Web agents can autonomously complete online tasks by interacting with websites, but their exposure to open web environments makes them vulnerable to prompt injection attacks embedded in HTML content or visual interfaces. Existing guard models still suffer from limited generalization to unseen domains and attack patterns, high false positive rates on benign content, reduced deployment efficiency due to added latency at each step, and vulnerability to adversarial attacks that evolve over time or directly target the guard itself. To address these limitations, we propose WARD (Web Agent Robust Defense against Prompt Injection), a practical guard model for secure and efficient web agents. WARD is built on WARD-Base, a large-scale dataset with around 177K samples collected from 719 high-traffic URLs and platforms, and WARD-PIG, a dedicated dataset designed for prompt injection attacks targeting the guard model. We further introduce A3T, an adaptive adversarial attack training framework that iteratively strengthens WARD through a memory-based attacker and guard co-evolution process. Extensive experiments show that WARD achieves nearly perfect recall on out-of-distribution benchmarks, maintains low false positive rates to preserve agent utility, remains robust against guard-targeted and adaptive attacks under substantial distribution shifts, and runs efficiently in parallel with the agent without introducing additional latency.

翻译：Web智能体可通过与网站交互自主完成在线任务，但其暴露于开放网络环境的特点使其易受HTML内容或视觉界面中嵌入的提示注入攻击。现有防护模型仍存在以下缺陷：对未见领域和攻击模式的泛化能力有限、良性内容误报率高、每步操作增加延迟导致部署效率降低，以及对随时间演化或直接攻击防护模型本身的对抗性攻击的脆弱性。为解决上述问题，我们提出WARD（Web智能体针对提示注入的鲁棒防御），这是一种面向安全高效Web智能体的实用防护模型。WARD基于WARD-Base（从719个高流量URL和平台收集约177K样本的大规模数据集）和WARD-PIG（专门针对防护模型的提示注入攻击数据集）构建。我们进一步提出A3T自适应对抗攻击训练框架，通过基于记忆的攻击者与防护者协同进化过程迭代强化WARD。大量实验表明，WARD在分布外基准测试中达到近乎完美的召回率，保持低误报率以维护智能体效用，在显著分布偏移下仍能保持对针对防护模型和自适应攻击的鲁棒性，并能与智能体高效并行运行且不引入额外延迟。