Imagine you're a restaurant health inspector, but instead of walking into the kitchen yourself, you have to judge the food solely by sniffing plates as they come out the pass. You can't cook anything new, you can't bring your own lab — you just have a trained nose calibrated in advance. That's SEAL: a defense that learns a scoring function offline, then at inference time sniffs every token in a tool's output and deletes the ones that smell like an injected instruction, all without generating a single defense token or calling a second model. The committed claim: SEAL is the first prompt-injection defense that sanitizes untrusted tool outputs using only a frozen task LLM, a learned soft prompt, and a scoring readout — no auxiliary verifier, no defense-generated text — while beating the prior state of the art (PISanitizer) on both attack suppression and task completion, at roughly 1/127th the token cost. That's a genuine efficiency-regime change, not just a marginal accuracy bump. The architecture sits squarely in the soft-prompt-tuning family. SEAL learns a continuous prompt prefix and a lightweight readout head during offline training, then freezes the task model entirely. At inference, it constructs scoring queries from the trusted user context concatenated with the learned prompt — critically, the scoring reference never touches the inspected tool text, so an attacker can't poison the scoring baseline. Tokens are scored independently (no cross-context normalization), and a preservation regularization term pushes the system toward keeping evidence-bearing tokens rather than aggressively deleting everything. On the ladder, the numbers are striking. Against PISanitizer — the named SOTA — SEAL drops attack success on AgentDojo from 34.6% to 0.1% versus PISanitizer's already-reduced rate, while lifting the Joint metric (task completion without attack success) from 51.4% to 77.5%. The 127× token reduction is the headline efficiency win: PISanitizer generates defensive tokens and/or runs a verifier, both expensive under local inference budgets. SEAL does neither. The authors replicate on a second backbone model with the same training recipe, which is a meaningful transferability signal though not independent replication. Integrity is solid but not airtight. Both AgentDojo and AgentDyn are community benchmarks with public task suites, not bespoke evaluation sets. The second-backbone replication is a genuine effort to show generality. However, the paper is not pre-registered, there's no independent reproduction by another group, and the adversarial threat model is limited to the injection strategies present in these two benchmarks — adaptive adversaries who know SEAL's scoring mechanism haven't been tested. The preservation regularization is a nice design choice, but its sensitivity to the regularization coefficient isn't exhaustively ablated from what the abstract conveys. The milestone to watch is real-world adaptive attack resistance. SEAL works against the injection strategies in AgentDojo and AgentDyn today, but the field's live question is whether any static defense survives adversaries who specifically target it. The next concrete number: attack success rate against adaptive adversaries who can observe SEAL's deletion pattern and craft injections designed to evade per-token scoring. If SEAL holds below 5% against such adversaries, it graduates from benchmark defense to deployable defense. The obvious experiment not run: adaptive adversarial evaluation where the attacker has white-box or gray-box access to SEAL's scoring readout. The honest read is (a) — this is expensive to set up properly (you need to train attack models against the defense) and the paper already has a strong story on two benchmarks with a second backbone. They likely prioritized breadth (two benchmarks, two models) over adversarial depth. The next paper will almost certainly address this, or a red-team paper from another group will.
