Heads of Security reports improved prompt-injection resistance from learned attention gates on two open models

Key facts

As stated in the sources, with where to find them.

• On 100 held-out InjecAgent direct-harm cases, Table 1’s rounded maximum attack success rates across tested RL-Hammer attackers are 97% for GPT-OSS-20B, 85% with SecAlign and 10% with HoS; Llama values are 99%, 82% and 1%.Section 4.1; Table 1; Appendix E.1–E.2
• The strongest shown RL-Hammer attacker against HoS transferred from SecAlign training. Success means the first tool call names the attacker’s tool, not an executed harmful end-to-end action; the GPT-OSS evaluation targets use medium reasoning effort.Section 4.1; Appendix E.1, Table 5; Appendix E.2
• The authors note fixed training data, dense-attention architectural requirements and the need to decide externally which content is trusted. Finite attack budgets cannot establish security against every adaptive adversary.Section 6, Discussion and Limitations

Findings that cite this record

No tracked finding cites this record yet.

Key questions this bears on

• Can prompt injection against AI agents be reliably defended?Not reliably. Bounding what untrusted input can trigger helps, but trust boundaries must survive delegation and tool execution.

Sources

• Heads of Security: Learned Attention Gates Improve Prompt Injection RobustnessIgor Shilov et al. (arXiv)Oct 27, 2026Primary sourceAccessed Oct 30, 2026

Related records