Replication package — Evaluating Indirect Prompt-Injection Defenses in Tool-Using LLM Agents: Security, Utility, and Replication

This deposit is version 3 of the replication package, updated 17 July 2026. It contains all data, traces, analysis scripts, and figures needed to reproduce every number reported in the manuscript. Contents: agentdojo_results_CORRECTED.csv — canonical summary (run 1 frontier + run 2 GPT-5.4-mini) agentdojo_results_mini_rerun.csv — run 1 GPT-5.4-mini agentdojo_results_verify.csv — run 2 GPT-5.4 and Claude Sonnet 4.6 traces_run1_mini_pdef_tar.gz — per-instance traces, run 1, GPT-5.4-mini, 5 defenses traces_run2_mini_rerun_tar.gz — per-instance traces, run 2, GPT-5.4-mini, 5 defenses traces_frontier_verify_tar.gz — per-instance traces, run 2, GPT-5.4 and Claude, 9 cells agentdojo_banking.py — cell runner (LOGDIR-patched) analyze_agentdojo.py — Wilson CIs, McNemar + Holm correction plot_headline_figure_pooled.py — Figure 1 (provenance-asserting) plot_figure2_instance_heatmap.py — Figure 2 (provenance-asserting) figure1_pooled.pdf/.png/.svg — Figure 1 figure2_instance_heatmap.pdf/.png/.svg — Figure 2 CHANGES.md, CHANGES_ADDENDUM_2026-07-16.md — full audit trail