AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection

2026-08-04

AI Summary

This work addresses the vulnerability of large language model (LLM) agents to prompt injection attacks, particularly when task descriptions are ambiguous and existing defenses struggle to learn user-defined safety boundaries from historical interactions. Inspired by adaptive immune mechanisms, the paper proposes the first self-evolving immune system for LLMs, comprising a persistent “antibody” repository, a runtime threat detection and response module, and an antibody evolution strategy driven by user feedback. This framework enables dynamic learning of safety boundaries and cross-task knowledge transfer. Evaluated across three benchmarks and four mainstream LLMs, the approach effectively blocks harmful behaviors while maintaining high legitimate task completion rates, significantly outperforming current defense methods—especially in challenging scenarios where both benign and malicious actions conform to the stated task description.

Abstract

Prompt injection remains a critical threat to LLM agents, yet existing defenses treat each task as a self-contained problem, independent of previous encounters. In practice, user requests are often underspecified: they describe the desired outcome without fully specifying acceptable behavior. An injection can exploit this ambiguity, causing the agent to complete the task in a way the user would reject. As the user's expectations become clearer through concrete cases, a defense should learn from each encounter and apply what it learns to the next. Inspired by adaptive immunity, we propose AgentAntibody, which equips LLM agents with a self-evolving immune system against prompt injection. AgentAntibody represents its evolving understanding of the user's security boundary as a persistent library of antibodies. At runtime, the library recognizes threats to this boundary and mounts corresponding immune responses. Across encounters, it evolves to strengthen the agent's immunity to future attacks. Extensive experiments across three benchmarks and four backbone LLMs show that, by learning the user's boundary through experience, AgentAntibody outperforms existing defenses in preventing harmful actions while preserving legitimate task completion, even when the harmful and legitimate actions are both compatible with the stated task.

Problem

• prompt injection
• LLM agents
• adaptive immunity
• security boundary
• user expectations

Innovation

• prompt injection
• adaptive immunity
• LLM agents
• antibody library
• security boundary