BASIS: Selectively defending against prompt injection based on whether an attack succeeds, using prefilled attention probes

The researchers propose a prompt injection defense method, BASIS: using the Attention Competition Ratio (ρ) as a feature, it trains two sparse linear probes, an existence probe and a breach probe, and decides whether to refuse via cascaded gating, without additional LLM inference. The method has three stages: injection existence detection, per-sample breach prediction, and instruction robustness evaluation; it refuses only when an attack would actually succeed, to mitigate over-refusal. On four tasks and six open-source LLMs, it maintains near-perfect injection detection while significantly reducing over-refusal on safe attack samples, especially under robust instruction templates.