Newest papers

SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense

Yinxiang Wang, Zehua Ma, Kejiang Chen, Weiming Zhang, Han Fang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.26013 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

LLMベースのセグメントベースのガードレーンは、間接的なプロンプトインジェクション(IPI)に対して効果的ですが、そのパフォーマンスはモデル能力に大きく依存します:ガードレーンモデルがより小さいか弱くなると、検出が大幅に悪化します。これは自然な質問を提起します:私たちは間接的なプロンプトインジェクション(IPI)だけに依存しながら強力なIPI防衛を維持することができますか? なぜか理解するために、私たちは、LLMガードレーンが実際に何をしているかを再確認します。これらの分離型ガードレーンモデルは、強力なツール出力の中に潜在的に注入された指示を同時に発見することを必要とします。 これは、それらがユーザーの要求によって強力であるかどうかを判断

Machine translation (Meta M2M100); the English original follows.

Abstract

LLM-based guardrails are effective against indirect prompt injection (IPI), but their performance depends heavily on model capability: as the guardrail model becomes smaller or weaker, detection degrades substantially. This raises a natural question: can we retain strong IPI defense while relying only on a small LLM? To understand why, we revisit what an LLM guardrail actually does. Detecting IPI requires simultaneously locating potentially injected instructions within heterogeneous tool outputs and judging whether they are authorized by the user's request. We find that the difficulty for small models arises largely from satisfying both requirements jointly, rather than from either subproblem alone. This suggests a different path to lightweight defense: explicitly decoupling localization from decision-making. In particular, localization needs no strong language-model reasoning, since injected instructions are often semantically discontinuous with their surrounding content and can be partitioned into local regions via lightweight unsupervised segmentation. Once the observation is partitioned this way, the remaining authorization check becomes a localized judgment that a small LLM can handle. Building on this insight, we design a lightweight IPI guardrail that performs attack-agnostic localization followed by block-level authorization judgment with a small language model. By separating where to look from what to decide, our approach substantially reduces the capability required of the guardrail model while preserving strong defense performance. Empirically, our guardrail achieves a 0.32% attack success rate with negligible loss in benign utility while remaining effective with substantially smaller models. These results show that strong IPI defense need not rely on strong LLMs when localization and decision-making are explicitly decoupled.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Authorization, Decoupling (probability), Computer science, Path (computing), Computer security, Distributed computing

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange