Researchers gate attention to defend LLM agents against prompt injection

Researchers from Imperial College London and the Tübingen AI Center introduced HoS, which trains small per-head attention gates instead of fine-tuning model weights to separate trusted instructions from untrusted external content. On GPT-OSS-20B the strongest adaptive attack, RL-Hammer, reached 10% success against HoS versus 85% against SecAlign and 97% undefended.

• Gates are learned per trust channel: system prompt, user input and tool outputs
• On GPT-OSS-20B RL-Hammer hit 97% undefended, 85% against SecAlign and 10% against HoS
• On Llama-3.3-70B the figures were 99%, 82% and 1% respectively
• The method is not end-to-end: applications must still label trust channels correctly