StateFence
A task-aware defense framework for LLM agents that treats critical outputs as protected states and routes defense strategies according to the state under attack, defending against evidence-chain contamination caused by indirect prompt injection.
Timeline (last 90 days)
The paper names a failure mode evidence-chain contamination of protected task state, whose core insight is that whether a suspicious string is dangerous depends on the task itself.
StateFence is a task-aware evaluation and defense framework that treats four types of output—severity labels, incident narratives, response strategies, and IOC sets—as protected state.
StateFence's defense is not enabled globally but routed according to the state under attack: whichever state the attacker tries to tamper with is the state on which the defense takes effect.
StateFence maps indirect prompt injection attacks into four SOC evidence attack forms: explicit attacks, stealthy attacks, multi-hop attacks, and persistent attacks.
The paper tests StateFence on controlled SOC cases and public SOC validation cases, and the results show that the framework reduces the attack success rate and decreases the failure types that depend on evidence contamination, while task utility is preserved.
The limitation of the StateFence paper is that experiments are concentrated in SOC scenarios, and whether it applies to blue-team tasks in other domains still needs verification; moreover, the defense effectiveness against multi-hop and persistent attacks depends on the completeness of trace recording, and the overhead and coverage in actual deployment are issues that need attention going forward.
All Facts (6)
The paper names a failure mode evidence-chain contamination of protected task state, whose core insight is that whether a suspicious string is dangerous depends on the task itself.
50%UnverifiedStateFence is a task-aware evaluation and defense framework that treats four types of output—severity labels, incident narratives, response strategies, and IOC sets—as protected state.
50%UnverifiedStateFence's defense is not enabled globally but routed according to the state under attack: whichever state the attacker tries to tamper with is the state on which the defense takes effect.
50%UnverifiedStateFence maps indirect prompt injection attacks into four SOC evidence attack forms: explicit attacks, stealthy attacks, multi-hop attacks, and persistent attacks.
50%UnverifiedThe paper tests StateFence on controlled SOC cases and public SOC validation cases, and the results show that the framework reduces the attack success rate and decreases the failure types that depend on evidence contamination, while task utility is preserved.
50%UnverifiedThe limitation of the StateFence paper is that experiments are concentrated in SOC scenarios, and whether it applies to blue-team tasks in other domains still needs verification; moreover, the defense effectiveness against multi-hop and persistent attacks depends on the completeness of trace recording, and the overhead and coverage in actual deployment are issues that need attention going forward.
50%