PISanitizer: Preventing Prompt Injection in Long-Context Large Language Models via Prompt Sanitization

Researchers propose PISanitizer, a defense method against prompt injection in long-context large language models that locates and sanitizes potentially injected tokens in the context before the backend model generates a response. Existing prompt injection defenses are mostly designed for short contexts; injected instructions account for a very small proportion of long contexts, and defense effectiveness is limited. The method is based on two observations: prompt injection is essentially constructing instructions that force the model to follow them, and the model relies on the attention mechanism to focus on key input tokens; therefore, the model is first made to follow arbitrary instructions in the context, and then the high-attention tokens that drive this following behavior are sanitized, so that the more effectively an injected instruction forces the model to follow it, the more easily it is sanitized. The authors state that evaluation shows the method successfully prevents prompt injection, maintains utility, outperforms existing defenses, and remains robust to optimization-based attacks and strong adaptive attacks. Code is open-sourced at https://github.com/sleeepeer/PISanitizer。