LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense
LTBD uses learnable trust delimiters to sharply reduce prompt-injection success without changing LLM weights.
The paper proposes Learnable Trust-Boundary Delimiters (LTBD), a lightweight prompt-injection defense that uses a few learned delimiters to separate trusted user instructions from untrusted external data while leaving LLM parameters unchanged. LTBD reports 0.00% attack success on AlpacaFarm and 0.11-0.19% on TaskTracker, outperforming inference-time defenses and competing with training-based methods. It preserves benign-task utility, adds negligible inference overhead, and remains effective when attackers know the defense and try to bypass it.
- Learnable delimiters encode trust boundaries without changing LLM weights.
- Reports 0.00% ASR on AlpacaFarm and 0.11-0.19% on TaskTracker.
- Beats inference-time defenses and matches training-based approaches.
- Remains effective against adaptive attackers who know the defense.
From the original article
1 min read at arxiv.orgLarge language models (LLMs) perform remarkably well on complex tasks, yet remain highly vulnerable to prompt injection attacks, where malicious instructions embedded in external data can override user intent. Existing defenses remain limited by model fine-tuning requirements, vulnerability to adaptive attacks, or reliance on brittle handcrafted prompts.
By Luman Zhao · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.