EDIC: An External-Data Per-Instruction Compliance Defense Framework
Start here
A paper released on October 16, 2026 proposes the EDIC framework, which attributes legitimate instructions and adversarial prompt injections mixed in external data on an instruction-by-instruction basis, using decomposed rewards to separately encourage beneficial compliance and penalize harmful compliance. The method formalizes the problem as classification of instructions in external data, performing identification, classification and action on each embedded instruction; the training pipeline injects paired beneficial and harmful instructions and performs counterfactual filtering, and the generative judge is initialized via SFT and then fine-tuned with GRPO. On two backbone models and five benchmarks, EDIC improves both safety and helpfulness compared with the strongest prior defense, with harmful refusal on Qwen3-4B improving by up to 7.7%.
Generated by AI from reports · Updated 25 days ago
Attention and developments
Attention, hourly
Now 27, 0% in 24 hours·Peak 27 (Nov 6 03:00)
Related research
This event's paper
- Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data
arXiv · 2026-10-16 · Deep reading
Progress timeline
- arXiv: Adversarial Attacks, Backdoors & PoisoningIdentify, Classify, Act: Per-Instruction Controlled Compliance of LLMs with External Data
The paper proposes EDIC, which attributes each instruction among the legitimate instructions and adversarial prompt injections mixed in external data on an instruction-by-instruction basis, using decomposed rewards to separately encourage helpful compliance and penalize harmful compliance. The method formulates the problem as classification of instructions in external data, i.e., identify, classify, and act on each embedded instruction; the training pipeline injects paired helpful and harmful instructions and performs counterfactual filtering, and a generative judge is first initialized via SFT and then fine-tuned with GRPO. On two backbone models and five benchmarks, EDIC improves both safety and helpfulness compared with the strongest prior defense, with harmful refusal improving by up to 7.7% on Qwen3-4B and helpfulness on Arena-Hard-Auto improving by 12.5%. The code is open-sourced on GitHub.