizer reverse 85 of 150 removal decisions (56.7%). Adding four benign sentences reversed 26 of 150 (17.3%). SEAL reads query-key compatibility before softmax, aggregates the M sealed queries by log-mean-exp, and mixes layer-head scores with the learned weights. The token score is then d(t) = Σ w·a + b.
• Suppression costs task evidence. On AgentDojo, PISanitizer removes 46.3% of clean text and Attention Tracker removes 75.4%. Both show lower clean task success than no defense. SEAL trains with a ranking loss, a boundary loss and a preservation regularizer that keeps scores stable for unchanged benign units after an attack or benign-instruction insertion. Training data includes legitimate instructions addressed to human readers, so imperative wording alone is not a positive label.

At inference, the tool output is split into units by sentence and structural boundaries. A unit is deleted if its mean token score is above 0. After deletion, the pre-tool cache is restored and the edited text is replayed. Inspection repeats until nothing is deleted or the pass budget R is spent. The same cached keys used for task generation are reused, so no extra decoding is needed.

Preconditions / Affected

• The threat model trusts the initial instructions and tool definitions. Only tool outputs are attacker-controlled. The attacker cannot change C0, the weights or the defense parameters.
• You need access to the task model's internal queries and keys, so this fits self-hosted open-weight models, not hosted APIs.
• A soft prompt and readout must be trained per backbone. Mixed-in non-rotary coordinates are used, and the paper notes backbone-specific details (Qwen scaling uses 1/√256 with 192 retained coordinates; Gemma uses native scaling).
• The paper says keys remain contextual, so scores can still shift when the preceding text changes.

What to do

The excerpt gives no commands or code release. Treat SEAL as a design to evaluate. If you run local agents, compare it with your current defense on attack success and on Joint (task completion without attack success), not attack success alone. The paper reports 34.6% to 0.1% attack success and 51.4% to 77.5% Joint on AgentDojo, with about 127x fewer defense tokens than PISanitizer.

Caveats

• The fetched text stops partway through the training objective. Results tables, adaptive-attack results, the AgentDyn numbers, the value of R and latency figures were not available.
• The O1 and O2 controls do not separate the effects of query changes, normalization and span selection. The paper says so itself.
• The PISanitizer comparison uses the authors' adaptation of its released rules to the same backbone.