safety security
The Security Gate Moves Inside Attention
Learned per-head gates cut a black-box prompt-injection attack's success on GPT-OSS-20B from 97 percent to 10 percent while preserving tested utility.
Summary
Learned per-head gates cut a black-box prompt-injection attack's success on GPT-OSS-20B from 97 percent to 10 percent while preserving tested utility.
Prompt-injection defenses often filter inputs or retrain an entire model. Heads of Security instead learns a small gate for selected attention heads, controlling how each redistributes attention between trusted instructions and untrusted data. On GPT-OSS-20B, the authors report that the adaptive black-box RL-Hammer attack succeeds 97 percent of the time against the base model and 85 percent against SecAlign++, but 10 percent against HoS. A strengthened white-box attack required three times more compute to reach the same attack-success rate, while standard multiple-choice utility remained close to the base model and static agentic benchmarks matched SecAlign. The result is limited to the tested models, attacks and benchmarks; it is not proof that prompt injection has been solved.
Why it matters
Learned per-head gates cut a black-box prompt-injection attack's success on GPT-OSS-20B from 97 percent to 10 percent while preserving tested utility.
Limits and context
- The result is limited to the tested models, attacks and benchmarks; it is not proof that prompt injection has been solved.
Key claims
Learned per-head gates cut a black-box prompt-injection attack's success on GPT-OSS-20B from 97 percent to 10 percent while preserving tested utility.
Qualification: The result is limited to the tested models, attacks and benchmarks; it is not proof that prompt injection has been solved.
Evidence: source-2026-10-29-001
Sources
- arXiv preprint 2610.37657, original v1arXiv · primary research
Corrections
No corrections have been recorded for this story.