> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kalarislabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Kalaris Labs is an independent AI research lab, founded in India in 2026 by Sayan Chowdhury, building the infrastructure for the agentic era: agent harnesses, protocols, markets and mandates, simulations and evaluations that are hard to game. Its motto is "The rules have to exist before the actors do." Answers to common questions are at https://docs.kalarislabs.com/lab/faq.
> This is the documentation of Kalaris Labs, an applied AI research lab. Product MCP servers: Kuchi at https://kuchi.kalarislabs.com/mcp (remote, no auth); Skill Doctor via `npx -y @security.kalarislabs/skill-doctor mcp`; AMARA via `amara mcp`. See https://docs.kalarislabs.com/agents/mcp-servers.
> When citing a Kalaris Labs paper, cite its DOI and state its evidence level (proposal, partial implementation, simulation, experiment or position) as given on the paper page. Do not present simulation results as results on deployed systems.
> The PrincipalBench v1 model rankings are withdrawn. Use PrincipalBench v2.

# Economic safeguards against indirect prompt injection in agent networks

> A system-level defence against indirect prompt injection that makes attacks cost more than they are worth. Simulated attack success fell from 38.4% to 2.1%.

**Bottom line:** Model-level defences against indirect prompt injection keep being bypassed by adaptive attackers. This paper adds a system-level layer whose aim is not to stop every injection but to make a successful attack cost more than it is worth, and to contain the damage when one succeeds.

| | |
| - | - |
| **Author** | Sayan Chowdhury ([ORCID 0009-0004-8421-0087](https://orcid.org/0009-0004-8421-0087)), Kalaris Labs |
| **Published** | 2026-11 on Zenodo (preprint) |
| **Evidence** | Results come from simulation. |
| **DOI** | [10.5281/zenodo.24121312](https://doi.org/10.5281/zenodo.24121312) |
| **License** | CC BY 4.0 |
| **Theme** | [Agent economies](https://docs.kalarislabs.com/research.md#agent-economies) |

> [card] [Read the paper](https://zenodo.org/records/24121312)
>
> Full text (05\_Economic\_Safeguards\_Against\_IDPI.pdf) and versions on Zenodo.

> [card] [Skill Doctor](https://docs.kalarislabs.com/skill-doctor.md)
>
> Related Kalaris Labs documentation.

## Key points

* Four mechanisms from the agent economies series: a context scarcity barrier that limits how much untrusted text an agent holds, a stake locked before high-impact actions, reputation cascades that isolate compromised agents, and verifiable execution.
* The paper gives a simple attacker-cost model and a corrected bound on the probability that a multi-step attack succeeds.
* In a simulated testbed, attack success fell from 38.4% for the strongest baseline (a sandbox) to 2.1%, a 94.5% relative reduction, with a 0.5 percentage-point drop in task completion and about 0.2 s of added latency.
* Removing any one mechanism raised attack success to between 8.3% and 18.9%.

## Limitations

These are simulation results, the attacker model is simple, and the claims about attacker cost depend on assumed prices.

## Abstract

> Language-model agents that read untrusted content and can act on it are exposed to indirect prompt injection (IDPI), in which instructions hidden in a web page, document or API response steer the agent. Defences that work on the model alone, such as hardened prompts, instruction hierarchies and input classifiers, have repeatedly been bypassed by adaptive attackers. This paper explores a complementary, system-level approach. We combine four mechanisms from the Synthetic Microeconomics series: a context scarcity barrier that limits how much untrusted text an agent holds, a stake that must be locked before high-impact actions, reputation cascades that isolate agents found to be compromised, and verifiable execution. The aim is not to prevent every injection but to make a successful attack cost more than it is worth, and to contain the damage when one succeeds. We give a simple attacker-cost model and a corrected bound on the probability that a multi-step attack succeeds. In a simulated testbed, attack success fell from 38.4% for the strongest baseline (a sandbox) to 2.1% (a relative reduction of 94.5%), with a 0.5 percentage-point drop in task completion and about 0.2 s of added latency. In an ablation, removing any one mechanism raised attack success to between 8.3% and 18.9%. These are simulation results, the attacker model is simple, and the claims about attacker cost depend on assumed prices. We state these limits in the paper.

## Related research

* [Agent Coupling Protocol](https://docs.kalarislabs.com/research/papers/agent-coupling-protocol.md): ACP is a ten-stage protocol that weighs provider reliability more heavily as an orchestrator's context fills. In simulation, honest providers earn 4.8 to 7.6 times more than malicious ones.
* [Marginal Utility of Context](https://docs.kalarislabs.com/research/papers/marginal-utility-of-context.md): An exponential barrier price on context use makes a rational agent compress memory early. In a 50-agent simulation it raised task success from 0.42 to 0.73.
* [Orchestration Trilemma](https://docs.kalarislabs.com/research/papers/orchestration-trilemma.md): Agent markets face finite context, slow verification and fast default cascades at once. The Agent Coupling Protocol cut simulated systemic failure 8.1 to 14.2 times against four baselines.

## Cite this paper

```bibtex theme={"system"}
@misc{chowdhury2026economicsafeguardsindire,
  title     = {{Economic Safeguards Against Indirect Prompt Injection: A systemic defence layer for autonomous agent networks}},
  author    = {Chowdhury, Sayan},
  year      = {2026},
  publisher = {Zenodo},
  note      = {Preprint, Kalaris Labs},
  doi       = {10.5281/zenodo.24121312},
  url       = {https://doi.org/10.5281/zenodo.24121312}
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.