CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agents

arXiv:2609.34463 · cs.CR, cs.AI · Submitted 2026-09-28 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-28

Updated: 2026-09-28

Terminology

• Benchmark — 16× in this paper · explained in 2 episodes
• Alignment — 11× in this paper · explained in 1 episode
• Generalization — 5× in this paper · explained in 13 episodes
• Monte Carlo Tree Search — 5× in this paper
• Robustness — 5× in this paper · explained in 5 episodes
• Ablation — 4× in this paper · explained in 1 episode
• Adaptation — 4× in this paper · explained in 1 episode
• Benchmarking — 4× in this paper · explained in 3 episodes
• Consistency — 4× in this paper · explained in 3 episodes
• Failure Modes — 4× in this paper · explained in 3 episodes
• Fine-Tuning — 4× in this paper · explained in 5 episodes
• GRPO — 4× in this paper · explained in 6 episodes
• LLM judge — 4× in this paper · explained in 2 episodes
• Accuracy — 3× in this paper · explained in 1 episode
• Reinforcement Learning — 3× in this paper · explained in 4 episodes
• Adversarial Co-evolution — 2× in this paper · explained in 1 episode
• Adversarial Training — 2× in this paper · explained in 1 episode
• Agent Security Bench — 2× in this paper
• Attack Success Rate (ASR) — 2× in this paper · explained in 2 episodes
• Verification — 2× in this paper · explained in 2 episodes
• AI Agents — 1× in this paper · explained in 2 episodes
• Ablation Studies — 1× in this paper · explained in 1 episode
• Ablation study — 1× in this paper · explained in 1 episode
• Adaptive Safety — 1× in this paper · explained in 1 episode
• Adaptivity — 1× in this paper · explained in 1 episode
• Adversarial Examples — 1× in this paper · explained in 2 episodes
• Catastrophic Forgetting — 1× in this paper · explained in 5 episodes
• Distillation — 1× in this paper · explained in 2 episodes
• Generative AI — 1× in this paper · explained in 2 episodes
• Grounding — 1× in this paper · explained in 3 episodes
• Interpretability — 1× in this paper · explained in 15 episodes
• KL Regularization — 1× in this paper · explained in 2 episodes
• Large Language Model (LLM) — 1× in this paper · explained in 3 episodes
• LoRA Adapters — 1× in this paper · explained in 3 episodes
• Multi-Agent System — 1× in this paper · explained in 6 episodes
• On-Policy Distillation — 1× in this paper · explained in 3 episodes
• RAG — 1× in this paper · explained in 3 episodes
• Regularization — 1× in this paper · explained in 3 episodes
• Supervised Fine-Tuning (SFT) — 1× in this paper · explained in 8 episodes
• Trace — 1× in this paper · explained in 2 episodes

Sources

• Constitutional AI: Harmlessness from AI Feedback
• StruQ: Defending Against Prompt Injection with Structured Queries
• Meta-SecAlign: Training LLMs against Prompt Injection for Robust Agents
• ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning
• RainbowPlus: Enhancing Adversarial Prompt Generation via Evolutionary Quality-Diversity Search
• WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
• DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation
• LocalAlign: Enabling Generalizable Prompt Injection Defense via Generation of Near-Target Adversarial Examples for Alignment Training
• LoRA: Low-Rank Adaptation of Large Language Models
• ReasAlign: Reasoning Enhanced Safety Alignment against Prompt Injection Attack
• GDPO: Group reward-Decoupled Normalization Policy Optimization for Multi-reward RL Optimization
• AgentBench: Evaluating LLMs as Agents
• AutoDojo: A Generative Benchmark for Evaluating Prompt Injection Defenses in LLM Agents
• Toolformer: Language Models Can Teach Themselves to Use Tools
• ASPI: Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents
• DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models
• PromptArmor: Simple yet Effective Prompt Injection Defenses
• GPT-Red: Automated Red Teaming via Self-Play at Scale

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs