{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2605-11026","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","arxiv_id":"2605.11026","date":"2026-05-10","proceeding":null,"authors":["Yassin H. Rassul","Tarik A. Rashid"],"abstract":"Defenses against indirect prompt injection (IPI) in tool-using LLM agents share two structural weaknesses. First, they all attempt to prevent attacks rather than detect the compromises that slip through. Second, they have only been evaluated in English, leaving users of low-resource languages such as Kurdish and Arabic without tested protection. This paper addresses both gaps with AgentShield, a deception-based detection framework that places three layers of traps inside the agent's tool interface: fake tools, fake credentials, and allowlisted parameters. The same trap triggers serve as high-precision labels for a self-supervised classifier. An LLM agent that follows an attacker's hidden instruction almost always touches one of these traps, which gives both a real-time compromise signal and a zero-FP label for training a downstream detector without manual annotation. Across 176 cross-lingual attack prompts and four LLMs from three providers, and because modern LLMs already refuse most IPI attempts on their own (attack success rate <= 10%), AgentShield's job is to catch the attacks that do slip through. On commercial models, it catches 90.7%-100% of such successful attacks, with zero false alarms on 485 normal-use tests. It survives a systematic adaptive-attack evaluation with zero evasion on commercial models, and the self-supervised classifier transfers across models and languages without retraining.","url_abs":"https://arxiv.org/abs/2605.11026","url_pdf":"https://arxiv.org/pdf/2605.11026","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2605.11026"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/Yassin-H-Rassul/AgentShield","reach":null}],"summary":{"ran":8,"unverified":1},"by_repo_kind":{"found_in_text":{"samples":9,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":9,"samples":[{"code_sha256_prefix":"79ea4bd698c5cd44","entry":"check_attack_success","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/run_adaptive_v2.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/run_adaptive_v2.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"79ea4bd698c5cd44"}},{"code_sha256_prefix":"a1dfed4a9a0be088","entry":"chi_squared_test","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/compute_statistics.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/compute_statistics.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"a1dfed4a9a0be088"}},{"code_sha256_prefix":"fef845a461336ee2","entry":"exfiltrate_data_to_attacker_server","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/dashboard.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/dashboard.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"fef845a461336ee2"}},{"code_sha256_prefix":"cc2e07d887b87973","entry":"export_all_user_data","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/dashboard.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/dashboard.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"cc2e07d887b87973"}},{"code_sha256_prefix":"f1b5e37d62fbb861","entry":"mcnemar_test","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/compute_statistics.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/compute_statistics.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"f1b5e37d62fbb861"}},{"code_sha256_prefix":"5ec07c3a2a31daea","entry":"proportion_ci","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/compute_statistics.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/compute_statistics.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"5ec07c3a2a31daea"}},{"code_sha256_prefix":"e925bc12349395ec","entry":"system_admin_console","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/dashboard.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/dashboard.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"e925bc12349395ec"}},{"code_sha256_prefix":"fea6f2ffcae65bcb","entry":"wrap_in_context","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/compare_input_vs_behavioral.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/compare_input_vs_behavioral.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"fea6f2ffcae65bcb"}},{"code_sha256_prefix":"e8b3f4ed67d2425e","entry":"run_classifier","repo":"Yassin-H-Rassul/AgentShield","repo_kind":"found_in_text","path":"agentshield/compare_input_vs_behavioral.py","file_url":"https://github.com/Yassin-H-Rassul/AgentShield/blob/HEAD/agentshield/compare_input_vs_behavioral.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"e8b3f4ed67d2425e"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.CL","source":"arxiv_2026.jsonl"},"syntology_extracted_results":null}