Continual Guardrail Learning for Tool-Using LLM Agents: Cross-Benchmark Jailbreak Detection, Indirect Prompt-Injection Filtering, and Utility Preservation - Hao Ran; Natalie Foster; Bo Liang; Justin Meyer (PT Jurnal Cendekia Indonesia, 2026)
Tool-using large language model agents process untrusted text while holding permissions to communicate, book services, and move funds. This study evaluates lightweight guardrails under changing attacks while preserving authorized task utility. The text study uses all 6,899 saved runs in one internally consistent AgentDojo v1 GPT-4o pipeline and 200 JailbreakBench prompts covering 100 behavior groups. Deduplication produced 5,280 texts: 1,450 attacks and 3,830 benign records. Injection-goal grouping assigned 3,169, 1,056, and 1,055 records to training, validation, and testing without sharing an AgentDojo attack target. A normalized word-character classifier achieved 85.43% F1, 90.31% recall, 7.96% benign false-positive rate, and 0.9613 ROC-AUC. A 1,000-round group bootstrap gave a wide 59.71-97.68% F1 interval. Cross-source recall fell to 33.00% from AgentDojo to JailbreakBench and 0.16% in the reverse direction. Sequential tests compared frozen, benign-anchored, hard-replay, and soft-label-replay learners. Reanalysis of 629 matched AgentDojo attacks showed that tool filtering reduced targeted attack success from 47.69% to 6.84% while increasing safe utility from 29.73% to 52.62%. Layered guardrails are therefore necessary: replay maintains coverage under shift, while tool-level enforcement provided the strongest observed end-to-end security-utility balance.