Source: arXiv — 2026-08-04
Summary
Researchers (Shihao Weng, Yang Feng, Xiaofei Xie, Jiongchi Yu) propose AgentAntibody, a defense for LLM agents against prompt injection modeled on biological adaptive immunity. Instead of treating every task as a self-contained problem, the system builds a persistent library of "antibodies" — learned representations of the user's security boundary — that accumulate across encounters, so the agent gets progressively harder to trick the more attacks it sees. Reported results show it sharply outperforms the best existing baselines cold-start and continues improving with repeated exposure to attacks.
Key Takeaways
- Core mechanism: a persistent, self-evolving library of "antibodies" that encode the agent's learned understanding of what counts as an authorized instruction versus an injected one — carried across tasks rather than reset each time, unlike most existing defenses.
- Cold-start performance: 81.1% macro SU-HM versus 36.6% for the strongest baseline — more than double the next-best defense before any adaptive learning even kicks in.
- On the AgentDyn dynamic-environment benchmark, AgentAntibody reaches 68.6%, a 27.2 percentage-point improvement over the best baseline, and 95.7% in the latent-boundary setting.
- Adaptive learning effect: cumulative attack success rate drops from 35.0% after 5 attacks to 6.1% after 80 attacks, with an average of only about 2.44 antibodies stored — a small, efficient library rather than unbounded memory growth.
- The immune-system framing is more than a metaphor here: the system behaves like real adaptive immunity, generalizing from a handful of "antigen" exposures (attacks) to build lasting resistance, rather than requiring a rule for every possible attack variant.
Reel Script
Hook (~17s, 38 words) Most prompt injection defenses forget everything the moment a task ends. Attack them the same way twice and they fall for it twice. This new defense remembers — and after eighty attacks, it's blocking over 93% of them.
Core Concept (~70s, 160 words) Prompt injection is when an attacker hides instructions inside data an AI agent reads — a webpage, an email, a file — hoping the agent follows the hidden instruction instead of the user's actual request. Most defenses today treat every task like it's the first time they've ever seen an attack. No memory, no learning, just a static filter.
AgentAntibody borrows straight from biology. Your immune system doesn't relearn what a virus looks like every time you get sick — it keeps antibodies around from past infections so it responds faster next time. This system does the same thing for prompt injection: every time it encounters and successfully resists an attack, it distills what it learned into a small stored "antibody" — basically a compressed lesson about where the user's real security boundary sits. Next time a similar or related attack shows up, it doesn't start from zero.
Hands-On (~55s, 135 words) The numbers back it up. Right out of the gate, before any learning happens, AgentAntibody hits 81.1% on their macro success metric — more than double the best existing baseline's 36.6%. On a benchmark called AgentDyn, which tests dynamic real-world-style agent environments, it scores 68.6%, over 27 points ahead of the next best defense, and climbs to 95.7% in what they call the latent-boundary setting.
But the standout number is the learning curve. After 5 attacks, the cumulative attack success rate is 35%. After 80 attacks, it's down to 6.1%. And it gets there storing an average of just 2.44 antibodies — this isn't hoarding every attack it's ever seen, it's generalizing efficiently.
Takeaway (~24s, 56 words) Static prompt-injection filters are already a losing game against adaptive attackers. A defense that actually learns and compounds its resistance over time is the right direction, and these numbers are the real deal, not marketing. If you're deploying agents on untrusted data, this line of research is worth tracking closely.