arXiv News

First-hand information for everyone

Site

AboutPrivacy PolicyTerms of Use

© 2026 arXiv News

arXiv News

EnglishJapanese

Switch language

EnglishJapanese
Loading account…

First-hand information for everyone

Back to front page
CryptographyEnglishPublished

Pre‑trained decision models significantly reduce indirect prompt injection in web‑retrieval systems

November 15, 2026arXiv: 2611.08325v1

An open‑weight language‑model gate called Kev‑4B shows that a lightweight decision layer can lower the success of hidden instructions placed in retrieved webpages.

The gate reads each passage’s HTML once and asks three yes/no questions: (1) does it try to instruct an AI?; (2) is it filler or designed to mislead?; (3) is it relevant to the user’s query? If any answer is high enough the passage is dropped; a middle score triggers a citation‑prompted answer; otherwise the passage is forwarded to the generator.

Diagram of a gate that reads a passage’s HTML, answers three yes/no questions, and routes the passage to drop, citation prompt, or generator.
Figure 1. Figure 1 shows the gate’s decision workflow: each retrieved passage’s HTML is passed to a model that answers Q1, Q2, and Q3 to decide drop, flag, or forward.Ghadamyari, Mahdi, Habibi, Reza · arXiv:2611.08325v1 · Figure 1. · CC BY 4.0

In a benchmark of 1,000 forum‑style queries with hidden injected instructions, the attack success rate dropped from 27.9 % with no defence to 13.6 % when only published mitigations (sanitisation, normalisation and citation prompting) were used, and to 5.7 % when the Kev gate was added. The gate adds only 76 ms per passage and misclassifies 4 of 186 hard‑negative benign pages, a false‑positive rate of 2.2 %. Under clean‑query conditions, overall responsiveness remains essentially unchanged (between 85.6 % and 86.2 %).

Table showing standard attack success rates of 27.9%, 13.6%, and 5.7% for no defense, mitigations only, and Kev gate respectively, with corresponding latency 76 ms and 2.2% false‑positive rate.
ConfigurationStd. ASRVar. ASRFPRResp.
Vanilla (guard prompt)27.97.6–87.3
Combined mitigations13.62.9–85.6
TF-IDF detector, drop >0.8515.6–1.189.4
Laya gate (HTML), drop >0.513.3–19.979.0
Kev gate (HTML), drop >0.516.85.42.289.2
Kev gate (HTML), drop >0.3510.2–27.489.3
Combined + TF-IDF10.6–1.184.8
Combined + Laya gate8.6–19.973.7
Combined + Kev gate, drop >0.55.71.72.286.2
Combined + LLM judge (70B), drop >0.50.4–18.386.6
Combined + Kev gate, drop >0.352.9–27.485.8
Table 2. Table 3 lists attack success rates for no defense, published mitigations, and the Kev gate, plus latency and false‑positive rates.Ghadamyari, Mahdi, Habibi, Reza · arXiv:2611.08325v1 · Table 2. · CC BY 4.0

The study also shows that filtering the entire candidate pool before ranking can keep violent or toxic synthetic content can be reduced to 0.5 % exposure while still maintaining 83 % answer accuracy in a pollution‑style test.

These results demonstrate that released decision models can act as efficient gates against indirect prompt injection, though the false‑positive rate and repeated hard‑negative templates suggest cautious deployment and further testing in real‑world settings.

Source paper

Decision Models as Retrieval Gates Against Injection and Pollution

CryptographyInformation Retrieval
View on arXiv
Pre‑trained decision models significantly reduce indirect prompt injection in web‑retrieval systems | arXiv News