ASP-Guard: Per-Slot Typed Defense Against Prompt Injection in Computer-Use Agents

Computer-use agents (CUAs) act on rendered webpages, documents, emails, and graphical user interfaces using structured actions with named slots. Prompt injection attacks can manipulate these observations to induce unsafe behaviors such as credential disclosure, malicious navigation, or unauthorized tool use. Existing defenses typically operate at the page or action level, treating untrusted content uniformly and thereby sacrificing utility on legitimate tasks. We present ASP-Guard, a training-free defense framework based on typed slot policies. ASP-Guard measures region-to-slot influence using black-box mask-diff attribution and determines whether that influence is authorized according to the semantic type of the affected slot (e.g., perception, mission, sink, credential, or parameter). This enables the same untrusted region to be allowed for one slot while blocked for another. On the full 30-case VPI-Bench browser benchmark using GPT-4o-mini, ASP-Guard achieves a defense success rate (DSR) of 0.77 and blocks 21 of 25 attack-landed cases while safely escalating the remaining 4, resulting in zero silent allows. We further evaluate on a 64-case benign set (48 rendered tasks) and show that ASP-Guard Pareto-dominates a strong block-all-sinks baseline, achieving identical benign false-positive rate while improving DSR by 0.44. We also report attribution-grounded blocking on all blocked cases and analyze cross-model behavior across GPT-4o-mini and GPT-5-mini, revealing substantial differences in attack susceptibility between model generations. Our results suggest that typed per-slot authorization provides a more robust and generalizable defense against prompt injection than untyped global rules or scalar-threshold approaches.