- The paper introduces DualView, a novel dual-view architecture that tracks untrusted data across computational environments to prevent indirect prompt injection.
- It demonstrates a 0% attack success rate against both immediate and stored IPI while maintaining high agent (81%-83%) and human utility.
- DUALVIEW employs dynamic tool routing and synchronized agent/human views to isolate untrusted content, ensuring operational security and usability.
DualView: A Comprehensive Defense against Indirect Prompt Injection in Personal AI Agents
Motivation and Threat Model
Personal AI agents deployed locally, such as OpenClaw, are increasingly automating user workflows across filesystems, shell, network interfaces, and inter-agent protocols. This broad resource access is essential for agent capability but exposes them to indirect prompt injection (IPI) vulnerabilities, where attacker-controlled instructions embedded in external data (e.g., web content, emails, files) manipulate the agent’s behavior upon ingestion. The central security challenge is to reconcile three properties: agent utility (preservation of functional capability on untrusted data), human utility (compatibility of agent artifacts with user and program needs), and security (prevention of attacker control via IPI—including “stored IPI”, where attacker prompts persist in storage and are later reread as trusted input).
Conventional defenses—including Dual LLM pattern approaches, model-based guardrails, and OS-level sandboxing—fail to jointly satisfy all three properties. Specifically, Dual LLM architectures only track untrusted data within the agent’s process context, losing taint provenance when data is written to and read back from the local environment, leaving a gap exploited by stored IPI. Human usability is broken in designs that propagate symbolic placeholders through the environment, while designs that “desymbolize” for usability lose provenance and, therefore, security guarantees.
DUALVIEW Architecture
DUALVIEW builds on the Dual LLM paradigm by extending untrusted data tracking beyond the agent's memory into the entire computational environment.
Bifurcated Environment View: DUALVIEW creates two parallel, dynamically-synchronized representations of the user’s environment:
- AgentView: The agent perceives files, shell environments, network inputs, and inter-agent channels where all untrusted content appears only as opaque symbols (e.g., $ws01.content), maintaining provenance across serialization/deserialization, storage, and inter-process boundaries.
- Human View: Humans and non-agent programs interact with the environment containing original, unsymbolized data, preserving native usability.
Tool View Routing and Synchronization: DUALVIEW routes every tool call—file I/O, shell operations, network requests, inter-agent messaging—to the appropriate view, based on whether the operation can function on symbols (AgentView) or requires original data (Human View). Bidirectional synchronization ensures:
- AgentView receives trusted data as plaintext and untrusted data as symbols.
- Human View merges agent outputs as original data, resolving symbols.
- Concurrency and race conditions across views are controlled using file-system tracking (implemented with Git worktrees) and workspace isolation.
Data Trust and Usage Policies: Granular policy controls classify trusted/untrusted sources (by schema and origin) and restrict untrusted data desymbolization in potentially dangerous contexts (e.g., command execution via HumanShell), requiring explicit user approval. This best-effort layer supplements the deterministic guarantees of symbol isolation.
Agent-Side and Human-Side Tooling: Agent-internal workflows, U-LLM summarization/extraction tasks, and interactions with trusted agents operate entirely on symbols. Only when direct user interaction or remote APIs/third-party programs require, does DUALVIEW perform desymbolization, and only outside the context in which tool-call decisions are rendered, strictly separating policy from agent logic.
Empirical Evaluation
Empirical validation was conducted on custom IPI benchmarks and the PinchBench utility suite, using leading LLM backends (Claude Haiku 4.5, Claude Sonnet 4.6).
- Security: DUALVIEW achieved a 0% attack success rate on both immediate and stored IPI in all tested cases, outperforming model-based guardrails, unmodified Dual LLM, and input/output classifiers. By contrast, Dual LLM baselines, which only track taint within agent context, exhibited persistent vulnerability to stored IPI (up to 53.3% ASR on Haiku).
- Agent Utility: Agent task success rates were 81.6%/82.1% (Haiku/Sonnet), closely tracking the unprotected OpenClaw baseline (83.4%/88.5%), thus demonstrating that security comes at minimal utility cost. By comparison, sandboxing approaches reached 0% ASR but imposed severe utility degradation (62.5%/66.5%).
- Human Utility: Across all examined outputs (files, network messages, user-visible responses), DUALVIEW left no residual symbols, ensuring that the environment remained fully usable by humans and conventional applications. Quality scoring (LLM-based judges) found no material decrease in deliverable fidelity.
- Failure Analysis: Residual failures in PinchBench primarily reflected limitations in model-side handling of symbol references (e.g., repeated U-LLM requests, timeouts), not leakage of attacker taint.
- Overhead: DUALVIEW imposed a token cost overhead (48.2% Haiku, 93.4% Sonnet) due to additional U-LLM calls, but these are amortized in contexts where security is paramount.
Implications and Future Directions
DUALVIEW’s formal separation of agent and human environment views yields a robust, deterministic barrier between untrusted external data and agent control logic, effectively closing the stored IPI loophole present in earlier Dual LLM and guardrail architectures. Its design generalizes over toolsets and runtime infrastructures that support event hooks and pluggable tool harnessing.
Practical Implications:
- DUALVIEW's plugin-based deployment, not requiring modifications of model weights, agent internals, or underlying tool implementations, facilitates immediate integration into existing agentic systems (OpenClaw, Claude Code, Hermes Agent, etc.).
- Symbol isolation at the environment level is applicable to privacy/confidentiality taint-tracking schemes, extending beyond IPI defense to regulated, provenance-sensitive deployments.
Limitations and Future Research:
- Current policies depend on schema- and origin-based taint assignment; comprehensive enforcement of data usage (e.g., detecting untrusted data leaks in outbound arguments) remains a challenge.
- Custom tool support and automated tool routing, as well as taint propagation over remote/cloud storage, are open problems for future work.
- Optimizations for reducing U-LLM invocation cost, e.g., model distillation, call caching, or batched processing, would enable broader use.
Theoretical Implications:
- DUALVIEW suggests that data-flow isolation at the boundary between autonomous AI actors and their operational environment is a necessary primitive for universal agent security.
- The dual-view abstraction may inspire new isolation architectures for multi-agent and cross-system LLM deployments, especially when environmental state is mutable and shared.
Conclusion
DUALVIEW establishes a new security baseline by combining environment-level untrusted data tracking with bifurcated, dynamically-synchronized environment views. It demonstrably eliminates both immediate and stored IPI in personal AI agents while retaining high agent and human utility and practical deployability. The dual-view approach thus represents a substantive advance in the secure deployment of tool-integrated agentic AI, and provides a principled, extensible foundation for future work on trustworthy, context-aware AI ecosystems.
Reference:
Juhee Kim, Woohyuk Choi, Taehyun Kang, Youngmin Kim, and Byoungyoung Lee, "DualView: Preventing Indirect Prompt Injection in Personal AI Agents" (2607.03821)