SAVOR: One-Shot Indirect Prompt Injection via Offline Strategy Distillation

Technical Analysis

SAVOR embeds malicious instructions in external content (e.g., tool outputs, documents, web pages) that an LLM agent ingests during tool use, the classic indirect prompt injection entry point. Instead of iteratively querying and refining payloads against a live target (which is often infeasible for real attackers), SAVOR distills a reusable 'strategy memory' offline from outcome-conditioned reflection over successful/failed injection trajectories collected in disjoint training environments. At attack time, this frozen memory generates a single payload tailored to context, requiring only one interaction with the unknown target and no feedback loop, and the paper shows this generalizes across held-out tools, held-out attack goals, and even across different defenses. The attacker's gain is a higher success rate for hijacking agent goals/actions via poisoned observations, crossing the boundary between untrusted external data and the agent's decision-making/tool-invocation logic without needing white-box access or repeated probing.

Affected Systems

Agent Security Bench, OpenClaw-IPI (benchmark introduced in paper)

Detection Signatures

• Anomalous or unexpected imperative instructions embedded within tool outputs, retrieved documents, API responses, or web content consumed by an agent
• Instructions that reference agent internal state, goals, or subsequent tool calls not relevant to the ostensible content
• Sudden divergence between agent's stated task and tool invocation sequence following ingestion of external content
• Repeated single-shot injection attempts against agents from previously unseen or low-reputation external content sources
• Payloads with unusually generic/adaptive phrasing suggestive of distilled, reusable attack templates rather than target-specific crafting

Remediation Steps

1. 1

   Isolate and sanitize external content

   Treat all tool outputs, retrieved documents, and third-party data as untrusted; strip or neutralize embedded imperative language before it reaches the agent's context window.

2. 2

   Enforce instruction provenance separation

   Architecturally separate system/developer instructions from external observation data (e.g., via structured prompting, delimiters, or dedicated data channels) so the model can distinguish trusted directives from untrusted content.

3. 3

   Deploy defense-in-depth detection

   Use multiple layered defenses (input classifiers, output monitoring, anomaly detection on tool-call sequences) since the paper shows learned attack strategies transfer across single defenses.

4. 4

   Limit high-impact tool actions without confirmation

   Require human-in-the-loop approval or additional verification for sensitive or irreversible tool actions triggered after processing external content.

5. 5

   Red-team with strategy-transfer attacks

   Incorporate outcome-conditioned/strategy-distillation style attacks (like SAVOR) into internal red-team evaluations rather than only iterative white-box attacks, since single-query black-box attacks are now shown to be highly effective.

6. 6

   Monitor for cross-defense generalization

   Do not rely on a single injection defense mechanism; validate that defenses remain effective against strategies learned under other defenses, as the paper demonstrates transferability.