A new filter promises to stop rogue data from hijacking AI agents - and slashed attack success rates by roughly 37x in lab tests.
Researchers describe PIPES (Provenance-Informed, Prior-Enforced Screening) in a paper posted to arXiv on August 14, 2026. The system checks every piece of data a tool-using AI agent pulls in - search results, API responses, file contents - against two things: whether the format matches what that field is supposed to contain, and whether the source is trusted enough to make the claim it's making. Content that breaks either rule gets flagged for removal, a warning, a block, or escalation to a human. Tested against adaptive, PAIR-style jailbreak attacks across six benchmark splits (three from VitaBench, three from AgentDyn), PIPES cut average attack success from 84.7 percent down to 2.3 percent, while performance on legitimate tasks barely moved - 92.5 percent with the defense versus 90.6 percent without.
The interesting part isn't the numbers, it's the target. So-called state-corruption attacks don't trick a model with clever wording; they smuggle false claims about the environment into a tool's response, so the agent's next action looks justified even to guardrails watching for bad behavior. That's a harder problem than ordinary prompt injection, because the defense has to police what data is allowed to say, not just what the model does with it - closer to email provenance checks like SPF and DKIM than to a content filter.
One flag for readers: the paper names its target agent as "Gemma 4 31B IT," an identifier that does not correspond to any publicly confirmed Google model release at that name or parameter count. Treat that detail as unverified until the authors or Google clarify it.