Pith. sign in

REVIEW 6 cited by

Attention Tracker: Detecting Prompt Injection Attacks in LLMs

Not yet reviewed by Pith; the record is open.

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2411.00348 v2 pith:XN4NTEX2 submitted 2024-11-01 cs.CR cs.AIcs.LG

classification cs.CRcs.AIcs.LG
keywords attentionattacksinjectionllmspromptinstructionheadsmethod
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Large Language Models (LLMs) have revolutionized various domains but remain vulnerable to prompt injection attacks, where malicious inputs manipulate the model into ignoring original instructions and executing designated action. In this paper, we investigate the underlying mechanisms of these attacks by analyzing the attention patterns within LLMs. We introduce the concept of the distraction effect, where specific attention heads, termed important heads, shift focus from the original instruction to the injected instruction. Building on this discovery, we propose Attention Tracker, a training-free detection method that tracks attention patterns on instruction to detect prompt injection attacks without the need for additional LLM inference. Our method generalizes effectively across diverse models, datasets, and attack types, showing an AUROC improvement of up to 10.0% over existing methods, and performs well even on small LLMs. We demonstrate the robustness of our approach through extensive evaluations and provide insights into safeguarding LLM-integrated systems from prompt injection vulnerabilities.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 6 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Robust Context-Aware Detection of Malicious Instructions in Text

    cs.CR 2026-08 conditional novelty 6.0 of 10

    A query- and context-aware sentence detector with adversarial training provides a tunable utility-versus-security defense against indirect prompt injection in LLM agents.

  2. CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs

    cs.AI 2026-07 conditional novelty 6.0 of 10

    A document-aware hybrid detector that inspects PDF structure before text flattening outperforms text-only guardrails and structural-only models on a new 29,322-file controlled hidden-prompt-injection benchmark.

  3. LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems

    cs.CR 2025-09 conditional novelty 6.0 of 10

    A systematic review that categorizes LLM threats, severity scores, and mitigations across development and operation life cycles and multiple deployment scenarios.

  4. A Critical Evaluation of Defenses against Prompt Injection Attacks

    cs.CR 2025-05 conditional novelty 6.0 of 10

    StruQ, SecAlign, Instruction Hierarchy, PromptGuard, and Attention Tracker are substantially less effective and utility-preserving than claimed when evaluated with diverse prompts and adaptive attacks.

  5. MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents

    cs.CR 2025-02 conditional novelty 6.0 of 10

    MELON detects indirect prompt injection in LLM agents by re-executing each step with the user prompt replaced by a neutral task prompt and flagging attacks when the original and masked runs produce similar tool calls.

  6. PromptArmor: Simple yet Effective Prompt Injection Defenses

    cs.CR 2025-07 conditional novelty 5.0 of 10

    PromptArmor prompts a separate LLM to detect and remove injected prompts from agent inputs, achieving below 1% false positive and false negative rates on AgentDojo.

Pith tools