StateFence: Safeguarding Task State for Blue-Team LLM Agents Against Evidence-Chain Contamination

When the SOC Meets Indirect Prompt Injection

Blue-team LLM agents are becoming a common role in the SOC (Security Operations Center): they read alerts, extract IOCs, generate incident summaries, and recommend response actions. But this also opens a new attack path—indirect prompt injection. Attackers don't need to talk to the model directly; they simply hide malicious instructions in telemetry data, tickets, retrieval results, or memory, and the model may treat them as legitimate input and propagate them step by step in subsequent reasoning.

This paper names this failure mode evidence-chain contamination of protected task state. Its core insight is that whether a suspicious string is dangerous depends on the task itself. The same piece of text might be a malicious control instruction that must be stripped out in a summarization task, yet a key piece of evidence in an IOC extraction task. Simply "filter everything" harms evidence, while indiscriminate trust introduces contamination.

Indirect Prompt Injection is a class of attack relative to direct prompt injection. In direct injection, attackers write content like "ignore the above instructions" directly into the conversation input; indirect injection pre-embeds malicious instructions in external data the model will later read—web pages, documents, emails, ticket fields, retrieval corpus entries, or even the agent's long-term memory. When an LLM application is designed to "read this data and act on it," the instructions in the data get mixed into the same context as the user's real instructions, and the model often struggles to distinguish which part is "content" and which part is "command." In SOC scenarios, alert descriptions, log fields, and threat-intelligence summaries typically come from external or semi-trusted sources, naturally forming carriers for indirect injection—which is the root of this risk for blue-team LLM agents.

IOC (Indicator of Compromise) refers to observables that can identify signs of intrusion, with common types including malicious IP addresses, domains, URLs, file hashes (MD5/SHA-256), registry keys, process names, and so on. SOC analysts and automated tools extract IOCs to correlate alerts, query intelligence databases, and drive blocking actions. What makes IOC extraction special is that the more suspicious a string is—the more it looks like an attack artifact—the more likely it is to be genuinely valuable evidence. This directly conflicts with the defensive instinct to "filter suspicious content," and it is precisely the concrete manifestation of task dependence in the evidence-chain contamination problem.

StateFence's Design Approach: State Protection Rather Than Blanket Filtering

StateFence is a task-aware evaluation and defense framework. It treats four categories of output as protected state: severity labels, incident narratives, response strategies, and IOC sets. Defense is not enabled globally but routed according to the state under attack—whichever state an attacker tries to tamper with, defense takes effect on that state.

This design directly addresses the task-dependence challenge. The framework maps indirect prompt injection attacks into four SOC evidence attack forms: explicit attacks, stealthy attacks, multi-hop attacks, and persistent attacks. Each form corresponds to different propagation paths and observable traces; StateFence records these traces and selects defense strategies accordingly.

Distinguishing the Four Attack Forms

Explicit attacks are easy to identify, while stealthy attacks disguise malicious instructions as normal data formats; multi-hop attacks exploit multiple intermediate steps to gradually corrupt state; persistent attacks attempt to write contamination into memory, affecting subsequent tasks. StateFence's value lies in not assuming attacks have only one face, but preserving trackable propagation clues for each type of attack.

Multi-hop attacks borrow the idea of multi-hop reasoning: attackers don't expect a single malicious text to directly change the final conclusion, but instead let contamination pass level by level through several intermediate steps. A typical chain is "telemetry field contamination → distorted alert summary → shifted incident narrative → misjudged response strategy," where each hop in isolation looks like reasonable inference, and only tracing back the entire evidence chain reveals the anomalous source. The observability of such attacks depends on whether intermediate states are recorded, so defenders need to leave traces at every state transition point.

Persistent attacks target the agent's memory mechanism. When an LLM agent has cross-session long-term memory or task-state caching, attackers can write malicious instructions into memory entries that will be repeatedly recalled, keeping them effective across multiple subsequent unrelated tasks—achieving "one contamination, long-term residence." Compared with injection within a single session, persistent attacks have a longer detection window and higher cleanup cost, often requiring source verification and lifecycle management for memory writes rather than just filtering inputs.

Experimental Validation: Reducing Attack Success Rate While Preserving Task Utility

The paper tested StateFence on controlled SOC cases and public SOC validation cases. Results show that the framework reduces the attack success rate and decreases the types of failures that "only surface after evidence has been contaminated." On the other side, task utility is preserved, and metric losses caused by task-mismatched filtering are avoided—that is, evidence that should be retained is not mistakenly deleted.

The key trade-off here is that security defense cannot come at the expense of detection capability. If, to block injection, all suspicious strings needed for IOC extraction are filtered out, blue-team agents lose their ability to discover threats. StateFence attempts to strike a balance between the two through task-aware routing.

Task utility here refers to the agent's ability to perform its own job, typically measured by metrics such as detection recall, IOC extraction accuracy, incident summary quality, or response recommendation correctness. There is a structural tension between security defense and task utility: over-sanitizing inputs raises the attack-blocking rate but may delete genuine threat evidence, leading to missed detections; relaxing filtering preserves detection capability but gives injection an opening. Therefore, when evaluating such defense frameworks, both attack success rate and task utility metrics must be reported; looking only at the former masks the cost of "trading detection capability for security." StateFence's experimental design is built precisely around this pair of metrics.

Implications for Blue-Team Agent Design

This research sends a clear signal: robust blue-team LLM agents cannot rely solely on input sanitization but need mechanisms to protect task-critical state under untrusted evidence. Specifically, states need to be explicitly defined and isolated, defense strategies need to be bound to task objectives, and propagation traces need to be observable.

For teams bringing LLMs into security operations, this means considering at the architecture design stage: which intermediate decisions constitute protected state? When evidence sources are untrusted, how do you determine whether a string is a control instruction or key evidence? StateFence provides a reference framework, but more fundamental is the idea of task-state protection—drawing the security boundary on state rather than on input.

The paper's limitation is that experiments focus on SOC scenarios, and whether it applies to blue-team tasks in other domains remains to be verified. In addition, the defense effectiveness against multi-hop and persistent attacks depends on the completeness of trace recording; the overhead and coverage in actual deployment are issues that warrant attention going forward.

One-line Summary

StateFence uses task-aware state protection to defend blue-team LLM agents against indirect prompt injection and evidence-chain contamination.

Paragraph Summary

The article discusses the risk of indirect prompt injection facing blue-team LLM agents in the SOC: attackers hide malicious instructions in telemetry, tickets, retrieval results, or memory, causing the model to treat them as legitimate input and propagate them level by level—what the paper calls evidence-chain contamination. Its core insight is that whether the same string is dangerous depends on the task—a suspicious string in IOC extraction may be key evidence, while in a summarization task it may be a control instruction—so "blanket filtering" is not viable. Based on this, StateFence defines severity labels, incident narratives, response strategies, and IOC sets as protected state, routes defense according to the attacked state, and maps attacks into four forms—explicit, stealthy, multi-hop, and persistent—recording propagation traces. Experiments show it reduces attack success rate and delayed failures while preserving task utility. The article concludes by arguing that the security boundary should be drawn on state rather than input, and notes scenario limitations and trace-recording overhead.