0.5B model detects prompt injection in local RAG pipelines
Original title: Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG
Authors report 0.994 in-distribution recall at a 0.026 false-positive rate, but near-zero recall on PoisonedRAG.
Researchers released nokast-secureRAG, a roughly 0.5B-parameter model that sits between retrieval and generation and labels a query-context pair safe, suspicious, or malicious. A 35B teacher produced 5,233 examples across four attack families, and a 120B judge relabeled them with 95.0% agreement. On a held-out in-distribution set it beat a regex baseline, a public classifier, Llama Guard 3 1B, and Prompt-Guard-86M, which reached 0.900 recall with a 0.690 false-positive rate. Context-dependent judgment flips were both correct 75% of the time. Single-request latency was 293–404 ms; batched throughput latency was 37 ms. The model, data pipeline, and harness are open source.
Unconfirmed: Detection rates, agreement, and latency figures are the authors’ reported results, not an independent evaluation.
- The reported attack-success-rate proxy on the in-distribution test was 0.006.
- Ablations say retrieved context carries the main attack signal.
- Prompt-Guard-86M’s false-positive rate was 0.690 in the comparison.
- Fluent fact-poisoning on PoisonedRAG fell outside the instruction-consistency threat model.
From the original article
1 min read at arxiv.orgLocal Retrieval-Augmented Generation (RAG) systems are vulnerable to indirect prompt injection and retrieval poisoning, where malicious instructions in retrieved content are mistaken for trusted input. We present nokast-secureRAG, a roughly 0. 5B-parameter small language model that acts as a semantic firewall between retrieval and generation.
By Abhishek Rai · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.