{"id":"https://openalex.org/W7204201953","doi":"https://doi.org/10.18653/2026.findings-emnlp.188","title":"Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds","display_name":"Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7204201953","doi":"https://doi.org/10.18653/2026.findings-emnlp.188"},"language":"en","primary_location":{"id":"doi:10.18653/2026.findings-emnlp.188","doi":"https://doi.org/10.18653/2026.findings-emnlp.188","is_oa":true,"landing_page_url":"https://doi.org/10.18653/2026.findings-emnlp.188","pdf_url":"https://aclanthology.org/2026.findings-emnlp.188.pdf","source":{"id":"https://openalex.org/S7407096085","display_name":"Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310320244","host_organization_name":"Association for Computational Linguistics","host_organization_lineage":["https://openalex.org/P4310320244"],"host_organization_lineage_names":["Association for Computational Linguistics"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2026","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://aclanthology.org/2026.findings-emnlp.188.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5149684049","display_name":"Jiahao Chen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiahao Chen","raw_affiliation_strings":["Zhejiang University ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University ,","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135221609","display_name":"Rui Yin","orcid":"https://orcid.org/0009-0008-0484-926X","observed_orcids":["https://orcid.org/0009-0008-0484-926X"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rui Yin","raw_affiliation_strings":["Zhejiang University ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University ,","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148137331","display_name":"Xinfeng Li","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Xinfeng Li","raw_affiliation_strings":["Hong Kong Polytechnic University ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hong Kong Polytechnic University ,","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125702910","display_name":"Qianli Ma","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qianli Ma","raw_affiliation_strings":["University of Science and Technology of China ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Science and Technology of China ,","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139755055","display_name":"Tianyu Du","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tianyu Du","raw_affiliation_strings":["Zhejiang University ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University ,","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122824884","display_name":"Zhihui Fu","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhihui Fu","raw_affiliation_strings":["OPPO Research Institute {xaddwell , ruiyin ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"OPPO Research Institute {xaddwell , ruiyin ,","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148051840","display_name":"Jun Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jun Wang","raw_affiliation_strings":["OPPO Research Institute {xaddwell , ruiyin ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"OPPO Research Institute {xaddwell , ruiyin ,","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108924762","display_name":"Zhaoxiang Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhaoxiang Wang","raw_affiliation_strings":["OPPO Research Institute {xaddwell , ruiyin ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"OPPO Research Institute {xaddwell , ruiyin ,","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5124853295","display_name":"Shouling Ji","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shouling Ji","raw_affiliation_strings":["Zhejiang University ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University ,","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.678632,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"3995","last_page":"4001"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/indirect-prompt-injection","display_name":"indirect prompt injection","score":0.9929999709129333},{"id":"https://openalex.org/keywords/large-language-model-security","display_name":"large language model security","score":0.8450000286102295},{"id":"https://openalex.org/keywords/over-refusal","display_name":"over-refusal","score":0.7829999923706055},{"id":"https://openalex.org/keywords/prompt-injection-defense","display_name":"prompt injection defense","score":0.4650000035762787},{"id":"https://openalex.org/keywords/safety-utility-trade-off","display_name":"safety-utility trade-off","score":0.8220000267028809},{"id":"https://openalex.org/keywords/ai-coding-agents","display_name":"coding agents","score":0.7649999856948853}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7968000173568726},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7020000219345093},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.6672999858856201},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5723000168800354},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.5309000015258789},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4309999942779541},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.4163999855518341},{"id":"https://openalex.org/C166052673","wikidata":"https://www.wikidata.org/wiki/Q83021","display_name":"Empirical evidence","level":2,"score":0.40139999985694885},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.38029998540878296},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35409998893737793},{"id":"https://openalex.org/C2779304628","wikidata":"https://www.wikidata.org/wiki/Q3503480","display_name":"Face (sociological concept)","level":2,"score":0.3359000086784363},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.33160001039505005},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.3312000036239624},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.32679998874664307},{"id":"https://openalex.org/C2778717966","wikidata":"https://www.wikidata.org/wiki/Q4189076","display_name":"Protection mechanism","level":3,"score":0.31709998846054077},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.27959999442100525},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.26330000162124634},{"id":"https://openalex.org/C2992838255","wikidata":"https://www.wikidata.org/wiki/Q856887","display_name":"Security guard","level":2,"score":0.26170000433921814},{"id":"https://openalex.org/C2993069335","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical examination","level":2,"score":0.26159998774528503},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.25780001282691956},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.2574000060558319}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.18653/2026.findings-emnlp.188","doi":"https://doi.org/10.18653/2026.findings-emnlp.188","is_oa":true,"landing_page_url":"https://doi.org/10.18653/2026.findings-emnlp.188","pdf_url":"https://aclanthology.org/2026.findings-emnlp.188.pdf","source":{"id":"https://openalex.org/S7407096085","display_name":"Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310320244","host_organization_name":"Association for Computational Linguistics","host_organization_lineage":["https://openalex.org/P4310320244"],"host_organization_lineage_names":["Association for Computational Linguistics"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2026","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2608.22248","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.22248","pdf_url":"https://arxiv.org/pdf/2608.22248","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.22248","doi":"https://doi.org/10.48550/arxiv.2608.22248","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.22248","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.18653/2026.findings-emnlp.188","doi":"https://doi.org/10.18653/2026.findings-emnlp.188","is_oa":true,"landing_page_url":"https://doi.org/10.18653/2026.findings-emnlp.188","pdf_url":"https://aclanthology.org/2026.findings-emnlp.188.pdf","source":{"id":"https://openalex.org/S7407096085","display_name":"Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310320244","host_organization_name":"Association for Computational Linguistics","host_organization_lineage":["https://openalex.org/P4310320244"],"host_organization_lineage_names":["Association for Computational Linguistics"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2026","raw_type":"proceedings-article"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204201953.pdf","grobid_xml":"https://content.openalex.org/works/W7204201953.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4416956370","https://openalex.org/W7131426034","https://openalex.org/W7154209825","https://openalex.org/W7221059640","https://openalex.org/W4416037246","https://openalex.org/W4416034122","https://openalex.org/W7120124968","https://openalex.org/W4417293467","https://openalex.org/W4407310643","https://openalex.org/W7135043996"],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"integrated":[4],"into":[5],"complex":[6],"ecosystems":[7],"(e.g.,":[8],"code":[9],"agents)":[10],"face":[11,30],"critical":[12],"safety":[13],"threats":[14],"from":[15,44,59],"Indirect":[16],"Prompt":[17],"Injection":[18,71],"(IPI)":[19],"attacks,":[20],"where":[21],"malicious":[22,82],"instructions":[23,58,83],"are":[24],"embedded":[25],"in":[26],"retrieved":[27],"data.Existing":[28],"defenses":[29],"an":[31],"intractable":[32],"safety-utility":[33],"tradeoff:":[34],"sanitization-based":[35],"guardrails":[36,42],"incur":[37],"high":[38],"latency,":[39],"while":[40,113],"detection-based":[41],"suffer":[43],"severe":[45],"over-refusal.We":[46],"first":[47],"demonstrate,":[48],"both":[49],"theoretically":[50],"and":[51,84,103],"empirically,":[52],"that":[53,76,90,107],"LLMs":[54],"can":[55],"intrinsically":[56],"separate":[57],"data.Inspired":[60],"by":[61],"this":[62],"insight,":[63],"we":[64],"propose":[65],"AEGIS":[66,108],"(Adaptive":[67],"Ensemble":[68],"Guard":[69],"for":[70],"Shielding),":[72],"a":[73,86],"training-free":[74],"defense":[75],"extracts":[77],"instruction-sensitive":[78],"projectors":[79],"to":[80,122],"identify":[81],"leverages":[85],"Unified":[87],"Multi-Layer":[88],"Consensus":[89],"aggregates":[91],"topologically":[92],"distinct":[93],"signals":[94],"across":[95],"the":[96,115],"network":[97],"depth.Evaluations":[98],"on":[99,119],"eight":[100],"IPI":[101],"attacks":[102],"ten":[104],"baselines":[105],"show":[106],"achieves":[109],"state-ofthe-art":[110],"detection":[111],"accuracy":[112],"reducing":[114],"false":[116],"positive":[117],"rate":[118],"benign":[120],"tasks":[121],"below":[123],"1%.Code":[124],"is":[125],"available":[126],"at":[127],"Github.":[128]},"counts_by_year":[],"updated_date":"2026-10-31T12:09:11.096373","created_date":"2026-08-26T00:00:00"}