Heads of Security (HoS)
An architecture-level defense method against LLM prompt injection attacks that introduces a learnable gating mechanism for each attention head to enforce separation between instructions and data, dynamically regulating attention allocation between trusted and untrusted tokens without altering the main model weights.
Timeline (last 90 days)
The paper proposes Heads of Security (HoS), which enforces instruction-data separation through a set of learnable per-head attention gates.
HoS does not change the model's main weights; instead, it introduces a small gating module for each attention head that learns to reallocate attention weights over trusted and untrusted tokens.
HoS's gates are learned rather than hard-coded rules; defenses such as ASIDE instead adopt architectural-level instruction-data separation.
HoS's gating parameters are very small in scale and do not touch the main weights, making training cost far lower than full-parameter fine-tuning and avoiding catastrophic forgetting.
The paper evaluates HoS on Llama-3.3-70B-Instruct and GPT-OSS-20B, with baselines including the fine-tuning-based defense SecAlign++ and the architecture-based defense ASIDE.
Under the black-box RL-Hammer attack, HoS's attack success rate (ASR) is only 10%, compared with 97% for the original GPT-OSS-20B model and 85% for SecAlign.
Against the white-box attack Claudini, attackers need to consume about 3 times the FLOPs to reach the same ASR on HoS as on the baselines.
HoS maintains the base model's performance on standard multiple-choice benchmarks and prompt settings, whereas SecAlign and ASIDE degrade in few-shot scenarios.
On agent benchmarks of static attacks, HoS and SecAlign perform similarly and substantially outperform the safety-utility trade-off of base models.
HoS is currently still validated on specific models, and the gating module's training cost and cross-model generalization ability remain to be further observed.
All Facts (10)
The paper proposes Heads of Security (HoS), which enforces instruction-data separation through a set of learnable per-head attention gates.
50%UnverifiedHoS does not change the model's main weights; instead, it introduces a small gating module for each attention head that learns to reallocate attention weights over trusted and untrusted tokens.
50%UnverifiedHoS's gates are learned rather than hard-coded rules; defenses such as ASIDE instead adopt architectural-level instruction-data separation.
50%UnverifiedHoS's gating parameters are very small in scale and do not touch the main weights, making training cost far lower than full-parameter fine-tuning and avoiding catastrophic forgetting.
50%UnverifiedThe paper evaluates HoS on Llama-3.3-70B-Instruct and GPT-OSS-20B, with baselines including the fine-tuning-based defense SecAlign++ and the architecture-based defense ASIDE.
50%UnverifiedUnder the black-box RL-Hammer attack, HoS's attack success rate (ASR) is only 10%, compared with 97% for the original GPT-OSS-20B model and 85% for SecAlign.
50%UnverifiedAgainst the white-box attack Claudini, attackers need to consume about 3 times the FLOPs to reach the same ASR on HoS as on the baselines.
50%UnverifiedHoS maintains the base model's performance on standard multiple-choice benchmarks and prompt settings, whereas SecAlign and ASIDE degrade in few-shot scenarios.
50%UnverifiedOn agent benchmarks of static attacks, HoS and SecAlign perform similarly and substantially outperform the safety-utility trade-off of base models.
50%UnverifiedHoS is currently still validated on specific models, and the gating module's training cost and cross-model generalization ability remain to be further observed.
50%