Prompt injection defense uses attention gates

Prompt injection happens when untrusted text tries to override the instructions a model should follow. Heads of Security is a defense that uses learned attention gates to help separate trusted instructions from untrusted text, so a model can reason over untrusted content without following injected instructions.

In tests on Llama-3.3-70B-Instruct and GPT-OSS-20B, the researchers report that the RL-Hammer attack succeeded 10% of the time against Heads of Security, compared with 97% against GPT-OSS-20B and 85% against SecAlign. Those are results from the paper’s evaluation, not a guarantee about how a system will perform against attacks in a company’s own workflows. The paper also reports that the method maintained base-model utility across standard multiple-choice benchmarks and prompting setups. For operators, the useful takeaway is that prompt injection defenses can be built into how a model handles attention, rather than relying only on training.