Newest papers

SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense

Yinxiang Wang, Zehua Ma, Kejiang Chen, Weiming Zhang, Han Fang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.26013 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

基于EMPIRIBILITY分段攻击的防护栏对间接快速注射(IPI)是有效的,但它们的性能取决于模型能力:随着防护栏模型变得更小或更弱,检测显著下降,这引发了一个自然的问题:我们能否保持强大的IPI防御,而只依赖于小型LLM? 要了解为什么,我们重复了LLM防护栏实际上所做的事情。 检测IPI需要在强有力的工具输出中同时找到潜在的注射指令,并判断它们是否被用户的请求授权。 我们发现,对小型模型的困难在很大程度上来自于共同满足两种要求,而不是通过单独的副问题。 检测IPI需要不同的防护栏性能,而不是轻量防御:明确地脱

Machine translation (Meta M2M100); the English original follows.

Abstract

LLM-based guardrails are effective against indirect prompt injection (IPI), but their performance depends heavily on model capability: as the guardrail model becomes smaller or weaker, detection degrades substantially. This raises a natural question: can we retain strong IPI defense while relying only on a small LLM? To understand why, we revisit what an LLM guardrail actually does. Detecting IPI requires simultaneously locating potentially injected instructions within heterogeneous tool outputs and judging whether they are authorized by the user's request. We find that the difficulty for small models arises largely from satisfying both requirements jointly, rather than from either subproblem alone. This suggests a different path to lightweight defense: explicitly decoupling localization from decision-making. In particular, localization needs no strong language-model reasoning, since injected instructions are often semantically discontinuous with their surrounding content and can be partitioned into local regions via lightweight unsupervised segmentation. Once the observation is partitioned this way, the remaining authorization check becomes a localized judgment that a small LLM can handle. Building on this insight, we design a lightweight IPI guardrail that performs attack-agnostic localization followed by block-level authorization judgment with a small language model. By separating where to look from what to decide, our approach substantially reduces the capability required of the guardrail model while preserving strong defense performance. Empirically, our guardrail achieves a 0.32% attack success rate with negligible loss in benign utility while remaining effective with substantially smaller models. These results show that strong IPI defense need not rely on strong LLMs when localization and decision-making are explicitly decoupled.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Authorization, Decoupling (probability), Computer science, Path (computing), Computer security, Distributed computing

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange