ERASE blocks multimodal prompt injections while preserving task utility
Original title: Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation
ERASE on-policy self-distillation reduces injection success to near zero while retaining accuracy close to undefended levels on 3B audio.
Multimodal indirect prompt injection embeds malicious instructions in media containing task information. ERASE erases the injected region to construct a reference view preserving surrounding content. A student model learns via full-distribution feedback from a frozen base model on the erased input. Experiments across image audio and video show near-zero attack success with utility retention close to clean inputs.
- ERASE reaches 60.1% accuracy on 3B audio
- Injection dependence drops to 0.0095
- Out-of-domain accuracy stays near base level
From the original article
1 min read at arxiv.orgMultimodal indirect prompt injection embeds malicious instructions in external media that also contains information needed for the user's task. Existing defenses can block the attack yet impair the model's use of that information, leaving a gap between attack defense and task preservation. We propose ERASE, an on-policy self-distillation method that constructs its reference by erasing the injected region in place.
By Shuo Hong · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.