Improved Robustness against Indirect Prompt Injection Can Be Built into LLMs

Abstract

Large language model (LLM) agents act on inputs users do not control, including tool returns, retrieved documents, and messages. Indirect prompt injection embeds instructions in these channels to redirect an agent toward unintended actions. The same tool call may be appropriate for one task and harmful for another, making this threat difficult to address with input-level defenses alone. We ask whether robustness against indirect prompt injection can be built into the LLM itself, and instantiate this idea with Odile, a low-rank adapter trained on paired benign and harmful traces generated by the base model. Odile is designed to convert attacker-directed trajectories into a no-action state before a valid malicious tool call is produced, while preserving ordinary behavior on benign inputs. In matched evaluations, this single model-level defense matches or improves upon the security–utility tradeoffs of prompt hardening, runtime detection and rewriting, and prior fine-tuning defenses. Across three prompt-injection benchmarks, eight model backbones, and two defense-aware adaptive settings, Odile consistently reduces attack success while retaining benign behavior and ordinary model capability. It transfers from a compact training dataset to longer trajectories, different tool interfaces, mixture-of-experts models, and hybrid attention architectures. We release Odile at https://github.com/memo-ozdincer/odile