Twin Agent: Context Residual Compression for Privilege Separated Agents

Researchers propose Twin Agent, a privilege separation design pattern for LLM agents that uses two nearly symmetric agents—an Explore Agent inspecting untrusted information and a Safe Agent executing privileged actions—to mitigate prompt injection attacks while preserving task utility. Evaluated on SWE-bench Lite, AgentDojo, and DecodingTrust-Agent, Twin Agent outperforms undefended agents and privilege separation baselines by achieving a better security-utility tradeoff through context residual compression.

arXiv:2607.19595v1 Announce Type: cross Abstract: Large language model LLM agents are vulnerable to security risks, such as prompt injection attacks from untrusted context that manipulate downstream reasoning and tool use. Existing secure-by-design approaches mitigate this risk by separating untrusted observations from privileged execution and careful control of information flow, but often degrade utility and require extensive task-specific engineering. We thus propose Twin Agent, a general privilege separation design pattern inspired by residual coding in the agent context. Twin Agent consists of two nearly symmetric agents: an Explore Agent that inspects untrusted information and a Safe Agent that executes privileged actions. The Explore Agent is conditioned on the Safe Agent's current context and communicates only compact hints to the Safe Agent about the next action to take. This design reduces the information needed to preserve task utility and thus achieves a better security--utility tradeoff, which we empirically verify by measuring how utility and attack success change as the length of hints varies. We evaluate Twin Agent on long-horizon software engineering tasks with SWE-bench Lite and on heterogeneous multi-tool interaction tasks with AgentDojo and DecodingTrust-Agent. Across both benchmarks, Twin Agent preserves high task utility while preventing prompt injection attacks, outperforming both undefended agents and privilege separation baselines.