Skip to content

PARSE: Provenance-Aware Retrieval Sanitization for Professional Domain LLM Agents

🕒 Published (v1): 2026-06-16 03:29 UTC · Source: Arxiv · Venue: EMNLP 2026 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

PARSE is an inference-time, training-free sanitization pipeline that defends enterprise RAG agents against domain-camouflaged prompt injection in real professional documents. It achieves 15.6% attack success rate (38% reduction vs. 25.4% baseline) while preserving 86.9% utility—the only condition that is both statistically significant and maintains near-baseline utility. The paper also establishes that paraphrasing, the leading synthetic-benchmark defense, shows no statistically significant improvement on real documents (\(p=0.500\)).

Problem

Prompt injection defenses are developed and evaluated on synthetic benchmarks with short, atomic injection scenarios. Real enterprise documents (SEC filings, Federal Register rules, PubMed abstracts, arXiv papers, GitHub postmortems) are longer, denser, and interleave legitimate authority language with factual content—a regime where domain-camouflaged payloads mimic professional vocabulary and evade classifier-based defenses (including Llama Guard 3). No prior benchmark uses actual enterprise documents, leaving practitioners without evidence that lab results predict deployment behavior.

Method

PARSE is a six-step pipeline applied at document ingestion time, requiring no model training—only LLM API calls:

  1. Domain Classifier (Haiku): assigns a domain label (financial, legal, medical, scientific, DevOps) and confidence score; activates domain-specific authority-vocabulary allowlists.
  2. Directiveness Gate (Haiku, runs in parallel with Step 1): scores the document \(\delta(d) \in [0,1]\) for directive content. The routing rule is: $\(\text{route}(d) = \begin{cases} \text{full\_parse} & \text{if } \delta(d) \geq 0.5 \\ \text{simple\_paraphrase} & \text{otherwise} \end{cases}\)$ 59% of real documents score below the threshold and take the lightweight path.
  3. Combined Tagger-Extractor (Haiku, full path only): labels each sentence as factual | directive | hybrid, assigns an injection-likelihood score 0–1 using domain allowlists, and extracts a structured fact list.
  4. Structure-Aware Paraphraser (Sonnet): rewrites the document with tiered aggression (score ≥0.6 → aggressive neutralization; 0.3–0.6 → light rewriting; <0.3 → verbatim), under a hard constraint that all extracted facts appear in the output.
  5. Consistency Checker (Haiku): verifies each extracted fact survives rewriting; triggers one retry of Step 4 with explicit missing-fact constraints if it fails.
  6. Output Builder: returns the sanitized document plus a provenance trace (per-sentence scores, labels, extracted facts, consistency coverage).

Key Contributions

  • Real-document benchmark: 122 tasks across five professional domains using actual SEC EDGAR 10-K filings, Federal Register rules, PubMed RCT abstracts, arXiv cs.AI/LG/CL abstracts, and GitHub postmortems, each paired with a domain-camouflaged injection payload.
  • Synthetic-to-real generalization failure: paraphrasing achieves \(p=0.500\) (\(h=-0.019\)) on real documents despite strong synthetic benchmark performance; confirming even its small apparent effect would require \(n=17{,}253\) tasks.
  • PARSE architecture: directiveness gate concentrating cost on high-risk documents; sentence-level injection scoring with domain allowlists to avoid false positives on legitimate authority language; closed-loop fact-preservation verification.
  • Ablation evidence: parse_fast (single combined call, no multi-step) achieves 32.8% ASR—worse than baseline—confirming the structured multi-step analysis is necessary.

Results

  • PARSE: 15.6% ASR, 86.9% utility (\(p=0.014\), \(h=-0.245\), \(n=122 > n_{\min}=103\); adequately powered).
  • Baseline (no defense): 25.4% ASR, 91.8% utility.
  • Paraphrasing: 24.6% ASR (\(p=0.500\), \(h=-0.019\)), 82.8% utility—null result, 9 pp utility cost, no security benefit.
  • Spotlighting / Sandwiching: 18.9% ASR each, ~91–93% utility; nominally significant (\(p<0.05\)) but underpowered (\(n_{\min}=247\)), do not survive Bonferroni correction (\(\alpha=0.0071\)).
  • Llama Guard: 18.9% ASR (\(p=0.004\), survives Bonferroni), but 64.8% utility—27 pp utility cost, disqualifying for production.
  • parse_fast (ablation): 32.8% ASR (worse than baseline).
  • parse_domain_conditional (ablation): 22.1% ASR (\(p=0.292\), not significant).
  • Per-domain: largest PARSE reductions in financial (33.3% → 12.5%) and DevOps (24.0% → 12.0%).
  • Cost: ~$0.01/document; 59% of documents use only 2 API calls via the directiveness gate.

Limitations

  • Per-domain sample sizes (\(n=23\)–\(25\)) are underpowered for domain-level statistical comparisons; domain results are exploratory only.
  • Task construction uses LLM-generated payloads (claude-sonnet-4-5); human validation of a sample is not yet done.
  • Not evaluated against adaptive adversaries who know the PARSE mechanism and craft payloads to survive structured sanitization.
  • Directiveness gate threshold of 0.5 was tuned on a validation set and may require domain-specific calibration.
  • Per-document cost (~$0.01) may be prohibitive for very large corpora without caching.
  • CommandSans is not evaluated against domain-camouflaged payloads, so direct comparison is incomplete.

Relevance to Agentic AI / LLM Agents

Prompt injection via retrieval is a primary attack vector against RAG-based LLM agents, and PARSE directly targets the most dangerous variant—domain-camouflaged injection that evades existing defenses by mimicking professional vocabulary. The paper's benchmark reveals a critical failure mode: defenses validated on synthetic data do not protect real enterprise agents, a finding that should inform how security is evaluated for any production agentic system handling untrusted retrieved content. The directiveness gate and provenance trace are architecturally reusable components for agent pipelines requiring both security and faithful knowledge retrieval. The work also establishes that utility must be a first-class metric alongside ASR when deploying defensive components in agents, since a defense that cripples retrieval quality is not deployable.