Only What You've Signed up For: Secure Workflows with Constrained Diffusion Agents
This paper proposes CoDA, a defense for agentic workflows that uses diffusion language models to enforce task-specific security policies during generation by projecting token distributions onto policy-compliant sets at each denoising step, rather than trying to detect malicious prompt injections after the fact. The interesting bit is that it leverages the iterative, sequence-wide nature of dLLM decoding to make constraint enforcement native to generation and reports strong robustness against static and adaptive attacks with modest overhead, though its practicality likely hinges on having precise policies and on the maturity/adoption of diffusion LMs compared with standard autoregressive agents.
Abstract
As agentic AI systems take on increasingly complex and consequential tasks, securing them against prompt injection becomes critical. Existing defenses often rely on detecting or reasoning about injected malicious instructions and can therefore remain vulnerable to adaptive attacks that optimize the injection itself. Diffusion language models (dLLMs), an emerging framework for language generation, offer a new opportunity for security enforcement: by iteratively refining their sequence wide predictions, they enable broader-scope constraint enforcement throughout generation. This paper introduces Policy-Constrained Diffusion Agents (CoDA), a framework that enforces task dependent security policies directly within the denoising process of diffusion language models. At each denoising step, CoDA projects token distributions onto a policy-compliant set, maintaining constraint satisfaction throughout generation. We evaluate CoDA across state-of-the-art diffusion language model families under both static and adaptive prompt-injection attacks. Results demonstrate substantial reductions in attack success rate with competitive task utility and practical inference overhead.