Stateful Monitor-Router-Rollback Regulation for Robust Functional Recovery in Large Language Model Agents

Prompt injection can divert large language model (LLM) agents from authorized objectives and contaminate subsequent conversational context. We investigate a deterministic Monitor-Router-Rollback (MRR) supervisory controller designed to detect suspicious instructions, constrain execution paths, and reconstruct trusted task context after exposure. The evaluation uses 400 matched attack scenarios, four attack families, three locally served models (Llama 3.1 8B, Qwen 2.5 32B, and Mistral-Nemo 12B), seven completed defense conditions, and four recorded phases yielding 33,600 completed model-scenario-defense-phase observations. Our findings demonstrate model-dependent robustness improvements—particularly for Llama 3.1 8B, where automated utility increases from 36.00% to 81.25% under MRR—while establishing rigorous methodological boundaries regarding semantic adjudication, component attribution, and repeated snapshot reconstruction.