Year: 2026
Type: conference-paper
Abstract: Large Language Models (LLMs) integrated into complex ecosystems (e.g., code agents) face critical safety threats from Indirect Prompt Injection (IPI) attacks, where malicious instructions are embedded in retrieved data.Existing defenses face an intractable safety-utility tradeoff: sanitization-based guardrails incur high latency, while detection-based guardrails suffer from severe over-refusal.We first demonstrate, both theoretically and empirically, that LLMs can intrinsically separate instructions from data.Inspired by this insight, we propose AEGIS (Adaptive Ensemble Guard for Injection Shielding), a training-free defense that extracts instruction-sensitive projectors to identify malicious instructions and leverages a Unified Multi-Layer Consensus that aggregates topologically distinct signals across the network depth.Evaluations on eight IPI attacks and ten baselines show that AEGIS achieves state-ofthe-art detection accuracy while reducing the false positive rate on benign tasks to below 1%.Code is available at Github.
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W7204201953