LLM-integrated applications are vulnerable to prompt injection attacks, where an attacker contaminates the input to inject malicious instructions, causing the LLM to follow the attacker's intent instead of the original user's. Existing prompt injection detection methods often have sub-optimal performance and/or high computational overhead. In this work, we propose PIShield, an effective and efficient detection method based on the observation that instruction-tuned LLMs internally encode distinguishable signals for prompts containing injected instructions. PIShield leverages residual-stream representations and a simple linear classifier to detect prompt injection, without expensive model fine-tuning or response generation. We conduct extensive evaluations on a diverse set of short- and long-context benchmarks. The results show that PIShield consistently achieves low false positive and false negative rates, significantly outperforming existing baselines. These findings demonstrate that internal representations of instruction-tuned LLMs provide a powerful and practical foundation for prompt injection detection in real-world applications.

翻译：大语言模型集成应用易受提示注入攻击，攻击者通过污染输入注入恶意指令，导致大语言模型遵循攻击者意图而非原始用户意图。现有提示注入检测方法常存在性能欠佳和/或计算开销过高的问题。本研究提出PIShield，一种基于指令调优大语言模型对含注入指令提示词存在内部可区分信号观测的高效检测方法。PIShield利用残差流表征与简单线性分类器实现提示注入检测，无需昂贵的模型微调或响应生成。我们在多样化短上下文与长上下文基准测试上开展广泛评估。结果表明PIShield持续实现低误报率与漏报率，显著优于现有基线方法。这些发现证明指令调优大语言模型的内部表征为实际应用中的提示注入检测提供了强大而实用的基础。