{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/heads-of-security-attention-gates-2026/",
 "asOf": "2026-10-30",
 "id": "heads-of-security-attention-gates-2026",
 "date": "2026-10-27",
 "datePrecision": "day",
 "title": "Heads of Security reports improved prompt-injection resistance from learned attention gates on two open models",
 "lane": "defense",
 "kind": "paper",
 "summary": "Shilov and colleagues introduce Heads of Security, learned attention gates separating trusted instructions from untrusted content, tested on GPT-OSS-20B and Llama-3.3-70B-Instruct. Their preprint reports improved robustness against adaptive attacks while preserving tested utility; the mechanism depends on externally supplied trust labels and is not an end-to-end authorization system.",
 "whyItMatters": "It tests model-level instruction/data separation against adaptive attacks while tracking utility.",
 "actors": [
  "imperial-college-london"
 ],
 "topics": [
  "prompt-injection",
  "monitoring-and-control",
  "eval-validity"
 ],
 "atlas": [
  "model",
  "untrusted-content",
  "eval-environment"
 ],
 "artifacts": [
  "heads-of-security",
  "llama",
  "agentdojo",
  "injecagent",
  "secalign"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2610.37657v1",
   "publisher": "Igor Shilov et al. (arXiv)",
   "title": "Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness",
   "date": "2026-10-27",
   "type": "primary",
   "accessed": "2026-10-30"
  }
 ],
 "keyFacts": [
  {
   "fact": "On 100 held-out InjecAgent direct-harm cases, Table 1’s rounded maximum attack success rates across tested RL-Hammer attackers are 97% for GPT-OSS-20B, 85% with SecAlign and 10% with HoS; Llama values are 99%, 82% and 1%.",
   "locator": "Section 4.1; Table 1; Appendix E.1–E.2"
  },
  {
   "fact": "The strongest shown RL-Hammer attacker against HoS transferred from SecAlign training. Success means the first tool call names the attacker’s tool, not an executed harmful end-to-end action; the GPT-OSS evaluation targets use medium reasoning effort.",
   "locator": "Section 4.1; Appendix E.1, Table 5; Appendix E.2"
  },
  {
   "fact": "The authors note fixed training data, dense-attention architectural requirements and the need to decide externally which content is trusted. Finite attack budgets cannot establish security against every adaptive adversary.",
   "locator": "Section 6, Discussion and Limitations"
  }
 ],
 "significance": 4,
 "fideQuestions": [
  "FID-075"
 ],
 "methods": [
  "adaptive-red-teaming",
  "indirect-prompt-injection",
  "instruction-priority-training"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-30",
 "revisions": []
}