{"id":"https://openalex.org/W7166809705","doi":"https://doi.org/10.18653/v1/2026.acl-long.502","title":"Defenses Against Prompt Attacks Learn Surface Heuristics","display_name":"Defenses Against Prompt Attacks Learn Surface Heuristics","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7166809705","doi":"https://doi.org/10.18653/v1/2026.acl-long.502"},"language":"en","primary_location":{"id":"doi:10.18653/v1/2026.acl-long.502","doi":"https://doi.org/10.18653/v1/2026.acl-long.502","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2026.acl-long.502","pdf_url":"https://aclanthology.org/2026.acl-long.502.pdf","source":{"id":"https://openalex.org/S4393915740","display_name":"Proceedings of the conference - Association for Computational Linguistics. Meeting","issn_l":"0736-587X","issn":["0736-587X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":["norway-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://aclanthology.org/2026.acl-long.502.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139734504","display_name":"Li Li","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li Li","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139729253","display_name":"Chenxiao Yu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I1174212","display_name":"University of Southern California","ror":"https://ror.org/03taz7m60","country_code":"US","type":"education","lineage":["https://openalex.org/I1174212"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chenxiao Yu","raw_affiliation_strings":["University of Southern California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Southern California","institution_ids":["https://openalex.org/I1174212"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114137002","display_name":"Zhiyu Ni","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhiyu Ni","raw_affiliation_strings":["University of California , Berkeley"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California , Berkeley","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139836816","display_name":"Hao Li","orcid":"https://orcid.org/0009-0002-0090-4870","observed_orcids":["https://orcid.org/0009-0002-0090-4870"]},"institutions":[{"id":"https://openalex.org/I204465549","display_name":"Washington University in St. Louis","ror":"https://ror.org/01yc7t268","country_code":"US","type":"education","lineage":["https://openalex.org/I204465549"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hao Li","raw_affiliation_strings":["Washington University in St. Louis"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Washington University in St. Louis","institution_ids":["https://openalex.org/I204465549"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010781829","display_name":"Charith Peris","orcid":"https://orcid.org/0000-0003-3648-8389","observed_orcids":["https://orcid.org/0000-0003-3648-8389"]},"institutions":[{"id":"https://openalex.org/I1311688040","display_name":"Amazon (United States)","ror":"https://ror.org/04mv4n011","country_code":"US","type":"company","lineage":["https://openalex.org/I1311688040"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Charith Peris","raw_affiliation_strings":["Amazon"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Amazon","institution_ids":["https://openalex.org/I1311688040"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122965821","display_name":"Chaowei Xiao","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I145311948","display_name":"Johns Hopkins University","ror":"https://ror.org/00za53h95","country_code":"US","type":"education","lineage":["https://openalex.org/I145311948"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chaowei Xiao","raw_affiliation_strings":["Johns Hopkins University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Johns Hopkins University","institution_ids":["https://openalex.org/I145311948"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5139796356","display_name":"Yue Zhao","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I1174212","display_name":"University of Southern California","ror":"https://ror.org/03taz7m60","country_code":"US","type":"education","lineage":["https://openalex.org/I1174212"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yue Zhao","raw_affiliation_strings":["University of Southern California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Southern California","institution_ids":["https://openalex.org/I1174212"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.43643512,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"10970","last_page":"10987"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.796999990940094},{"id":"https://openalex.org/keywords/large-language-model-security","display_name":"large language model security","score":0.7789999842643738},{"id":"https://openalex.org/keywords/prompt-injection-defense","display_name":"prompt injection defense","score":0.5669999718666077},{"id":"https://openalex.org/keywords/supervised-fine-tuning","display_name":"supervised fine-tuning","score":0.753000020980835},{"id":"https://openalex.org/keywords/shortcut-learning","display_name":"shortcut learning","score":0.8069999814033508},{"id":"https://openalex.org/keywords/position-bias","display_name":"position bias","score":0.878000020980835},{"id":"https://openalex.org/keywords/diagnostic-dataset","display_name":"diagnostic dataset","score":0.4909999966621399}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5489000082015991},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.4002000093460083},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.37880000472068787},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.30660000443458557},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2874999940395355},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.27390000224113464},{"id":"https://openalex.org/C2776799497","wikidata":"https://www.wikidata.org/wiki/Q484298","display_name":"Surface (topology)","level":2,"score":0.24390000104904175},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.23690000176429749},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.22300000488758087},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.2224999964237213}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.18653/v1/2026.acl-long.502","doi":"https://doi.org/10.18653/v1/2026.acl-long.502","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2026.acl-long.502","pdf_url":"https://aclanthology.org/2026.acl-long.502.pdf","source":{"id":"https://openalex.org/S4393915740","display_name":"Proceedings of the conference - Association for Computational Linguistics. Meeting","issn_l":"0736-587X","issn":["0736-587X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":["norway-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.18653/v1/2026.acl-long.502","doi":"https://doi.org/10.18653/v1/2026.acl-long.502","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2026.acl-long.502","pdf_url":"https://aclanthology.org/2026.acl-long.502.pdf","source":{"id":"https://openalex.org/S4393915740","display_name":"Proceedings of the conference - Association for Computational Linguistics. Meeting","issn_l":"0736-587X","issn":["0736-587X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":["norway-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G1353381076","display_name":null,"funder_award_id":"2138296","funder_id":"https://openalex.org/F4320312143","funder_display_name":"National Centre for Supercomputing Applications"},{"id":"https://openalex.org/G1453181110","display_name":null,"funder_award_id":"#2138286","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G1503004319","display_name":null,"funder_award_id":"#2138307","funder_id":"https://openalex.org/F4320312143","funder_display_name":"National Centre for Supercomputing Applications"},{"id":"https://openalex.org/G1860245536","display_name":"NSF POSE: Phase II: OpenAD: An Integrated Open-Source Ecosystem for Anomaly Detection","funder_award_id":"2346158","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G1912064254","display_name":"Track 4:  Advanced CI Coordination Ecosystem: Monitoring and Measurement Services","funder_award_id":"2137603","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2610354679","display_name":"POSE: Phase I: OpenTrustLLM: An Open-Source Ecosystem for Trustworthiness in Large Language Models","funder_award_id":"2449280","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G298330452","display_name":null,"funder_award_id":"#2138286","funder_id":"https://openalex.org/F4320312143","funder_display_name":"National Centre for Supercomputing Applications"},{"id":"https://openalex.org/G3562386289","display_name":null,"funder_award_id":"#2138296","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G4006316252","display_name":"Track 1: ACCESS Resource Allocations Marketplace and Platform Services (RAMPS)","funder_award_id":"2138259","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4010157413","display_name":null,"funder_award_id":"2138259","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G4403015908","display_name":null,"funder_award_id":"#2138259","funder_id":"https://openalex.org/F4320312143","funder_display_name":"National Centre for Supercomputing Applications"},{"id":"https://openalex.org/G4676224565","display_name":"ACO: An Open CI Ecosystem to Advance Scientific Discovery (OpenCI)","funder_award_id":"2138296","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G509285653","display_name":"Track 3: COre National Ecosystem for CyberinfrasTructure (CONECT)","funder_award_id":"2138307","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5367127336","display_name":null,"funder_award_id":"#2138307","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G5464919783","display_name":null,"funder_award_id":"2137603","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G8034736573","display_name":"ATD: Multifaceted Large Trajectory Model for Individual and Group Anomalous Behavior Detection from Spatiotemporal Data","funder_award_id":"2428039","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8108599699","display_name":null,"funder_award_id":"#2137603","funder_id":"https://openalex.org/F4320312143","funder_display_name":"National Centre for Supercomputing Applications"},{"id":"https://openalex.org/G8300691027","display_name":"Track 2: Customized Multi-tier Assistance, Training, and Computational Help (MATCH) for End User ACCESS to CI","funder_award_id":"2138286","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320312143","display_name":"National Centre for Supercomputing Applications","ror":"https://ror.org/03r10zj06"},{"id":"https://openalex.org/F4320337377","display_name":"Office of Advanced Cyberinfrastructure","ror":"https://ror.org/04nh1dc89"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7166809705.pdf","grobid_xml":"https://content.openalex.org/works/W7166809705.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7202037975","https://openalex.org/W4416284488","https://openalex.org/W7131834642","https://openalex.org/W7155009583","https://openalex.org/W7127370637","https://openalex.org/W4416549384","https://openalex.org/W7164273814","https://openalex.org/W7131824922","https://openalex.org/W4415314618","https://openalex.org/W7165736730"],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2,38,161,198],"(LLMs)":[3],"are":[4],"increasingly":[5],"deployed":[6],"in":[7,31,68,98,127,134],"security-sensitive":[8],"applications,":[9],"where":[10],"they":[11,63],"must":[12],"follow":[13],"system-or":[14],"developer-specified":[15],"instructions":[16,29],"that":[17,62,172],"define":[18],"the":[19,155,184],"intended":[20,41],"task":[21],"behavior,":[22],"while":[23],"completing":[24],"benign":[25,49,94,135],"user":[26,32],"requests.When":[27],"adversarial":[28],"appear":[30],"queries":[33],"or":[34],"externally":[35],"retrieved":[36],"content,":[37],"may":[39],"override":[40],"logic.Recent":[42],"defenses":[43,175],"rely":[44,64],"on":[45,65],"supervised":[46,206],"finetuning":[47],"with":[48,159],"and":[50,191,199],"malicious":[51],"labels.Although":[52],"these":[53],"methods":[54],"achieve":[55],"high":[56,118],"attack":[57,128],"rejection":[58,78,111,131],"rates,":[59],"we":[60],"find":[61],"narrow":[66],"correlations":[67],"defense":[69,89,156,201],"data":[70,129,157],"rather":[71,182],"than":[72,183],"harmful":[73],"intent,":[74],"leading":[75],"to":[76,116,147,168,178],"systematic":[77,193],"of":[79,166,205],"safe":[80],"inputs.We":[81],"analyze":[82],"three":[83],"recurring":[84],"shortcut":[85],"behaviors":[86],"induced":[87],"by":[88,145],"fine-tuning.Position":[90],"bias":[91,122,150],"arises":[92],"when":[93,124],"content":[95],"placed":[96],"later":[97],"a":[99,138,192],"prompt":[100],"is":[101],"rejected":[102],"at":[103],"much":[104],"higher":[105],"rates;":[106],"across":[107,195],"reasoning":[108],"benchmarks,":[109],"suffix-task":[110],"rises":[112],"from":[113],"below":[114],"10%":[115],"as":[117,119],"90%.Token":[120],"trigger":[121,140],"occurs":[123],"strings":[125],"common":[126],"raise":[130],"probability":[132],"even":[133],"contexts;":[136],"inserting":[137],"single":[139],"token":[141],"increases":[142],"false":[143],"refusals":[144],"up":[146,167],"50%.Topic":[148],"generalization":[149,153],"reflects":[151],"poor":[152],"beyond":[154],"distribution,":[158],"defended":[160],"suffering":[162],"test-time":[163],"accuracy":[164],"drops":[165],"40%.These":[169],"findings":[170],"suggest":[171],"current":[173],"prompt-injection":[174],"frequently":[176],"respond":[177],"attack-like":[179],"surface":[180],"patterns":[181],"underlying":[185],"intent.We":[186],"introduce":[187],"controlled":[188],"diagnostic":[189],"datasets":[190],"evaluation":[194],"two":[196],"base":[197],"multiple":[200],"pipelines,":[202],"highlighting":[203],"limitations":[204],"fine-tuning":[207],"for":[208],"reliable":[209],"LLM":[210],"security.":[211]},"counts_by_year":[],"updated_date":"2026-10-29T09:56:32.521200","created_date":"2026-07-02T00:00:00"}