LeanGuard uses Lean4 to cut agent prompt-injection to 5.9%
TL;DR
- LeanGuard checks every proposed tool call against a policy written in Lean4 before the call reaches the agent's environment.
- On Tau-Bench with Qwen models from 0.8B to 27B, unguarded agents made at least 33 forbidden calls while LeanGuard executed none.
- On the DTap benchmark, direct prompt-injection success fell from 57.9% to 5.9% with the Lean4 guardrail in front.
LeanGuard, a runtime that "checks every proposed tool call against a policy written in Lean4 before the call reaches the environment," dropped direct prompt-injection success on the DTap benchmark from 57.9% to 5.9%, according to its authors in an arXiv preprint.
On Tau-Bench, run across Qwen models from 0.8B to 27B, unguarded agents made "at least 33 calls that the Lean policy forbids," the paper reports; LeanGuard executed none. The system expresses policies as state predicates with temporal operators over execution history, uses fail-closed evaluation, and runs decision procedures "verified against LeanLTL semantics."
When the gate denies a call, a proof-guided repair step "proves an admissible edit for 88 of 252 denials caused by argument values, in a median of 2 ms." The abstract does not publish per-model latency numbers for the gating step itself, nor results on non-Qwen frontier models.
Originally reported by paper
Read the original article →Original headline: LeanGuard Cuts AI Agent Prompt Injection From 58% to 6% With Lean4 Pre-Execution Verification