# PARSE: Provenance-Aware Retrieval Sanitization for Professional Domain LLM Agents

Source: [PARSE: Provenance-Aware Retrieval Sanitization for Professional Domain LLM Agents](<https://www.sota2.com/research/paper/6a322a3ad33dfb23e783ec6c>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-07-23T05:00:13.404Z

Authors: Aaditya Pai

Published: 2026-06-16T03:29:23.000Z

## Abstract

Prompt injection defenses evaluated on synthetic benchmarks do not generalize to real enterprise documents, which are longer, denser, and interleave legitimate authority language with factual content. We demonstrate this gap with a real-document benchmark of 122 tasks across five professional domains (financial, legal, medical, scientific, DevOps) using actual SEC filings, Federal Register rules, PubMed abstracts, arXiv papers, and GitHub postmortems. Paraphrasing, the strongest defense on synthetic benchmarks, shows no statistically significant attack success rate reduction on real documents (p=0.500) while degrading utility from 91.8% to 82.8%. We introduce PARSE (Provenance-Aware Retrieval Sanitization), a domain-aware, fact-preserving sanitization pipeline that classifies each sentence by injection likelihood, extracts structured facts before rewriting, and verifies fact preservation via a consistency-checking loop. A directiveness gate routes 59% of real enterprise documents to a lightweight path, concentrating computational cost on high-risk documents. PARSE achieves 15.6% attack success rate -- a 38% reduction versus the 25.4% baseline -- at 86.9% utility, the only condition that is both statistically significant (p=0.014, adequately powered) and maintains near-baseline utility. Practitioners should evaluate defenses on domain-matched real documents, not synthetic proxies.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Prompt Injection Security Evaluation on Professional Domains Corpus](<https://www.sota2.com/research/sota/prompt-injection-security-evaluation-on-professional-domains-corpus.md>): Prompt Injection Security Evaluation; Professional Domains Corpus; Attack Success Rate (DevOps): 12.

- [Utility / Task Performance on Professional Domains Corpus](<https://www.sota2.com/research/sota/utility-task-performance-on-professional-domains-corpus.md>): Utility / Task Performance; Professional Domains Corpus; Utility: 86.9.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2606.17467>)

[PDF](<https://arxiv.org/pdf/2606.17467.pdf>)