SpanGuard splits localization from authorization for small-model IPI defense
Original title: SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense
Authors report a 0.32% attack success rate and little loss of benign utility while using substantially smaller guardrail models.
The paper says small LLM guardrails fail at indirect prompt injection because they must locate injected instructions and judge authorization together. SpanGuard first segments tool output with lightweight unsupervised methods, then asks a small model to authorize each block. The authors say this keeps strong defense without relying on a large guardrail model.
Unconfirmed: The attack-success rate and utility results are figures reported by the paper's authors.
- Injected instructions are treated as semantically discontinuous with nearby tool output.
- Localization is attack-agnostic and does not use strong language-model reasoning.
- The remaining check is a block-level authorization judgment by a small LLM.
- Reported attack success rate is 0.32%, with negligible benign-utility loss.
From the original article
1 min read at arxiv.orgLLM-based guardrails are effective against indirect prompt injection (IPI), but their performance depends heavily on model capability: as the guardrail model becomes smaller or weaker, detection degrades substantially. This raises a natural question: can we retain strong IPI defense while relying only on a small LLM? To understand why, we revisit what an LLM guardrail actually does.
By Yinxiang Wang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.