Heads of Security attention gates improve prompt-injection robustness
Original title: Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness
Authors report RL-Hammer attack success of 10% on HoS versus 97% on GPT-OSS-20B and 85% on SecAlign.
Researchers introduce Heads of Security (HoS), learned per-head attention gates that separate trusted instructions from untrusted data. They evaluate it on Llama-3.3-70B-Instruct and GPT-OSS-20B against SecAlign++ and ASIDE. The paper says HoS is more robust to adaptive attacks, keeps utility on standard benchmarks, and matches SecAlign on static agentic prompt-injection tests, while ASIDE reaches only 10% utility on tool use.
Unconfirmed: Robustness and utility figures are the authors' reported results, not independently confirmed.
- Black-box RL-Hammer reaches 97% ASR on GPT-OSS-20B and 10% on HoS.
- Claudini needs three times more FLOPs for the same ASR on HoS.
- SecAlign and ASIDE degrade in few-shot settings; HoS does not, the authors say.
- On static agentic attacks, HoS and SecAlign perform similarly.
- AI models
- Llama-3.3-70B-InstructGPT-OSS-20B
From the original article
1 min read at arxiv.orgWe introduce Heads of Security (HoS), a prompt injection defense that enforces instruction-data separation via a small set of learned per-head attention gates. HoS learns how each head should redistribute attention between trusted and untrusted tokens, enabling models to reason over untrusted content without following injected instructions. We evaluate HoS on Llama-3.
By Igor Shilov · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.