Igor Shilov and eight coauthors submitted Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness to arXiv on 27 October 2026. The preprint introduces Heads of Security (HoS), a defense using a small set of learned attention gates for individual attention heads to separate trusted instructions from untrusted data.[1]
According to the abstract, these gates learn how to redistribute attention between trusted and untrusted tokens. The authors evaluated HoS on Llama-3.3-70B-Instruct and GPT-OSS-20B, comparing it with the finetuning defense SecAlign++ and the architectural defense ASIDE.[1]
The authors report that the black-box RL-Hammer attack achieved an attack success rate (ASR) of 97% against GPT-OSS-20B, 85% against SecAlign, and 10% against HoS. The abstract uses “SecAlign++” in its comparison overview and “SecAlign” for these results; the saved page does not clarify that naming difference. It also reports that an adapted Claudini white-box attack needed three times as many floating-point operations to reach the same ASR against HoS as against GPT-OSS-20B or SecAlign.[1]
The abstract claims HoS preserves base-model utility across standard multiple-choice benchmarks and prompting setups. On agentic benchmarks with static attacks, it reports similar performance for HoS and SecAlign. These are author-reported research results.[1]
[1]: Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness, arXiv, 27 October 2026.
Lead photo: Igor Shilov, Xiaoxue Yang, Alexander Panfilov, Evgenii Kortukov, Matthieu Meeus, Peter Romov, Wojciech Samek, Jonas Geiping, Yves-Alexandre de Montjoye · CC BY 4.0.
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
efedf3ed91c4d9dd06ab6e6a19264a38cc1bd3e69c36c4e65f913efd240f8746
