Lycid drives prompt-injection attacks to zero while preserving the agent's utility on legitimate tasks and keeps end-to-end execution time in line with an ordinary tool-calling loop.
Performance on the AgentDojo prompt-injection benchmark, with and without Lycid defensive layer using Gemini 2.5 Flash.
Security is the share of control-flow prompt-injection attacks blocked. We excludes injection tasks that are not control-flow attacks in banking and travel succeeds merely if the model utters a target string. Neither involves data reaching a tool sink, so a data-flow gate has nothing to act on. The “without lycid” bars are the undefended Native Tool Calling API baseline for the same model (Gemini 2.5 Flash) from Debenedetti et al., Defeating Prompt Injections by Design. Utility is the share of user tasks completed, shown without injections and under attack. Security-check time is the static gate's own analysis time per workflow, the parse, taint/provenance, and reader-policy checks that constitute lycid's security decision.
Share of prompt-injection attacks blocked. Higher is better. Gemini 2.5 Flash with and without Lycid.
Share of user tasks completed successfully. Higher is better.
Share of user tasks completed (no attack). Higher is better. Gemini 2.5 Flash, undefended baseline.
Distribution of the static gate's analysis time per workflow.