Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction

[2504.20472] Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction Skip to main content Search Submit Donate Log in Search arXiv Press Enter to search · Advanced search Computer Science > Cryptography and Security arXiv:2504.20472 (cs) [Submitted on 29 Apr 2025 ( v1 ), last revised 9 Apr 2026 (this version, v2)] Title: Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction Authors: Yulin Chen , Haoran Li , Yuan Sui , Yue Liu , Yufei He , Xiaoling Bai , Chi Fei , Yabo Li , Haozhe Ma , Yangqiu Song , Bryan Hooi View a PDF of the paper titled Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction, by Yulin Chen and 9 other authors View PDF HTML (experimental) Abstract: Large language models (LLMs) have demonstrated impressive performance and have come to dominate the field of natural language processing (NLP) across various tasks. However, due to their strong instruction-following capabilities and inability to distinguish between instructions and data content, LLMs are vulnerable to prompt injection attacks. These attacks manipulate LLMs into deviating from the original input instructions and executing maliciously injected instructions within data content, such as web documents retrieved from search engines. Existing defense methods, including prompt-engineering and fine-tuning approaches, typically instruct models to follow the original input instructions while suppressing their tendencies to execute injected instructions. However, our experiments reveal that suppressing instruction-following tendencies is challenging. Through analyzing failure cases, we observe that although LLMs tend to respond to any recognized instructions, they are aware of which specific instructions they are executing and can correctly reference them within the original prompt. Motivated by these findings, we propose a novel defense method that leverages, rather than suppresses, the instruction-following abilities of LLMs. Our approach prompts LLMs to generate responses that include both answers and their corresponding instruction references. Based on these references, we filter out answers not associated with the original input instructions. Comprehensive experiments demonstrate that our method outperforms prompt-engineering baselines and achieves performance comparable to fine-tuning methods, reducing the attack success rate (ASR) to 0 percent in some scenarios. Moreover, our approach has minimal impact on overall utility. Comments: ACL 2026 Findings Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2504.20472 [cs.CR] (or arXiv:2504.20472v2 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2504.20472 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Yulin Chen [ view email ] [v1] Tue, 29 Apr 2025 07:13:53 UTC (297 KB) [v2] Thu, 9 Apr 2026 06:57:42 UTC (204 KB) Full-text links: Access Paper: View a PDF of the paper titled Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction, by Yulin Chen and 9 other authors View PDF HTML (experimental) TeX Source view license Current browse context: cs.CR < prev | next > new | recent | 2025-04 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar export BibTeX citation Loading... BibTeX formatted citation × loading... Data provided by: Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab) Major funding support from

Related documents

• CVE-2026-4921 — LOW 2.7#1081056
• CVE-2026-82832 — CRITICAL 9.6#1001284
• CVE-2026-6928 — CRITICAL 9.8#1067165
• TOMOYO Linux: A Mandatory Access Control Method Based on Application Execution State#267746
• The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents#10281