Twin Agent compresses context to blunt prompt injection
Twin Agent splits duties: one Large Language Model explores untrusted input, the other executes privileged actions, with only short “hints” crossing the boundary. On benchmarks, it keeps task performance while slashing prompt-injection success to near zero in static tests. Adaptive, multi-turn copy-and-paste attacks still slip through occasionally.
Most agent vendors say they separate the dirty world from the clean one. Few show their working. Twin Agent does. It treats prompt injection as an information-flow problem: compress the risky bits until there’s not enough juice to subvert your tools.
The design is simple enough to steal. Two near-symmetric agents. The Explore Agent reads untrusted inputs. The Safe Agent holds the keys and pushes buttons. Explore sees Safe’s current context and replies with a compact “hint” about the next action. That hint is short on purpose, run through a detector, and truncated or blocked if it breaches a tight budget. Typical budgets in the paper were 100 characters for most tasks and 200 for a more tool-heavy setup.
On three benchmarks that matter for agents with teeth — SWE-bench-injected (derived from SWE-bench Lite), AgentDojo, and DecodingTrust-Agent — this compression trick pays off. Against non-adaptive attacks, attack success rates drop to almost zero while task performance holds steady or nudges up compared with an undefended agent. A plan-first baseline in the CaMeL style kept things safe but bled utility. Kill the hints entirely and the Safe Agent drifts off course on iterative work. Small budgets aren’t free: cost roughly doubles versus baseline in the 50–100 character range.
The fun part is where it bends. In an adaptive two-phase test, single-turn payloads bounced off the Safe Agent with 0.0% success. But a multi-turn copy-and-paste move that coerced the Explore Agent to forward malicious content produced a 4.7% success rate in one run. Reruns washed that out, which tells you the risk is stochastic, not mythical.
If I were red‑teaming this, I’d aim squarely at the hint channel. Split a payload across turns. Hide intent in seemingly relevant “residual” guidance. Nudge the Explore Agent into relaying content verbatim. Play with phrasing to dodge the detector, which is filtering at the hint boundary, not at source. The authors’ own results show a tight coupling: increase hint length and both utility and attack success climb. That knob will be tempting to product teams under pressure.
The paper is honest about limits: no formal guarantees, a narrow eval set, and an assumption that short injections are hard against frontier models. Copy-and-paste or supply-chain style control of the Explore Agent remains potent. Non-determinism means repeat tries may pay off. The idea of “context residual compression” lands well; the open question is how often real deployments can keep the budget tight without users shouting for more.
Security by compression isn’t a silver bullet, but here it’s more than a slogan. The evidence is solid for static threats, and the attack path to watch is the Explore–Safe seam where hints turn into actions.
Additional analysis of the original ArXiv paper
📋 Original Paper Title and Abstract
Twin Agent: Context Residual Compression for Privilege Separated Agents
🔍 ShortSpan Analysis of the Paper
Problem
This paper studies prompt injection against large language model agents that must process untrusted inputs while performing privileged actions such as code execution, filesystem writes or API calls. Existing secure-by-design patterns separate untrusted observations from privileged execution but often reduce utility or require heavy task-specific engineering. The work asks whether a general privilege separation design can limit information flow while keeping long-horizon, adaptive agent behaviour intact.
Approach
Twin Agent is a privilege-separated architecture composed of two near-symmetric agents: an Explore Agent that inspects untrusted inputs and a Safe Agent that performs privileged actions. The Explore Agent is conditioned on the Safe Agent's current interaction history and transmits only compact, task-relevant residual hints that are intended to reduce the Safe Agent's uncertainty about its next action. The hint channel has a tunable length budget and each hint is run through a prompt-injection detector and truncated or blocked if it exceeds the budget. Twin Agent is instantiated on three benchmarks: long-horizon software engineering tasks (SWE-bench-injected, derived from SWE-bench Lite), and heterogeneous multi-tool environments (AgentDojo and DecodingTrust-Agent). Typical hint budgets used in experiments were 100 characters for SWE-bench-injected and DecodingTrust-Agent and 200 characters for AgentDojo.
Key Findings
- Twin Agent achieves a markedly better security-utility trade-off than undefended agents and strict privilege-separation baselines: it preserves much of original task utility while substantially reducing attack success rates (ASR), often to near zero in non-adaptive tests.
- Under non-adaptive attacks on the evaluated benchmarks, Twin Agent reduced ASR to almost 0.0% while maintaining or slightly improving utility relative to the baseline agent; CaMeL-style plan-first defences showed significant utility degradation in the same setup.
- An adaptive two-phase attack using an optimisation procedure showed the Safe Agent resisted single-turn adaptive payloads with ASR 0.0%, but a multi-turn copy-and-paste attack that forced the Explore Agent to forward malicious payloads produced an overall ASR of 4.7% in one run; these failures were stochastic and reruns eliminated observed successes in that sample, indicating non-deterministic risk.
- Increasing the hint budget improves utility but also increases ASR, supporting the view that secure agent communication is fundamentally a compressed information-flow problem. At small budgets (50 to 100 characters) the defended agent cost about twice that of the baseline per instance.
- Hints help preserve the original reasoning trajectory; a no-hint Safe Agent deviates substantially and performs worse on tasks that require iterative feedback.
Limitations
Evaluations cover a limited set of domains and static attacks; Twin Agent provides no formal security guarantees and relies on the assumption that short injections are hard to mount against frontier models. The Explore Agent can be fully compromised by a copy-and-paste style attack and occasional stochastic failures were observed in adaptive multi-turn scenarios. Deployment incurs extra cost and latency.
Implications
From an offensive perspective, the primary attack surface becomes the hint channel and the Explore-Safe boundary. An attacker who can craft longer hints, evade the detector, or coerce the Explore Agent to forward payloads may induce privileged actions. Copy-and-paste or supply-chain injections that directly control the Explore Agent are especially effective. Adaptive attacks that exploit model non-determinism, hint-budget increases, or weaknesses in hint filtering could raise ASR. Threat modelling should therefore focus on securing the hint channel, hardening the Explore Agent against manipulation, and addressing stochastic execution failures.
