Heads of Security: Learned Attention Gating Improves Prompt Injection Robustness

Researchers propose Heads of Security (HoS), a prompt injection defense that enforces instruction-data separation by learning each attention head's attention allocation between trusted and untrusted tokens. The authors compare it with the fine-tuning-based SecAlign++ and with ASIDE, which likewise implements instruction-data separation at the architectural level, on Llama-3.3-70B-Instruct and GPT-OSS-20B: the black-box attack RL-Hammer achieves a 97% attack success rate on GPT-OSS-20B and 85% on SecAlign, but only 10% on HoS; for the white-box attack Claudini, strengthened against HoS via autoresearch, the FLOPs required to reach the same attack success rate on HoS are 3 times those on GPT-OSS-20B or SecAlign.