CapLite Shows Small LLM Agents Can Defend Prompt Injection Without Writing Their Own Security Code

CapLite, a new prompt‑injection defense, eliminates successful attacks on small language‑model (SLM) agents while consuming only a fraction of the tokens used by prior defenses. The result matters for developers who run locally hosted agents, because it shows a practical way to secure them without relying on the model to generate its own security policies.

What did the CapLite paper evaluate?

The research, authored by Zimo Xu, Wenzhuo Liu and Hideki Nakayama and posted on arXiv on 13 Nov 2026, measured four existing enforcement defenses—CaMeL, Progent, IPIGuard and DRIFT—across 15 open‑weight models ranging from 1.7 B to 12 B parameters. Each defense asks the agent’s own model to write a security artifact (a program, a privilege policy, a dependency graph or a constraint list) that downstream code enforces. The authors then introduced a suite of prompt‑injection attacks via the AgentDojo benchmark, totaling 13 935 attacked episodes.

Can small language model agents write their own security artifacts?

According to the paper, the answer is largely no. The policies generated for Progent admitted attacks on 14 of the 15 models, IPIGuard’s graphs were vulnerable on 13 models, and DRIFT’s constraints failed on 11 models. Even CaMeL, which enforces a program rather than a policy, suffered from unrecoverable syntax errors in up to 68 % of episodes for the Granite‑4.2‑8B model, and its programs failed to run in as many as 68 % of cases. The failure rate showed no correlation with model size (the authors report $\\|\\rho\\| \le 0.33$, p > 0.2), indicating that larger SLMs do not automatically produce more reliable artifacts.

How does CapLite differ from prior defenses?

CapLite discards the idea that the model should author its own security artifact. Instead, it derives a policy directly from the tool schemas (the formal description of each tool’s inputs and authority arguments) using deterministic code. The workflow consists of three components:

1. Planner – sees only the user request and the schemas, then commits any write calls before any tool result is read.
2. Binder – fills each open argument with candidates extracted from the request, never from tool outputs.
3. Mediator – admits a write only if every authority argument (recipient, amount, object ID, URL, etc.) exactly matches a value stated in the original request.

These steps guarantee write integrity: injected text cannot add a new write, nor can it redirect a write to an unintended target. Figure 4 in the paper (referenced as Figure 1 in the article) visualises the trusted instruction path versus the untrusted observation path, highlighting where CapLite intervenes.

How effective is CapLite in practice?

The experiments show that CapLite achieved zero successful attacks across all 13 935 attacked episodes, a result highlighted in Figure 2 of the paper. Its utility under attack was 29.0 % compared with 27.2 % for CaMeL, but it used only 17.1 k tokens per episode—about 18 % of CaMeL’s 94 k token cost. This translates to the highest utility‑per‑token ratio among all defenses tested, and even outperforms the undefended agent, which consumed more tokens while being vulnerable to injection.

The authors also performed ablations confirming that both the write‑commit step and the Mediator are essential; removing either re‑introduces successful attacks. Cost‑efficiency analyses (Section 5.4) place CapLite on the Pareto frontier of attack‑success rate versus utility, as illustrated in Figure 1 of the paper.

Applying the findings with Grafy

While Grafy does not yet ship a built‑in CapLite module, the principles can be explored using existing tools. Developers can prototype the schema‑derived policy approach in Grafy Chat by loading a small open‑weight model and manually enforcing write‑integrity checks in the surrounding code. For deeper analysis of the paper’s methodology, the Grafy Reader app lets you upload the PDF and query the benchmark results directly. Finally, the Grafy Graph workspace can help map the decision flow between Planner, Binder and Mediator, making it easier to experiment with custom enforcement pipelines.

Frequently asked questions

Does CapLite rely on the language model to generate security code?

No. CapLite derives its policy from static tool schemas and enforces decisions in deterministic code, eliminating the need for the model to write any security artifact.

How does CapLite’s token usage compare to other defenses?

CapLite uses about 17.1 k tokens per episode, which is roughly 18 % of CaMeL’s 94 k tokens and fewer than any other enforcement defense evaluated in the study.

Can the CapLite approach be used with models larger than 12 B parameters?

The paper evaluates models up to 35 B parameters and finds that larger models still fail to produce reliable security artifacts. CapLite’s schema‑derived method is model‑agnostic, so it can be applied to both small and larger models without modification.

---

Source: Grafy Research Lab — CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts