Small Language Models Can't Write Their Own Security Policies — CapLite Stops Asking Them To

CapLite defends AI agents against prompt injection by deriving access policy from tool schemas instead of the model's own output, achieving zero successful attacks across 13,935 episodes at 18% of the token cost.

Imagine you're a nightclub bouncer, and instead of checking IDs yourself, you ask each guest to write their own entry policy. Most guests would write themselves in. That's essentially what current prompt-injection defenses do: they ask the very language model that might be compromised to produce the security artifact — a privilege policy, a dependency graph, a constraint list — that code then enforces. CapLite's insight is that you should never let the guest write the guest list. The paper's committed claim: small language models (1.7B–12B parameters) cannot be trusted to write their own security artifacts, and a defense that derives policy entirely from tool schemas — without any model-written security artifact — achieves write integrity with zero successful attacks. This is not a marginal improvement. Across 15 open-weight models, existing enforcement defenses (CaMeL, Progent, IPIGuard, DRIFT) fail catastrophically on the majority. CaMeL's programs don't even run in up to 68% of episodes. Progent's model-written policies admit attacks on 14 of 15 models. The failure mode is structural, not parametric. CapLite's mechanism is surgical. It inspects tool schemas — the formal API definitions that describe what each tool can do and what arguments it takes — and commits all write calls before any tool result (which might contain injected text) is read. A write is admitted only if every argument that determines the recipient, amount, object, or destination was explicitly stated in the user's original request. This is a static policy derived from structure, not a dynamic one generated by the model. The architecture is deliberately model-agnostic: it doesn't need the LLM to understand security, only to call tools. The integrity story is strong for a systems paper. Evaluation runs on AgentDojo, a community benchmark with 13,935 attacked episodes — not a bespoke test suite. The baselines are current: CaMeL, Progent, IPIGuard, and DRIFT are all named, tested on the same benchmark, and compared on both security (attack success rate) and utility (task completion). CapLite achieves 0% attack success rate across all episodes. Utility under attack is 29.0% vs CaMeL's 27.2% — essentially a tie on task completion, but at 17.1k tokens per episode versus CaMeL's ~95k. That's an 82% reduction in token overhead. The tradeoff is real and the authors are honest about it. CapLite's write-integrity guarantee is narrow by design: it prevents injected writes (sending emails, transferring money, modifying files to unintended targets) but does not address read-only exfiltration or subtle data poisoning through tool outputs. The 29% utility rate means the defended agent completes fewer than a third of tasks even without attacks — the defense is conservative. The paper also only tests on AgentDojo's tool suite; real-world APIs with ambiguous schemas or implicit side effects could break the schema-parsing assumption. The ladder position is clear. Among enforcement defenses, CapLite is the first to achieve zero attack success without requiring any model-written security artifact. This is a categorical difference, not a numerical one. The prior art all asked models to generate policies and then enforced those policies with code — a sound architecture if the policy is correct, but a house of cards when the model writing the policy is a 3B-parameter open-weight model that can be trivially confused. The successor question is obvious: scale the tool suite and the attack surface. AgentDojo's tools are well-specified with clean schemas. Real-world APIs — Stripe, Twilio, arbitrary REST endpoints — have messy schemas, optional parameters that carry security-relevant semantics, and side effects not captured in the schema definition. The authors almost certainly know this is the gap. My read: they're scoping tightly for a clean result paper and saving the messy-world evaluation for follow-up work.