{"id":"https://openalex.org/W4416034122","doi":"https://doi.org/10.18653/v1/2025.findings-emnlp.1060","title":"Defending against Indirect Prompt Injection by Instruction Detection","display_name":"Defending against Indirect Prompt Injection by Instruction Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4416034122","doi":"https://doi.org/10.18653/v1/2025.findings-emnlp.1060"},"language":"en","primary_location":{"id":"doi:10.18653/v1/2025.findings-emnlp.1060","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-emnlp.1060","pdf_url":"https://aclanthology.org/2025.findings-emnlp.1060.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2025","raw_type":"proceedings-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://aclanthology.org/2025.findings-emnlp.1060.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120308490","display_name":"Tongyu Wen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tongyu Wen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120308491","display_name":"Chenglong Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chenglong Wang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120308492","display_name":"Xiyuan Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiyuan Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120308493","display_name":"Haoyu Tang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haoyu Tang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120308494","display_name":"Yueqi Xie","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yueqi Xie","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120308495","display_name":"Lingjuan Lyu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lingjuan Lyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120308496","display_name":"Zhicheng Dou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhicheng Dou","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5076423724","display_name":"Fangzhao Wu","orcid":"https://orcid.org/0000-0001-9138-1272"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fangzhao Wu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.4373,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.87224296,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"19472","last_page":"19487"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5996000170707703,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5996000170707703,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.15209999680519104,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.12200000137090683,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.61080002784729},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5072000026702881},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.47999998927116394},{"id":"https://openalex.org/keywords/unintended-consequences","display_name":"Unintended consequences","score":0.4027999937534332},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.3005000054836273}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6919000148773193},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.61080002784729},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6086999773979187},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5072000026702881},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.47999998927116394},{"id":"https://openalex.org/C2776889888","wikidata":"https://www.wikidata.org/wiki/Q1135789","display_name":"Unintended consequences","level":2,"score":0.4027999937534332},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3407000005245209},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3398999869823456},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3005000054836273},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2678999900817871},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.26159998774528503},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.25929999351501465},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.25619998574256897}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.18653/v1/2025.findings-emnlp.1060","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-emnlp.1060","pdf_url":"https://aclanthology.org/2025.findings-emnlp.1060.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2025","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2505.06311","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2505.06311","pdf_url":"https://arxiv.org/pdf/2505.06311","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"doi:10.18653/v1/2025.findings-emnlp.1060","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-emnlp.1060","pdf_url":"https://aclanthology.org/2025.findings-emnlp.1060.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: EMNLP 2025","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416034122.pdf","grobid_xml":"https://content.openalex.org/works/W4416034122.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"integration":[1,23],"of":[2,26,57,69,74,98,131],"Large":[3],"Language":[4],"Models":[5],"(LLMs)":[6],"with":[7,14],"external":[8,37,61],"sources":[9],"is":[10,157],"becoming":[11],"increasingly":[12],"common,":[13],"Retrieval-Augmented":[15],"Generation":[16],"(RAG)":[17],"being":[18],"a":[19,89,128],"prominent":[20],"example.However,":[21],"this":[22,84],"introduces":[24],"vulnerabilities":[25],"Indirect":[27],"Prompt":[28],"Injection":[29],"(IPI)":[30],"attacks,":[31],"where":[32],"hidden":[33,108],"instructions":[34,58],"embedded":[35,59],"in":[36,133,139],"data":[38],"can":[39,64],"manipulate":[40],"LLMs":[41,99],"into":[42],"executing":[43],"unintended":[44],"or":[45],"harmful":[46],"actions.We":[47],"recognize":[48],"that":[49,93],"IPI":[50,82,103],"attacks":[51],"fundamentally":[52],"rely":[53],"on":[54,152],"the":[55,66,71,95,107,134,140,145,153],"presence":[56],"within":[60],"content,":[62],"which":[63],"alter":[65],"behavioral":[67,96],"states":[68,97,109],"LLMs.Can":[70],"effective":[72],"detection":[73,129],"such":[75],"state":[76],"changes":[77],"help":[78],"us":[79],"defend":[80],"against":[81],"attacks?In":[83],"paper,":[85],"we":[86,105],"propose":[87],"InstructDetector,":[88],"novel":[90],"detection-based":[91],"approach":[92],"leverages":[94],"to":[100,149],"identify":[101],"potential":[102],"attacks.Specifically,":[104],"demonstrate":[106],"and":[110,137,143],"gradients":[111],"from":[112],"intermediate":[113],"layers":[114],"provide":[115],"highly":[116],"discriminative":[117],"features":[118],"for":[119],"instruction":[120],"detection.By":[121],"effectively":[122],"combining":[123],"these":[124],"features,":[125],"InstructDetector":[126],"achieves":[127],"accuracy":[130],"99.60%":[132],"in-domain":[135],"setting":[136],"96.90%":[138],"out-of-domain":[141],"setting,":[142],"reduces":[144],"attack":[146],"success":[147],"rate":[148],"just":[150],"0.03%":[151],"BIPIA":[154],"benchmark.The":[155],"code":[156],"publicly":[158],"available":[159],"at":[160],"https://github.com/MYVAE/Instructiondetection.":[161]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-06T08:01:05.025921","created_date":"2025-10-10T00:00:00"}