NeurIPS 2025

DRIFT: Dynamic Rule-Based Defense with Injection
Isolation for Securing LLM Agents
Hao Li1, Xiaogeng Liu2, Hung-Chun Chiu3, Dianqi Li3, Ning Zhang1, Chaowei Xiao2
1Washington University in St. Louis, 2Johns Hopkins University
3Independent Researcher
{li.hao, zhang.ning}@wustl.edu, cxiao13@jh.edu
Abstract
Large Language Models (LLMs) are increasingly central to agentic systems due
to their strong reasoning and planning capabilities. By interacting with external
environments through predefined tools, these agents can carry out complex user
tasks. Nonetheless, this interaction also introduces the risk of prompt injection
attacks, where malicious inputs from external sources can mislead the agent’s
behavior, potentially resulting in economic loss, privacy leakage, or system com-
promise. System-level defenses have recently shown promise by enforcing static
or predefined policies, but they still face two key challenges: the ability to dy-
namically update security rules and the need for memory stream isolation. To
address these challenges, we propose DRIFT, a Dynamic Rule-based Isolation
Framework for Trustworthy agentic systems, which enforces both control- and
data-level constraints. A Secure Planner first constructs a minimal function trajec-
tory and a JSON-schema-style parameter checklist for each function node based
on the user query. A Dynamic Validator then monitors deviations from the original
plan, assessing whether changes comply with privilege limitations and the user’s
intent. Finally, an Injection Isolator detects and masks any instructions that may
conflict with the user query from the memory stream to mitigate long-term risks.
We empirically validate the effectiveness of DRIFT on the AgentDojo and ASB
benchmark, demonstrating its strong security performance while maintaining high
utility across diverse models—showcasing both its robustness and adaptability. The
code is released at https://github.com/SaFoLab-WISC/DRIFT.
1
Introduction
Large Language Models...