SIA-GUARD: SESSION-AWARE ACTION CONTROL FOR LLM AGENTS AGAINST PROMPT-INJECTION ATTACKS

Abstract

The paper presents an overview of the development and experimental evaluation of SIA-GUARD, a security filter for LLM agents that accounts for session context and controls the execution of actions involving external tools. The study addresses the escalation of prompt-injection risks from the level of malicious textual prompts to the level of actions performed on files, corporate records, and business processes. Such actions may include reading files, exporting customer records, modifying customer data, writing malicious reports, or executing unauthorized financial transactions. The proposed SIA-GUARD filter is positioned between the LLM agent and the model API, as well as between the agent and MCP-like tool servers. SIA-GUARD maintains a unified chronological record of each session, labels outputs from untrusted tools as potentially malicious, applies deterministic policies to high-risk data sources, removes or masks leakage-detection control markers, and may employ an auxiliary LLM to assess ambiguous tool actions or identify underlying intent. A demonstration environment was developed for the experimental evaluation, comprising a document server, a file server, and a business-data server. A test set of 25 prompts was also constructed: four legitimate prompts for measuring false-positive rates and 21 adversarial prompts. The latter included hidden malicious instructions embedded in HTML, Markdown, and PDF content; obfuscated messages; malicious data embedded in external tools or APIs, commonly referred to as tool poisoning; concealed calls encoded in data schemas; cross-session persistence mechanisms; and attempts to pressure the agent into exporting or modifying data. The study evaluated 1,050 paired records: 525 records generated in an unprotected baseline configuration, with three repetitions of each of the 25 prompts across seven locally deployed models, and 525 corresponding records generated in the protected configuration using SIA-GUARD. In addition, 525 paired records were analyzed in an ablation study in which individual filter components were disabled in turn, thereby isolating the contribution of specific protection mechanisms for the qwen/qwen3-coder-next model. In the multi-model evaluation, the protected configuration prevented all leakage of the designated control markers, whereas the unprotected baseline produced 63 leakage incidents across 525 records. In the unprotected configuration, the models proceeded to carry out unsafe actions, while the SIA-GUARD-protected configuration either blocked the risky action or routed it for review in 88.3% of cases. The findings demonstrate the high effectiveness of execution-time security controls for LLM-agent actions as a practical complement to prompt-level defenses. This approach substantially reduces the number of successful attacks at the agentic level while preserving a useful degree of automation.