Heads of Security：注意力门控防御提示注入攻击
Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness
prompt injection 一直没好办法防，这篇用注意力门控把攻击成功率从 97% 压到 10%，还不太掉性能，做安全或 agent 的值得看。
论文提出 Heads of Security（HoS），通过学习每层注意力头的门控，在模型内部强制实现指令与数据分离，让模型能阅读不可信内容但不执行其中注入的指令。在 Llama-3.3-70B-Instruct 和 GPT-OSS-20B 上测试，黑盒攻击 RL-Hammer 对 GPT-OSS-20B 的攻击成功率（ASR）达 97%，对微调防御 SecAlign 达 85%，对 HoS 只有 10%。白盒攻击 Claudini 在 HoS 上要花 3 倍 FLOPs 才能达到与 GPT-OSS-20B 相同的 ASR。与同类架构防御 ASIDE 相比，HoS 保留了基础模型在少样本设置下的性能，而 ASIDE 在工具使用场景只有 10% 的效用。
Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness
We introduce Heads of Security (HoS), a prompt injection defense that enforces instruction-data separation via a small set of learned per-head attention gates. HoS learns how each head should redistribute attention between trusted and untrusted tokens, enabling models to reason over untrusted content without following injected instructions. We evaluate HoS on Llama-3.3-70B-Instruct and GPT-OSS-20B. We compare it against SecAlign++, a state-of-the-art finetuning-based defense, and ASIDE, a defense that, like ours, builds instruction-data separation into the model architecture. We show that HoS offers greater robustness to adaptive attacks, better performance on standard utility benchmarks, and matches top performance on standard agentic prompt injection benchmarks. More specifically, the black-box RL-Hammer attack reaches 97% ASR against GPT-OSS-20B and 85% against SecAlign, but only 10% against HoS. Claudini, a state-of-the-art white-box attack, strengthened against HoS through autoresearch, requires 3 times more FLOPs to reach the same ASR on HoS as it does on GPT-OSS-20B or SecAlign. HoS preserves base-model utility across standard multiple-choice benchmarks and prompting setups, whereas SecAlign and ASIDE degrade in few-shot settings. On agentic benchmarks with static attacks, HoS and SecAlign perform similarly and substantially improve the security-utility trade-off over the base model. ASIDE struggles with tool use, achieving only 10% utility. These results show that prompt injection robustness can be achieved and improved through targeted attention interventions.
