@inproceedings{peng-etal-2026-recoveragent,
title = "{R}ecover{A}gent: Intent-Preserving Recovery from Indirect Prompt Injection in Tool-using {LLM} Agents",
author = "Peng, Hanli and
Liu, Ziyao and
Zheng, Yongsen and
Lam, Kwok-Yan",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.830/",
pages = "17596--17612",
ISBN = "979-8-89176-462-0",
abstract = "Tool-using LLM agents execute multi-step tasks by iteratively reasoning and interacting with external tools. However, they are vulnerable to indirect prompt injection (IPI), where adversarial instructions embedded in tool outputs can divert benign user intents into unsafe actions or unintended goals. Existing defenses mainly prioritize reducing unsafe behaviors, while paying limited attention to preserving the original user intent. As a result, safety improvements may come at the cost of interrupting execution or distorting benign task goals. This reveals a key gap in current LLM-agent defenses: the trade-off between safety and intent preservation remains largely underexplored. We propose \textbf{RecoverAgent}, an intent-preserving recovery framework that enables agents to continue execution after detecting unsafe intermediate responses. Instead of terminating the task, RecoverAgent rewrites unsafe responses into safe and executable alternatives while maintaining alignment with the original user intent. Experiments on R-Judge, InjecAgent, AgentHarm, and BadAgent demonstrate that RecoverAgent reduces attack success and harmful behaviors while substantially improving trajectory completion and intent fidelity compared to other defenses under IPI."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="peng-etal-2026-recoveragent">
<titleInfo>
<title>RecoverAgent: Intent-Preserving Recovery from Indirect Prompt Injection in Tool-using LLM Agents</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hanli</namePart>
<namePart type="family">Peng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ziyao</namePart>
<namePart type="family">Liu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yongsen</namePart>
<namePart type="family">Zheng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Kwok-Yan</namePart>
<namePart type="family">Lam</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Tool-using LLM agents execute multi-step tasks by iteratively reasoning and interacting with external tools. However, they are vulnerable to indirect prompt injection (IPI), where adversarial instructions embedded in tool outputs can divert benign user intents into unsafe actions or unintended goals. Existing defenses mainly prioritize reducing unsafe behaviors, while paying limited attention to preserving the original user intent. As a result, safety improvements may come at the cost of interrupting execution or distorting benign task goals. This reveals a key gap in current LLM-agent defenses: the trade-off between safety and intent preservation remains largely underexplored. We propose RecoverAgent, an intent-preserving recovery framework that enables agents to continue execution after detecting unsafe intermediate responses. Instead of terminating the task, RecoverAgent rewrites unsafe responses into safe and executable alternatives while maintaining alignment with the original user intent. Experiments on R-Judge, InjecAgent, AgentHarm, and BadAgent demonstrate that RecoverAgent reduces attack success and harmful behaviors while substantially improving trajectory completion and intent fidelity compared to other defenses under IPI.</abstract>
<identifier type="citekey">peng-etal-2026-recoveragent</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.830/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>17596</start>
<end>17612</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T RecoverAgent: Intent-Preserving Recovery from Indirect Prompt Injection in Tool-using LLM Agents
%A Peng, Hanli
%A Liu, Ziyao
%A Zheng, Yongsen
%A Lam, Kwok-Yan
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F peng-etal-2026-recoveragent
%X Tool-using LLM agents execute multi-step tasks by iteratively reasoning and interacting with external tools. However, they are vulnerable to indirect prompt injection (IPI), where adversarial instructions embedded in tool outputs can divert benign user intents into unsafe actions or unintended goals. Existing defenses mainly prioritize reducing unsafe behaviors, while paying limited attention to preserving the original user intent. As a result, safety improvements may come at the cost of interrupting execution or distorting benign task goals. This reveals a key gap in current LLM-agent defenses: the trade-off between safety and intent preservation remains largely underexplored. We propose RecoverAgent, an intent-preserving recovery framework that enables agents to continue execution after detecting unsafe intermediate responses. Instead of terminating the task, RecoverAgent rewrites unsafe responses into safe and executable alternatives while maintaining alignment with the original user intent. Experiments on R-Judge, InjecAgent, AgentHarm, and BadAgent demonstrate that RecoverAgent reduces attack success and harmful behaviors while substantially improving trajectory completion and intent fidelity compared to other defenses under IPI.
%U https://aclanthology.org/2026.findings-emnlp.830/
%P 17596-17612
Markdown (Informal)
[RecoverAgent: Intent-Preserving Recovery from Indirect Prompt Injection in Tool-using LLM Agents](https://aclanthology.org/2026.findings-emnlp.830/) (Peng et al., Findings 2026)
ACL