Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness
The authors report a 10% attack success rate against HoS, versus 97% against the base GPT-OSS-20B model, under RL-Hammer.
HoS uses learned attention gates to separate trusted instructions from untrusted content while allowing the model to reason over both. A strengthened white-box attack required three times more compute to reach the same success rate against HoS as against GPT-OSS-20B or SecAlign. HoS preserved base-model performance on standard multiple-choice tests, including few-shot setups where competing defenses degraded. On agentic benchmarks with static attacks, HoS performed similarly to SecAlign.
ArXiv · AI/CL/LG's note
HoS uses learned attention gates to separate trusted instructions from untrusted content while allowing the model to reason over both. A strengthened white-box attack required three times more compute to reach the same success rate against HoS as against GPT-OSS-20B or SecAlign. HoS preserved base-model performance on standard multiple-choice tests, including few-shot setups where competing defenses degraded. On agentic benchmarks with static attacks, HoS performed similarly to SecAlign.
ArXiv · AI/CL/LG's note
score 5