On November 12, 2026, researchers from The University of Tokyo and the Institute of Automation at the Chinese Academy of Sciences posted a preprint introducing CapLite, an architectural defense framework designed to protect small language model agents from prompt-injection attacks without relying on model-written security artifacts. Evaluating 15 open-weight models on the AgentDojo benchmark, authors Zimo Xu, Wenzhuo Liu, and Hideki Nakayama demonstrated that existing enforcement defenses break down on smaller models, whereas CapLite prevented all 13,935 attempted injection attacks across 15 model configurations.
Why model-written security artifacts fail on smaller models
Modern agent defenses with strong theoretical guarantees typically take authorization decisions away from model context and assign them to deterministic code. However, existing frameworks such as CaMeL, Progent, IPIGuard, and DRIFT rely on the agent’s own underlying model to author an initial security artifact—such as an executable program, a privilege policy, a tool dependency graph, or a parameter checklist. The researchers evaluated whether small language models, spanning 1.7 billion to 12 billion parameters, can reliably produce these artifacts.
Across the evaluation, defenses whose artifacts decide what actions are permitted consistently failed open. Privilege policies generated by Progent permitted prompt-injection breaches on 14 of the 15 evaluated models, totaling 676 successful attacks. IPIGuard’s planned dependency graphs admitted attacks on 13 models, while DRIFT’s parameter checklists admitted attacks on 11 models. Conversely, defenses whose artifacts decide what code executes failed closed: CaMeL maintained strong security with only 20 successful attacks across 13,935 episodes, but its generated programs failed to execute in up to 68% of episodes on models such as Granite-4.2-8B, requiring repeated repair cycles that drove average consumption to 93.7k tokens per episode. Model scale did not solve this vulnerability: within the Qwen3 and Gemma-4 model families, attack success rates under Progent and IPIGuard rose alongside model size, as larger models proved more susceptible to following injected instructions.
How CapLite enforces write integrity through schema policies
CapLite eliminates model-written security artifacts entirely. Authorization is determined by deterministic code through two mechanisms: a policy derived directly from tool parameter schemas and a grounding set of values explicitly stated in the initial user request. Tools are classified as read-only or write operations based on verb analysis in tool names and docstrings, while arguments that govern whom or what an action affects—such as recipients, account numbers, monetary amounts, and target URLs—are designated as authority arguments.
The system organizes execution into a pipeline served by a single open-weight model:
- Planner: Inspects only the user request and tool schemas to commit a fixed sequence of write operations before any external tool output is read.
- Reader: Conducts an adaptive read loop to gather information, subject to destination checks that block navigation to ungrounded URLs.
- Binder and Composer: Binds extracted observation values to placeholder parameters, admitting authority values only if they match the request grounding set exactly, while composing free-text message bodies.
- Mediator: Enforces that executed write calls strictly match the prefix committed by the Planner and verifies that every authority argument exists within the user’s initial prompt.
Comparative benchmark results on AgentDojo
The authors evaluated CapLite across 929 tool-goal injection episodes per model on AgentDojo v1.2.2 suites covering Workspace, Slack, Banking, and Travel environments. CapLite recorded zero successful attacks across all 15 models, resisting direct instructions, tool knowledge exploits, read exfiltration, and descriptor collision attacks. CapLite achieved 29.0% utility under attack, comparable to CaMeL’s 27.2%, while requiring 17.1k tokens per episode—18% of CaMeL’s token footprint.
| Defense | Benign Utility (%) | Utility Under Attack (%) | Attack Success Rate (%) | Successful Attacks (k) | Zero-ASR Models | Tokens / Episode |
|---|---|---|---|---|---|---|
| Undefended | 59.4 | 50.2 | 16.66 | 2,322 | 0/15 | 28.0k |
| Progent | 43.8 | 40.6 | 4.85 | 676 | 1/15 | 63.4k |
| IPIGuard | 40.1 | 35.7 | 3.12 | 435 | 2/15 | 60.5k |
| DRIFT | 35.7 | 34.9 | 1.54 | 214 | 4/15 | 28.1k |
| CaMeL | 24.9 | 27.2 | 0.14 | 20 | 12/15 | 93.7k |
| CapLite | 28.1 | 29.0 | 0.00 | 0 | 15/15 | 17.1k |
These findings show that securing agentic workflows does not depend solely on post-hoc AI output verification. Instead, establishing strict structural boundaries addresses agent security as an architectural vulnerability similar to flaws tracked through CVE vs CVSS frameworks.
Implications for university labs and research computing
For academic research groups and university computing facilities deploying open-weight models locally—such as resources allocated under the NAIRR Pilot—the findings highlight the danger of assuming smaller open models can reliably enforce their own security constraints. Research teams running automated literature indexing, laboratory notebook management, or local repository operations cannot rely on prompt-level instructions to safeguard sensitive data.
As academic institutions evaluate compliance with evolving standards such as the EU AI Act, implementing deterministic schema boundaries and write commitment provides a verifiable method to run local agents safely on modest hardware without incurring the latency and cost of commercial frontier models.
