What they did

SPA calls an LLM planner once per query to produce a complete executable plan in a declarative domain-specific language. During execution, a dual-lattice information-flow system tracks both confidentiality—where sensitive data may flow—and integrity—whether data is sufficiently trustworthy—including flows created by control decisions.

For reuse across queries, execution results are stored as labeled artifacts. Later planning receives semantic metadata rather than the underlying potentially malicious content. The authors evaluated the architecture on AgentDojo and AgentDojo-MQ, their extension for persistent state reuse and delayed attacks.

Key findings

• Under the “tool_knowledge” attack, SPA with information-flow control reduced attack success to 0% on AgentDojo.
• On the multi-query AgentDojo-MQ benchmark, attack success was 0.2%, indicating that the protections largely carried across persistent state reuse.
• Label-preserving artifacts allowed later queries to use prior results without exposing their untrusted payloads directly to the planner.
• Strict integrity enforcement introduced a security–utility tradeoff, rejecting some behavior that could otherwise help complete tasks.

Why it matters

Persistent agents expand the attack surface beyond a single prompt or tool call: malicious content can influence later decisions through stored state. SPA shows that securing the entire planning-and-execution pipeline, while preserving trust labels across queries, can sharply constrain this class of attack rather than treating each interaction in isolation.

Caveats

The abstract reports results for one named attack setting and does not provide detailed utility scores, model configurations, baseline comparisons, or performance overhead. The near-zero attack rates therefore should not be read as protection against all prompt-injection strategies, and the practical cost of strict integrity policies remains an open question.