Provenance-Based Pre-Action Authorization for LLM Agents: A Structural Defense Evaluated on AgentDojo with AgentLock

Large language model agents are vulnerable to indirect prompt injection: content they read can redirect the tools they call. We study provenance-based pre-action authorization, the defense implemented in AgentLock, which never inspects tool-call content and instead gates consequential actions on the lineage of what is already in the session specifically, whether untrusted-provenance content preceded the action. Evaluated on the AgentDojo benchmark, the mechanism achieves 0% defense-effective attack success on the write-trailing-read threat models of the banking and workspace suites across two models (GPT-4o-mini and GPT-4o), and, on banking, utility rises (31.25%→37.50%) under the identical gate as the model improves. We characterize the boundary of the mechanism structurally rather than empirically: attacks split into value-carrying (malice in a parameter value, caught cheaply by per-value lineage) and value-free (malice in the action itself, e.g. “add then remove user Fred”, where every parameter is an innocent common token) the latter is provably outside per-value lineage’s reach and requires session-taint enforcement. A six-condition ablation on the slack suite makes this concrete: among parameter-lineage-equipped configurations, the one with no session-taint enforcement is the only one in which attacks genuinely execute (5.71% real attack success), and it is also the only one that recovers utility (4×: 20.00% vs the 4.76% write-gate floor). We state the utility cost plainly: under correct authority classification the slack write-gate is deny-by-default and floors utility at 4.76%. We also report a benchmark scoring artifact (a checker
whose blocked-but-attempted calls score as successes) that can invert the measured ranking of two defenses, and we present official alongside defense-effective attack success wherever artifacts exist. All top-line claims are scoped to AgentDojo; single-benchmark external validity is an explicit limitation.

SHA-256 (this PDF):
9041a7befc10a1ec777e14089656b24567fbb6615ca38dd1bf18a6f18de40cbe