nokast-secureRAG Small Models Detect RAG Prompt Injection
Start here
Researchers propose nokast-secureRAG, a small language model with about 0.5B parameters, as a semantic firewall between retrieval and generation in a RAG pipeline, jointly evaluating the user query and retrieved context and classifying them as safe, suspicious, or malicious. The model is trained through a teacher-judge-student process: a 35B teacher generates 5,233 samples covering four attack categories, an independent 120B judge relabels them, and the agreement rate before student fine-tuning is 95.0%. On an in-distribution held-out test set, detection recall is 0.994 and the false positive rate is 0.026.
Generated by AI from reports · Updated 23 days ago
Attention and developments
Attention, hourly
Now 29, 0% in 24 hours·Peak 29 (Nov 6 04:00)
Related research
This event's paper
- Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG
arXiv · 2026-10-20 · Deep reading
Progress timeline
- arXiv: Adversarial Attacks, Backdoors & PoisoningContext-Aware Prompt Injection Detection in RAG Pipelines with a Small Language Model: nokast-secureRAG
The researchers propose nokast-secureRAG, a small language model of about 0.5B parameters that acts as a semantic firewall between retrieval and generation in a RAG pipeline, jointly evaluating the user query and the retrieved context and classifying them as safe, suspicious, or malicious. The model is trained through a teacher-judge-student process, with a 35B teacher generating 5,233 samples covering four types of attacks, an independent 120B judge re-labeling them, and an agreement rate of 95.0% before student fine-tuning. On an in-distribution held-out test set, detection recall is 0.994, false positive rate is 0.026, and the attack success rate proxy metric is 0.006, outperforming a regex baseline, a public prompt injection classifier, Llama Guard 3 1B, and the non-fine-tuned version; Prompt-Guard-86M has recall of 0.900 but a false positive rate of 0.690. Ablations show that the retrieved context carries the main attack signal, single-request latency is 293-404 ms, above the 100 ms target, and amortized throughput latency under batching is 37 ms.