APEX places prompt-injection checks at consequential execution boundaries

APEX starts with the authorized user task before attack material is introduced and compiles that intent into an executable authorization contract. Its WRAP mechanism checks requested effects and their runtime evidence before actions commit; PLANT creates controlled probes for dependencies that the original task never endorsed. The reported protection therefore rests on a testable rule for each consequential effect, not on asking the same model to judge whether suspicious text sounds like an instruction.

The authors report zero successful attacks in five of six studied benchmarks and 0.56 percent on the remaining test, with zero observed success in the reported adaptive setups. These are results in the provided test environments. They do not prove that every action runs through the gate, that a compiler cannot authorize the wrong task, or that all forms of side effect are visible.

The remaining 0.56 percent in SkillInject matters because it was not an unobserved network exfiltration. The paper identifies a crafted instruction in a data-storytelling skill that biased the wording of an otherwise authorized report. Its output remained within the expected artifact and left no extra externally distinguishable effect for the execution gate to reject. APEX is strongest when authorization can be expressed as checkable operations, but content quality and subtle answer contamination still require independent evaluation of the final artifact.