Search papers, labs, and topics across Lattice.
This paper introduces a context- and query-aware approach for detecting malicious instructions in text, specifically targeting indirect prompt injection (IPI) vulnerabilities in large language models (LLMs). By employing two adversarial training methods鈥攆eature-space adversarial training and LLM-based paraphrasing鈥攖he authors enhance the robustness of their classifier against adaptive evasion attacks. Experimental results demonstrate that their method outperforms existing IPI defense baselines, achieving higher utility and lower attack success rates, particularly when tuned for specific application domains.
Malicious instruction detection can be significantly improved by adapting adversarial training to the context of the task, leading to better robustness against evolving attack strategies.
The remarkable instruction-following ability of modern LLMs has enabled their practical use as the minds of agents that can autonomously complete increasingly complex tasks. Therein, however, also lies their vulnerability to attacks which embed malicious instructions in text, common variants of which are known as indirect prompt injection (IPI). A fundamental task in addressing this vulnerability is successful segmentation of a given text into benign and malicious sentences (if any). While a number of approaches for this task have been proposed, no detector combines query-relative detection at the segment level, and none are hardened against adaptive evasion attacks realizable in agentic executions. We address the former limitation by developing an approach for malicious sentence classification that is both context- and query-aware. Next, to harden the resulting classifier against evasion, we present two adversarial training methods. The first is directly adapted feature-space adversarial training (AT) in which evasions are approximated using projected-gradient-based optimization in the embedding space. The second simulates realizable evasion attacks in the AT loop through LLM-based paraphrasing. Crucially, we parametrize both AT variants to facilitate a smooth tradeoff between utility and attack robustness. In extensive experiments using indirect prompt injection benchmarks we show that the proposed approach outperforms state-of-the-art IPI defense baselines under static attacks, while in the case of adaptive attacks, our AT variants provide significantly higher utility, lower attack success rate, and often both. Finally, we show that the best AT parameters can depend intimately on the particular application domain. Consequently, domain-dependent tuning of malicious text detectors is likely necessary in practice. Our code is publicly available at https://github.com/tavia-liu/CAD.
