Robust Context-Aware Detection of Malicious Instructions in Text

arXiv:2608.05430 · cs.CR, cs.LG · Submitted 2026-08-05 · Read on arXiv

Buzhao Liu, Xinhang Ma, Yevgeniy Vorobeychik

cs.CR, cs.LG

Submitted: 2026-08-05

Code: https://github.com/tavia-liu/CAD

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Benchmark — 25× in this paper · explained in 2 episodes
• Robustness — 21× in this paper · explained in 6 episodes
• Indirect Prompt Injection — 14× in this paper · explained in 2 episodes
• Embeddings — 9× in this paper · explained in 2 episodes
• Prompt Injection Attacks — 8× in this paper · explained in 2 episodes
• Ablation — 5× in this paper · explained in 1 episode
• Benchmarking — 5× in this paper · explained in 4 episodes
• Fine-Tuning — 5× in this paper · explained in 5 episodes
• Accuracy — 4× in this paper · explained in 1 episode
• Trace — 4× in this paper · explained in 2 episodes
• Adversarial Examples — 3× in this paper · explained in 2 episodes
• In International Conference on Learning Representations — 3× in this paper
• AI Agents — 2× in this paper · explained in 2 episodes
• Generalization — 2× in this paper · explained in 14 episodes
• Papers — 2× in this paper · explained in 3 episodes
• Weight Decay — 2× in this paper · explained in 2 episodes
• Actor — 1× in this paper · explained in 3 episodes
• Adversarial Robustness — 1× in this paper · explained in 4 episodes
• Agentic Framework — 1× in this paper · explained in 7 episodes
• Agentic System — 1× in this paper · explained in 2 episodes
• Generator — 1× in this paper · explained in 2 episodes
• Hyperparameters — 1× in this paper · explained in 2 episodes
• Loss Function — 1× in this paper · explained in 2 episodes
• Overfitting — 1× in this paper · explained in 2 episodes
• Perplexity — 1× in this paper · explained in 3 episodes
• Semantic Equivalence — 1× in this paper · explained in 2 episodes
• Task Alignment — 1× in this paper · explained in 2 episodes
• Transformer — 1× in this paper · explained in 2 episodes
• Transformers — 1× in this paper · explained in 2 episodes

Sources

• Detecting Language Model Attacks with Perplexity
• Defeating Prompt Injections by Design
• DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence
• Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities
• Defending Against Indirect Prompt Injection Attacks With Spotlighting
• Attention Tracker: Detecting Prompt Injection Attacks in LLMs
• Baseline Defenses for Adversarial Attacks Against Aligned Language Models
• AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?
• Automatic and Universal Prompt Injection Attacks against Large Language Models
• AutoDojo: A Generative Benchmark for Evaluating Prompt Injection Defenses in LLM Agents
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Progent: Securing AI Agents with Privilege Control
• jina-embeddings-v3: Multilingual Embeddings With Task LoRA
• Defending Against Prompt Injection with DataFilter
• Defending against Indirect Prompt Injection by Instruction Detection
• System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective
• Qwen3 Technical Report
• Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models
• MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents
• Universal and Transferable Adversarial Attacks on Aligned Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Estimating the Social Cost of Corporate Data Breaches
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills