Reproduce “Soft Instruction De-escalation Defense” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Nils Philipp Walter, Chawin Sitawarin, Jamie Hayes, David Stutz, Ilia Shumailov
Soft Instruction Control (SIC) is introduced as a modular preprocessing layer designed to defend Large Language Model (LLM) agents against prompt injection attacks. It employs an iterative sanitization loop that neutralizes imperative instructions within untrusted input streams, achieving a 0% Attack Success Rate on standard benchmarks and significantly outperforming other defenses against adaptive attacks.
Key insights
- Iterative sanitization combined with a canary check and multi-stage instruction detection creates a significantly more robust defense than single-pass or detection-only methods.
- The 'masking' rewriting strategy generally preserves utility better than 'rephrasing' or 'removing' while still achieving zero Attack Success Rate (ASR).
- Even with strong adaptive adversaries, the layered nature of SIC presents a highly constrained optimization problem, forcing attackers to find new, non-imperative attack vectors such as embedded executable workflows or authority-styled language.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.