Heads of Security: Learned attention gating improves prompt injection robustness

Researchers from Imperial College London and other institutions proposed the Heads of Security (HoS) defense method, which trains learned gates on each attention head so that the model can read tool outputs without executing instructions injected into them. Each token is labeled as trusted, untrusted, or template channel, and each head scales attention scores by channel before softmax, thereby preventing instruction-following heads from reading untrusted content while other heads can still process that content. The method trains only gate parameters: 18,432 scalars on GPT-OSS-20B and 46,080 on Llama-3.3-70B, trained with the SecAlign++ DPO recipe, with base weights unchanged.