Lightweight defense improves prompt injection protection with small language models
SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense
Cryptography and Security
Summary
Controlling AI models to prevent harmful hidden instructions, called indirect prompt injection (IPI), usually needs strong language models. The authors find that smaller models struggle mainly because they need to both find suspicious parts and decide if they are allowed instructions at once. They propose splitting these tasks: first, use a simple method to find suspect sections, then let a small language model decide if those sections are okay. This approach keeps protection strong even with smaller models, making defenses more efficient.
What this means in practice
- •For ai safety engineers: Implement prompt injection protections that remain effective while using smaller, cheaper language models to reduce infrastructure costs.
- •For security teams: Deploy lightweight detection tools that can locate and block unauthorized injected instructions without expensive model resources.
Authors
Yinxiang Wang, Zehua Ma, Kejiang Chen, Weiming Zhang, Han Fang
Abstract
LLM-based guardrails are effective against indirect prompt injection (IPI), but their performance depends heavily on model capability: as the guardrail model becomes smaller or weaker, detection degrades substantially. This raises a natural question: can we retain strong IPI defense while relying only on a small LLM? To understand why, we revisit what an LLM guardrail actually does. Detecting IPI requires simultaneously locating potentially injected instructions within heterogeneous tool outputs and judging whether they are authorized by the user's request. We find that the difficulty for small models arises largely from satisfying both requirements jointly, rather than from either subproblem alone. This suggests a different path to lightweight defense: explicitly decoupling localization from decision-making. In particular, localization needs no strong language-model reasoning, since injected instructions are often semantically discontinuous with their surrounding content and can be partitioned into local regions via lightweight unsupervised segmentation. Once the observation is partitioned this way, the remaining authorization check becomes a localized judgment that a small LLM can handle. Building on this insight, we design a lightweight IPI guardrail that performs attack-agnostic localization followed by block-level authorization judgment with a small language model. By separating where to look from what to decide, our approach substantially reduces the capability required of the guardrail model while preserving strong defense performance. Empirically, our guardrail achieves a 0.32% attack success rate with negligible loss in benign utility while remaining effective with substantially smaller models. These results show that strong IPI defense need not rely on strong LLMs when localization and decision-making are explicitly decoupled.