Newest papers

Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG

Abhishek Rai · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28364 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

该系统易受间接快速注射和检索中毒,在检索内容中的恶意指令被误认为是可信的输入。我们介绍了 nokast-secureRAG,一个大约 0.5B 参数的小型语言模型,该系统易受间接快速注射和检索中毒,在检索内容中的恶意指令被误导为可信的输入。我们介绍了 nokast-secureRAG,一个大约 0.5B 参数的小型语言模型,该模型作为间接快速注射和检索之间的语义防火墙。它共同评估了用户查询和检索的外部环境,将该对称分类为安全,可疑或恶意。我们使用主模型进行训练:一个 35B 教师在四个攻击家庭中生成 5,233 个示

Machine translation (Meta M2M100); the English original follows.

Abstract

Local Retrieval-Augmented Generation (RAG) systems are vulnerable to indirect prompt injection and retrieval poisoning, where malicious instructions in retrieved content are mistaken for trusted input. We present nokast-secureRAG, a roughly 0.5B-parameter small language model that acts as a semantic firewall between retrieval and generation. It jointly evaluates the user query and retrieved context, classifying the pair as safe, suspicious, or malicious. The model is trained using a teacher-judge-student pipeline: a 35B teacher generates 5,233 examples across four attack families, and an independent 120B judge re-labels them, achieving 95.0% agreement before student fine-tuning. On a held-out in-distribution test set, the model achieves 0.994 detection recall at a 0.026 false-positive rate and a 0.006 attack-success-rate proxy, outperforming a regex baseline, a public prompt-injection classifier, Llama Guard 3 1B, and its untuned version. Prompt-Guard-86M reaches 0.900 recall but has a 0.690 false-positive rate. On a judgment-flip test, where the same sentence is benign or malicious depending on context, the model correctly classifies both cases 75% of the time, outperforming the compared baselines. Ablations indicate that retrieved context carries the main attack signal, while query-context consistency reduces false positives. Single-request latency is 293-404 ms, above the target of 100 ms, while amortized throughput latency is 37 ms under batching. On the external PoisonedRAG benchmark, recall falls to near zero, indicating that fluent fact-poisoning attacks lie outside the detector's instruction-consistency threat model. We report this limitation alongside the in-distribution results. The model, data-generation pipeline, and evaluation harness are released open source.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Guard (computer science), Recall, Latency (audio), Language model, Artificial intelligence

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange