Learned attention gates cut prompt injection success to 10% while preserving utility
The claim
Heads of Security reduces prompt injection attack success rate to 10% compared to much higher rates for existing defenses
Published as: “Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness”
So what
HoS offers a practical way to harden open-weight LLM agents against prompt injection while keeping their general-purpose performance, making it attractive for deployments that need both security and utility.
The five-minute version
Heads of Security (HoS) reduces prompt-injection attack success to 10% (RL-Hammer) and 3× more FLOPs needed for 50% success (Claudini) compared with 97%/85% on undefended and SecAlign models, while keeping utility on standard benchmarks close to the base models. The paper evaluates HoS on Llama-3.3-70B-Instruct and GPT-OSS-20B against adaptive black-box and white-box attacks and shows it preserves few-shot and multi-turn performance better than SecAlign and ASIDE. Evidence comes from multiple benchmark tables and attack-success curves, but the paper notes that HoS only matches SecAlign on static agentic benchmarks and that detection rates drop when all gates are enabled.
What they found 1
- HoS reduces black-box RL-Hammer attack success to 10% while baseline attacks reach 97% on GPT-OSS-20B and 85% on SecAlign.
“the black-box RL-Hammer attack reaches 97% ASR against GPT-OSS-20B and 85% against SecAlign, but only 10% against HoS.”
What undercuts it the paper’s own results
- On static agentic benchmarks HoS performs similarly to SecAlign rather than strictly better: "On agentic benchmarks with static attacks, HoS and SecAlign perform similarly and substantially improve the security-utility trade-off over the base model."
- When all HoS gates are enabled, detection of injected instructions is low (3.11%): "With all HoS gates enabled, the detection rate is 3.11%."
Stated limits 3
- Instruction-data separation is not an end-to-end defense.
- HoS is designed for standard dense attention and is not directly compatible with linear attention architectures.
- Training data is fixed; more diverse data could improve both HoS and baselines.
What’s new here 4
- Learns per-head attention gates that redistribute attention between trusted and untrusted tokens.
- Enforces instruction-data separation without full model fine-tuning, using a small parameter set.
- Demonstrates substantially lower adaptive attack success rates and higher FLOP cost for attackers.
- Maintains utility in few-shot and multi-turn settings where other defenses degrade.
Artifacts & methods 8
- Heads of Security (HoS)system
- SecAlign++system
- ASIDEsystem
- RL-Hammer attackevaluation
- Claudini attackevaluation
- AgentDojo benchmarkdataset
- LLMail-Inject benchmarkdataset
- MMLU-Pro, GSM8K, ARC-Cdataset