Skip to content

Untrusted Content Masking for Web Agents with Security Guarantees

🕒 Published (v1): 2026-07-06 16:22 UTC · Source: Arxiv · link

Why this paper was selected

Formal security guarantees against prompt injection for web agents; Jagielski (Google); directly buildable

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

UCM (Untrusted Content Masking) is a defense that restores the trusted/untrusted content boundary in web agents by redacting untrusted DOM elements before they reach the agent and routing all queries about untrusted content through a type-constrained Quarantined Model (Q-Model). This eliminates prompt injection attack surface by construction rather than detection. Evaluated on three frontier models across 10 custom websites and WebArena GitLab, UCM achieves 0% attack success rate with utility preserved at 1.05×–1.84× cost overhead.

Problem

Web agents (e.g., Claude Computer Use, OpenAI Operator) observe rendered pages that structurally intermingle trusted content (navigation, official listings) with untrusted content (user reviews, comments, ads). This entanglement destroys the trust boundary on which provable prompt injection defenses depend. Heuristic defenses provide no formal guarantees; existing guaranteed defenses either blind the agent entirely to page content or require costly per-site typed API infrastructure, sacrificing utility or scalability.

Method

UCM operates at the DOM level before page rendering reaches the agent:

  1. Boundary labeling: Trusted vs. untrusted DOM elements are identified either via hand-labeled CSS selectors (15–30 per site for an active honest owner) or via an LLM operating on content-sanitized HTML for automated boundary inference (passive honest owner case).
  2. Masking: Untrusted DOM nodes are replaced with labeled placeholders (e.g., id: product-review-1) preserving structural context but eliminating adversarial text from the agent's context window.
  3. Quarantined Model (Q-Model): When the agent needs to reason about untrusted content, it issues a structured query: (element_id, natural-language question, return_type ∈ {bool, int, float, date, enum}). The Q-Model reads the actual hidden content and returns a type-parsed response. Since type-constrained outputs cannot carry free-form text, injected instructions cannot propagate back to the agent's control flow.
  4. String fallback: For tasks requiring free-form string output, the agent declares the task unsolvable; the user is then offered a Q-Model string response for explicit approval before it enters the agent's context.

The framework is compatible with standard ReAct-loop agents without requiring commitment to a pre-execution plan.

Key Contributions

  • Defense design: UCM provides a constructive security guarantee—the agent never processes untrusted content, eliminating the attack surface regardless of injection sophistication.
  • Evaluation suite: 10 custom website environments across banking, email, e-commerce, forum, travel, etc. (50 tasks each: 5 untrusted-not-required + 5 untrusted-required), plus the 41-task WebArena GitLab suite.
  • Empirical validation: 0% ASR against strengthened WASP attacks across all tested configurations.
  • Automated boundary inference: LLM-based trust-boundary detection on content-sanitized HTML, with high agreement to human annotations on Booking.com, Reddit, and GitLab—enabling deployment without per-site manual labeling.
  • Attack surface analysis: Formal characterization of control-flow and data-flow attack strategies against UCM and why each is bounded.

Results

  • Utility: Preserved across all three agents (Claude Sonnet 4.5, Claude Sonnet 4.6, GPT-5.4) on both untrusted-not-required and untrusted-required task groups; full utility recovery on WebArena GitLab with the string-fallback extension.
  • Cost overhead: 1.05×–1.84× median cost per task (API prices with prompt caching, May 2026); overhead is higher for untrusted-required tasks due to Q-Model calls.
  • Model scaling: Claude Sonnet 4.6 incurs larger relative overhead but lower absolute cost than Sonnet 4.5, suggesting overhead decreases as models improve.
  • Efficiency gain: ~15% of tasks are cheaper under UCM due to reduced visual clutter enabling more direct navigation.
  • Security: 0% attack success rate on strengthened WASP attacks (full results in appendix).
  • Boundary inference: High human-agreement on Booking.com, Reddit, GitLab (quantitative figures cited in Section 7, not detailed in excerpt).

Limitations

  • Trust anchor requirement: Guarantees require an honest site owner; visiting an outright malicious site remains unsafe regardless of UCM (active-content/XSS vulnerabilities are explicitly out of scope).
  • Data-flow attacks not fully prevented: Attackers controlling a substantial fraction of pooled untrusted inputs (e.g., reviews) can skew aggregated assessments; single-value corruption (returning well-typed but wrong values) is also possible when the attacker controls even one queried element.
  • String-return friction: Tasks requiring free-form untrusted strings require user approval, adding latency and human-in-the-loop dependency.
  • Per-site labeling effort: Active honest owner variant requires site instrumentation; automated boundary inference may make labeling errors that are not caught (sensitivity tested in Appendix E).
  • Out-of-scope threats: XSS escaping labeled regions, availability attacks, browser/OS compromise, and model errors unrelated to injection are not addressed.

Relevance to Agentic AI / LLM Agents

UCM directly addresses one of the most critical open security problems for production web agents: prompt injection via untrusted page content—an attack that scales with agent autonomy. By operating at the DOM level rather than requiring pipeline-level changes (e.g., plan-then-execute or per-site API construction), UCM preserves the standard ReAct loop that most LLM agent frameworks rely on, lowering the adoption barrier. The Q-Model pattern—structured queries with type-constrained responses—is a generalizable primitive applicable wherever agents must consume untrusted external data (tool outputs, retrieved documents, API responses). The work also establishes a formal threat model and security property for web agents, providing a rigorous baseline for future defense research in agentic systems.