Paper Title: ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
Source: arXiv:2602.20708 (published Feb 24, 2026)
1. Research Background
LLM agents are vulnerable to Indirect Prompt Injection (IPI), where malicious instructions hidden in external content hijack the agent's behavior. Existing defenses often lead to "over-refusal," where the agent stops working even on legitimate tasks.
Key Insight: IPI attacks leave distinct "over-focusing" signatures in the LLM's latent space that can be detected and corrected in real-time.
2. Proposed Framework: ICON
ICON introduces a probing-to-mitigation framework:
- Latent Space Trace Prober: Detects attacks by identifying high intensity scores in the model's internal representations.
- Mitigating Rectifier: Performs "surgical attention steering" to ignore adversarial query-key dependencies while amplifying the original task's elements.
3. Evaluation Results
ICON achieved a 0.4% Attack Success Rate (ASR), matching commercial-grade detectors, while improving task utility by over 50% compared to traditional filtering. It also showed strong performance on multi-modal agents.