{"slug": "heads-of-security-learned-attention-gates-improve-prompt-injection-robustness", "title": "Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness", "summary": "A paper submitted to arXiv on 27 October 2026 introduces Heads of Security (HoS), a prompt injection defense that uses a small set of learned per-head attention gates to separate trusted instructions from untrusted data. Evaluated on Llama-3.3-70B-Instruct and GPT-OSS-20B, HoS held the black-box RL-Hammer attack to a 10% attack success rate, versus 97% against GPT-OSS-20B and 85% against the finetuning-based defense SecAlign, and the white-box attack Claudini required 3 times more FLOPs to reach the same ASR on HoS as on GPT-OSS-20B or SecAlign. HoS also preserved base-model utility on standard multiple-choice benchmarks and few-shot prompting, where SecAlign and ASIDE degrade, while ASIDE reached only 10% utility on tool-use tasks.", "body_md": "# Computer Science > Machine Learning\n\n  [Submitted on 27 Oct 2026]\n\n# Title:Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness\n\n[View PDF](http://arxiv.org/pdf/2610.37657v1)\n\n[HTML (experimental)](https://arxiv.org/html/2610.37657v1)\n\nAbstract:We introduce Heads of Security (HoS), a prompt injection defense that enforces instruction-data separation via a small set of learned per-head attention gates. HoS learns how each head should redistribute attention between trusted and untrusted tokens, enabling models to reason over untrusted content without following injected instructions. We evaluate HoS on Llama-3.3-70B-Instruct and GPT-OSS-20B. We compare it against SecAlign++, a state-of-the-art finetuning-based defense, and ASIDE, a defense that, like ours, builds instruction-data separation into the model architecture. We show that HoS offers greater robustness to adaptive attacks, better performance on standard utility benchmarks, and matches top performance on standard agentic prompt injection benchmarks. More specifically, the black-box RL-Hammer attack reaches 97% ASR against GPT-OSS-20B and 85% against SecAlign, but only 10% against HoS. Claudini, a state-of-the-art white-box attack, strengthened against HoS through autoresearch, requires 3 times more FLOPs to reach the same ASR on HoS as it does on GPT-OSS-20B or SecAlign. HoS preserves base-model utility across standard multiple-choice benchmarks and prompting setups, whereas SecAlign and ASIDE degrade in few-shot settings. On agentic benchmarks with static attacks, HoS and SecAlign perform similarly and substantially improve the security-utility trade-off over the base model. ASIDE struggles with tool use, achieving only 10% utility. These results show that prompt injection robustness can be achieved and improved through targeted attention interventions.\n    \n\n### Additional Features\n\n### Current browse context:\n\ncs.LG\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\nIArxiv Recommender\n\n*(*[What is IArxiv?](https://iarxiv.org/about))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/heads-of-security-learned-attention-gates-improve-prompt-injection-robustness", "canonical_source": "http://arxiv.org/abs/2610.37657v1", "published_at": "2026-10-28 14:47:41+00:00", "updated_at": "2026-10-28 15:13:13.380350+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "machine-learning", "ai-research", "ai-agents"], "entities": ["Heads of Security", "Llama-3.3-70B-Instruct", "GPT-OSS-20B", "SecAlign", "ASIDE", "RL-Hammer", "Claudini", "arXiv"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/heads-of-security-learned-attention-gates-improve-prompt-injection-robustness", "markdown": "https://wpnews.pro/news/heads-of-security-learned-attention-gates-improve-prompt-injection-robustness.md", "text": "https://wpnews.pro/news/heads-of-security-learned-attention-gates-improve-prompt-injection-robustness.txt", "jsonld": "https://wpnews.pro/news/heads-of-security-learned-attention-gates-improve-prompt-injection-robustness.jsonld"}}