Show HN: A deterministic tool-call gateway vs. prompt-injection classifiers (github.com)

A new study led by Yehiel Amor introduces a deterministic tool-call gateway designed to thwart prompt-injection attacks in AI agents, evaluated within the AgentDojo framework. Unlike traditional classifiers that attempt to detect malicious instructions, this gateway focuses solely on tracking the origin of values in a tool call. It successfully blocked 99.3% of hijacked attacks during testing, demonstrating remarkable resilience against various obfuscation techniques—including backward text, base64 encoding, and even translations—while traditional classifiers fell short, frequently flagging legitimate tasks and failing to identify cleverly disguised injections. This architecture could reshape the AI/ML security landscape by emphasizing provenance over detection. The gateway's implementation does come with trade-offs, requiring human approval for a significant percentage of legitimate tasks, highlighting ongoing challenges in balancing security with usability. Additionally, issues arise when known counterparties are involved, reducing the stop rate significantly, underscoring the need for a robust strategy in developing such systems. Overall, this research pushes the boundaries of AI security architecture, urging a shift from reactive detection systems to proactive provenance-based solutions that could enhance the integrity of AI interactions.