Untrusted Content Masking (UCM)

• Untrusted Content Masking (UCM) is a technique that redacts untrusted DOM regions to enforce a trust boundary between adversarial and safe content.
• It operates in active mode with site-supplied trust labels or in passive mode using an LLM to identify untrusted segments from a sanitized DOM.
• UCM secures web agents by mediating access through a quarantined interface that returns only typed, controlled outputs, thus blocking prompt-injection attacks.

Untrusted Content Masking (UCM) is a system-level defense for web agents that enforces strict isolation between trusted page elements and untrusted, potentially adversarial content. In the formulation introduced in “Untrusted Content Masking for Web Agents with Security Guarantees” (Nikolić et al., 6 Jul 2026), UCM restores the trust boundary needed for formal security guarantees while preserving the agent’s ability to perceive and operate on the page’s structure. The core mechanism is DOM-level redaction: structural signals in the HTML Document Object Model (DOM) are used to identify untrusted regions, those regions are masked before they reach the agent, and any necessary access to their underlying content is mediated through a quarantined model that returns only type-restricted outputs (Nikolić et al., 6 Jul 2026).

1. Concept and problem setting

UCM arises from a specific mismatch between existing prompt-injection defenses and the web environment. In text-only tool-use APIs, trusted interface specifications and untrusted data are naturally separable, enabling robust isolation guarantees such as plan-then-execute over typed tools. Web agents differ because they must first observe the rendered page to perceive buttons, forms, and layout. Trusted UI and untrusted text are therefore intermingled in the pixels and DOM, collapsing the trust boundary on which prior guarantees depend (Nikolić et al., 6 Jul 2026).

The UCM framework addresses this structural entanglement by moving isolation to the DOM. Untrusted elements are redacted before agent observation, leaving the page structure intact for navigation and manipulation. When a task requires reading masked regions, the agent uses a separate quarantined interaction channel that returns only structured, typed values. This prevents injected instructions from propagating back into the agent’s planning context and yields what the paper describes as architectural non-interference from untrusted content without the rigidity of plan-then-execute APIs and with minimal page orchestration (Nikolić et al., 6 Jul 2026).

This suggests that UCM is best understood not as a prompt rewrite, but as a provenance-aware mediation layer placed between the web page and the agent. A plausible implication is that its novelty lies in restoring a formal trust boundary inside an environment where the page normally presents trusted and untrusted material as a single perceptual object.

2. Structural basis in the DOM

The key structural insight in UCM is that the DOM encodes sufficient information to distinguish trusted from untrusted regions without reading their content. The paper identifies hierarchy, tag names, classes, IDs, role and data-* attributes, test IDs, and layout containers as structural signals that correlate with content provenance, including patterns such as comment components, review widgets, and user posts (Nikolić et al., 6 Jul 2026).

Two operating modes are described. In the “active honest owner” mode, site owners annotate untrusted components directly, for example with data-untrusted="true". In the “passive honest owner” mode, UCM infers boundaries from structure alone using an LLM that analyzes a content-sanitized DOM in which all text is removed or replaced by length placeholders, URLs are anonymized, and scripts and styles are removed. The model then emits CSS selectors for untrusted regions, and sanitization prevents prompt injection during the labeling step itself (Nikolić et al., 6 Jul 2026).

The automated labeling process uses tag types, class names and attributes, DOM hierarchy and parent-child context, and site-specific structural templates for user content versus platform UI. The paper notes that origin and Content Security Policy are discussed in related work, but UCM’s core implementation and guarantees are based on DOM structure and site-provided trust labels rather than origin boundaries. Handling iframes, shadow DOM, and CSS-generated content is described as implementable within the same masking pattern, but not as the primary mechanism evaluated in the paper (Nikolić et al., 6 Jul 2026).

A concise summary of the two modes is useful:

Mode	Trust-boundary source	Labeling mechanism
Active honest owner	Site owner	data-untrusted="true" or CSS selectors
Passive honest owner	DOM structure	LLM emits selectors from sanitized HTML

3. Formal model and security guarantees

The formal model in (Nikolić et al., 6 Jul 2026) treats a page DOM as a set of nodes $D$, partitioned into trusted nodes $T \subseteq D$ and untrusted nodes $U \subseteq D$, with $T \cap U = \emptyset$ and $T \cup U = D$. UCM applies a masking transformation $M: D \rightarrow D'$ that preserves trusted structure and content while replacing each untrusted node with a placeholder carrying a stable identifier and, when available, a semantic label such as “review” or “user comment” (Nikolić et al., 6 Jul 2026).

For trusted nodes, masking is identity-preserving. For untrusted nodes, masking produces placeholders that retain layout and affordances while hiding attacker-controlled text from the agent. The interaction interface then permits clicks, inputs, and navigation on trusted UI, prevents direct revelation of untrusted text, and exposes a quarantined_llm_analysis tool. That tool accepts an element identifier, a natural-language query, and a declared return type $$\tau \in \{\text{bool}, \text{int}, \text{float}, \text{enum}, \text{date}\}$$; the hidden content is read by a separately quarantined model, and only a value that parses to $\tau$ is returned to the agent (Nikolić et al., 6 Jul 2026).

The central guarantee is stated as non-interference. The paper gives the information-theoretic form

$I(\text{U-text}; A) = 0$

where U-text denotes attacker-controlled content in untrusted nodes and $A$ is agent-visible content derived from the masked DOM. The theorem on control-flow non-interference states that under the honest-owner assumption and correct labeling, the agent’s context window contains no free-form tokens derived from untrusted regions. Because the quarantined interface returns only values that must parse to a declared type, instruction-bearing text from untrusted content cannot reach the agent, and adversarial prompt injections cannot alter agent control flow (Nikolić et al., 6 Jul 2026).

The proof sketch is constructive. By design, masking redacts untrusted regions and the interaction interface forbids revealing their raw contents. The only remaining dependence of the agent’s actions on untrusted content is through typed outputs, and the output spaces exclude free text. Since an instruction payload requires unconstrained text tokens in the agent’s context, those tokens are absent by construction (Nikolić et al., 6 Jul 2026).

4. System architecture and operational workflow

The UCM defense can run as a client-side framework or proxy layer. In active mode, page owners provide trust labels or selectors; in passive mode, a sanitized DOM is supplied to an LLM that emits selectors for untrusted components, and those selectors are then applied to the live DOM. The framework scans the DOM on load and continuously via MutationObserver to identify newly inserted untrusted elements (Nikolić et al., 6 Jul 2026).

For each untrusted element, the framework hides text or media via CSS, inserts a visible placeholder, assigns a stable data-qllm-id, and preserves structure and interactivity. The page remains usable: a masked link can still be clicked, and a masked form can still be submitted. The agent therefore receives a screenshot, accessibility tree, or DOM-derived description of a page in which trusted text is visible and untrusted text has become labeled placeholders (Nikolić et al., 6 Jul 2026).

The sandboxed interaction layer exposes standard browser actions together with the quarantined analysis tool. The tool resolves the identifier, extracts hidden text or media plus element metadata, constructs a restrictive prompt for the quarantined model, parses the returned value, validates it against the requested type and any constraints, and returns the typed result to the agent. If parsing fails, an error is returned; if the identifier is invalid, the tool returns the list of available identifiers on the page. The implementation also enforces per-element query caps and enum option caps to prevent covert reconstruction of free-form strings (Nikolić et al., 6 Jul 2026).

The paper additionally describes optional handling for free-form tasks. If the agent declares a task unsolvable under typed outputs, it may request a string answer from the quarantined model, but that answer is shown to the user for explicit approval before entering the agent’s context. This fallback does not alter the main guarantee, which is tied to the typed-output regime (Nikolić et al., 6 Jul 2026).

The implementation evaluated in the paper uses a client-side JavaScript masking framework with MutationObserver; for GitLab evaluation, a server-side proxy injects hand-labeled trust tags into the site DOM. Agents evaluated include Claude Sonnet 4.5, Claude Sonnet 4.6, and GPT-5.4, while the Q-Model is Claude Sonnet 4.5 (Nikolić et al., 6 Jul 2026).

5. Algorithms, policies, and evaluation

The active-mode labeling algorithm adds nodes with data-untrusted="true" to the untrusted set on page load, annotates inserted nodes matching site-provided selectors, and uses a deny-by-absence policy for critical components: if a page claims untrusted regions but none are visible under expected selectors, the framework flags the case for review. The passive-mode algorithm sanitizes the DOM, prompts an LLM for selectors targeting untrusted elements, iteratively asks for missed selectors, aggregates them, and applies them to the live page. When ambiguity remains, the runtime policy prefers default-deny on content while preserving interaction affordances (Nikolić et al., 6 Jul 2026).

The masking algorithm hides text nodes and user-controlled attributes such as alt and title, replaces visible content with placeholders, assigns stable identifiers of the form <namespace>:<component>:<index>, and preserves element bounds, ARIA roles, and event listeners. The same transformation is applied to dynamic insertions. The interaction mediation algorithm accepts typed return forms including bounded integers and floats, enums over specified options, and dates, with parsing and validation required before insertion into the agent context (Nikolić et al., 6 Jul 2026).

Evaluation in ten custom environments—banking, calendar, customer support, webshop, email, forum, job board, restaurant booking, travel booking, and wiki—used ten tasks per environment, split between tasks that do and do not require untrusted content. Utility was preserved across all suites and agents. Tasks solvable via trusted regions matched baseline, while tasks requiring untrusted content remained solvable through typed Q-Model queries. Reported cost overhead was moderate, ranging from $T \subseteq D$0 to $T \subseteq D$1 per task, with some tasks becoming cheaper under UCM because of reduced visual clutter and improved focus (Nikolić et al., 6 Jul 2026).

On the GitLab WebArena suite with 41 templates, utility was largely preserved with typed Q-Model access and was fully recovered when the gated string-output fallback was used for inherently free-form answers such as “Who has made the most contributions?” On seeded, strengthened WASP attacks in GitLab, UCM blocked all attacks with $T \subseteq D$2 ASR while preserving benign utility. The paper attributes this result to construction: adversarial instructions cannot pass through typed Q-Model outputs (Nikolić et al., 6 Jul 2026).

Sensitivity to mislabeling was also measured. Even when a single element was mislabeled as trusted at the injection point, ASR remained low at approximately $T \subseteq D$3, compared with approximately $T \subseteq D$4 for the undefended baseline and approximately $T \subseteq D$5 for prompt defense. For automated boundary identification in passive-owner settings, LLM-generated selectors from sanitized DOM achieved high F1 and low undermasking on Booking, Reddit, and GitLab, with example F1 values of approximately $T \subseteq D$6, $T \subseteq D$7, and $T \subseteq D$8 respectively (Nikolić et al., 6 Jul 2026).

6. Limitations, relationship to prior work, and broader usage of the term

The guarantees in (Nikolić et al., 6 Jul 2026) are conditioned on the honest-owner assumption and correct labeling. Over-masking can reduce usability, while under-masking can expose the agent to untrusted content. The paper also distinguishes control-flow prompt injection from data-flow attacks: UCM defeats control-flow prompt injection by design, but attackers can still manipulate typed values returned by the Q-Model, for example by skewing aggregates or hijacking selections. Proposed mitigations include parallel querying, consistency checks, action-level security policies, and user approvals for sensitive operations (Nikolić et al., 6 Jul 2026).

Dynamic content and side channels remain important edge cases. Active-content vulnerabilities such as runtime rewriting of trust tags are out of scope under the honest-owner assumption. Side channels including CSS-generated text, timing or layout cues, and encoded attributes require careful default masking within untrusted nodes. The paper also notes that visiting fully malicious sites remains unsafe independent of UCM, and that unknown sites can be managed with allow-lists and fallback heuristics (Nikolić et al., 6 Jul 2026).

In relation to prior work, UCM is positioned between heuristic prompt-injection defenses and site-specific typed APIs. Heuristic detectors, instruction hierarchies, sandwich prompts, and fine-tuning may improve robustness but are bypassable by adaptive attacks; typed site APIs provide strong control-flow integrity but require per-site infrastructure and reduce the naturalness of web interaction. UCM instead masks untrusted DOM-level content, retains structure-aware planning in a ReAct loop, and uses a quarantined, typed Q-Model to generalize dual-LLM and privilege-separation ideas to open-ended web pages (Nikolić et al., 6 Jul 2026).

The term “Untrusted Content Masking” also appears as a broader research label applied to other domains. In diffusion-based style transfer, a masking-based method suppresses content-bearing dimensions in image condition features to prevent content leakage from a style reference image (Zhu et al., 11 Feb 2025). In application-layer egress control for LLM agents, UCM refers to ordered text rewriting, media scramblers, and legitimacy attestation that destroy or bound covert-channel capacity in text, images, and audio (Metere, 20 May 2026). Related mappings also appear in speech privacy work on masking selected words or phrases (Williams et al., 2024), web architectures that proxy or verify untrusted third-party content (Levy et al., 2015, Somé et al., 2017), context-sensitive injection defenses that prevent parser context switches induced by tainted input (Kalantari et al., 2022), and analyses showing that local frames such as about:blank can bypass privacy tools when inherited origins are mishandled (Ukani et al., 31 May 2025). This suggests that, across domains, the recurring idea behind UCM is to preserve utility while ensuring that untrusted material reaches the protected subsystem only in a constrained, non-executable form.