Can capability tracking stop prompt injection attacks?

CaMeL's authors propose "a robust defense that creates a protective system layer around the LLM, securing it even when underlying models are susceptible to attacks." Rather than training or prompting the model to resist malicious instructions, CaMeL "explicitly extracts the control and data flows from the (trusted) query; therefore, the untrusted data retrieved by the LLM can never impact the program flow." On the AgentDojo benchmark the paper reports solving "77% of tasks with provable security (compared to 84% with an undefended system)" — a roughly seven-point drop in tasks completed, traded for a guarantee that no policy violation occurs on the tasks it does solve.

The mechanism borrows directly from software security: "Control Flow Integrity (Abadi et al., 2009), Access Control (Anderson, 2010, Chap. 6), and Information Flow Control (Denning and Denning, 1977)." A Privileged LLM (in Simon Willison's 2023 terms) turns the user's trusted query into pseudo-Python code — the plan. A custom interpreter then executes that plan while maintaining "a data flow graph (i.e., tracking which values each variable depends on)" and attaching a "capability" to every value: metadata recording where it came from and what it is allowed to touch. When the plan calls a tool, the interpreter checks the capability of each argument against a security policy before the call is allowed to execute — so a value sourced from an untrusted document can be blocked from flowing into, say, an email-recipient argument, regardless of what text that document contains.

Against Why do single-message classifiers miss cross-agent harms?, CaMeL is the same reframing — "better understood as a... flow problem than as a... classification task" — made concrete and enforced. SafeFlow's semantic taint is tracked but, by that note's own account, not fully specified; CaMeL specifies the mechanism: capabilities as first-class metadata, checked by an interpreter at the moment of tool invocation rather than inferred from re-expressed natural language. It also differs from Can inspecting generated workflows catch planning-time attacks?, which argues the right intervention point is the planning boundary, upstream of where organization is committed. CaMeL does not rely on a single upstream check: it secures the control flow once, at planning time, but then continues enforcing policy at every single tool call downstream, treating each step as a fresh point where a mislabeled value could otherwise slip through.

The excerpt does not establish how much utility the guarantee costs outside AgentDojo, or how often legitimate tasks get blocked by an over-cautious policy — the paper's own discussion names "user fatigue" from declassification prompts as an open tradeoff, not a solved one. CaMeL also explicitly does not defend "text-to-text attacks which have no consequences on the data flow," such as an injected summary that distorts content without exfiltrating anything, or phishing text shown to the user. The implication is that capability tracking closes the data/control-flow channel specifically, not prompt injection as a category; a complete defense still needs something else for attacks that work entirely inside the words the model produces.