Twin Agent: Context Residual Compression for Privilege Separated Agents

2026-07-21

AI Summary

This work addresses the vulnerability of large language model agents to prompt injection attacks triggered by untrusted context, which jeopardizes reasoning integrity and tool-use safety. The authors propose a dual-agent architecture that enforces privilege separation through context residual compression: an explorer agent processes untrusted inputs and generates compact, sanitized prompts, which a separate secure agent then uses to perform privileged operations. Inspired by residual encoding, this task-agnostic framework integrates contextual conditional modeling with controlled information flow, achieving strong security guarantees without compromising task utility. Experimental results demonstrate that the approach significantly outperforms existing baselines on SWE-bench Lite, AgentDojo, and DecodingTrust-Agent benchmarks, effectively mitigating prompt injection attacks while maintaining high task completion rates.

Abstract

Large language model (LLM) agents are vulnerable to security risks, such as prompt injection attacks from untrusted context that manipulate downstream reasoning and tool use. Existing secure-by-design approaches mitigate this risk by separating untrusted observations from privileged execution and careful control of information flow, but often degrade utility and require extensive task-specific engineering. We thus propose Twin Agent, a general privilege separation design pattern inspired by residual coding in the agent context. Twin Agent consists of two nearly symmetric agents: an Explore Agent that inspects untrusted information and a Safe Agent that executes privileged actions. The Explore Agent is conditioned on the Safe Agent's current context and communicates only compact hints to the Safe Agent about the next action to take. This design reduces the information needed to preserve task utility and thus achieves a better security--utility tradeoff, which we empirically verify by measuring how utility and attack success change as the length of hints varies. We evaluate Twin Agent on long-horizon software engineering tasks with SWE-bench Lite and on heterogeneous multi-tool interaction tasks with AgentDojo and DecodingTrust-Agent. Across both benchmarks, Twin Agent preserves high task utility while preventing prompt injection attacks, outperforming both undefended agents and privilege separation baselines.

Problem

• prompt injection attacks
• privilege separation
• security--utility tradeoff
• LLM agents
• untrusted context

Innovation

• Twin Agent
• privilege separation
• context residual compression
• prompt injection defense
• secure LLM agents