DISARM: Taint-gated counterfactual auditing for efficient defense against indirect prompt injection

The integration of external tools and untrusted data has transformed large language models (LLMs) into autonomous agents, but also exposes them to indirect prompt injection (IPI) attacks, where adversarial instructions in external content can manipulate tool use and compromise system behavior. Existing defenses use input filtering, reasoning correction, or execution control, but often trade attack suppression against task utility or runtime cost. We propose DISARM , a training-free defense that mediates action commitment at the tool boundary between agent-internal planning and external tool execution. DISARM keeps ordinary steps on a lightweight fast path and invokes one additional planner run only for selected checkpoints after removing any detected suspicious spans. It compares the proposed and replayed actions by tool path and critical arguments, allowing consistent actions, using the replayed action when only critical arguments differ within an unchanged tool path, and blocking tool-path deviations. This selective single-replay policy jointly targets security, utility, and low latency. On AgentDojo with GPT-4o,

reduces the four-attack average attack success rate (ASR) from 23.01% to 0.37% while increasing utility under attack (UA) from 63.69% to 73.63%. On benign tasks, its 4.29s latency is 9.44% above No Defense but 56.22% and 66.80% below MELON-Aug and IPIGUARD, respectively. Across five LLM backends, the largest observed suite-level average ASR is 1.56%. Complementary WASP and all-suite fixed-configuration adaptive evaluations further examine transfer and gate coverage: no successful attacker objective is observed in the evaluated Base64 and fragmentation cases, whereas semantic parameter pollution retains 1.11% ASR. These results support DISARM as a lightweight tool-boundary defense while exposing the boundary of cue-based gating.