Du Wenlong outlines four-layer prompt-injection defense for on-device agents

On 2026-11-11 at 18:05, Du Wenlong published a post on cnblogs titled "Prompt-injection defense for on-device agents: a four-layer security architecture, dissected." The article focuses on prompt-injection defenses for on-device AI interactive agents in two settings: task extraction and personal-data question answering. It follows a deliberate sequence: conclusions first, then a comparison of ordinary Agent behavior versus prompt-injection-resistant Agent behavior, followed by a breakdown of the four-layer security architecture, a real verification chain, the evolution of papers from 2024 to 2026, and finally technical boundaries. The opening section states the core conclusion up front, rather than building up through definitions. From there, the post contrasts how a typical Agent handles instructions with how a prompt-injection-resistant Agent is designed to behave, and then unpacks each layer of the proposed four-layer architecture. It also describes a real verification chain intended to demonstrate how the defense works in practice, instead of staying at the conceptual level. In addition, the author reviews relevant papers from 2024 to 2026 to trace how this kind of design has evolved, and closes by drawing technical boundaries: what the architecture is meant to cover, and what it does not claim to solve. No further follow-up posts appear in the provided material, so the discussion currently rests at this single publication and its stated scope.