When large language model (LLM) agents are increasingly deployed to automate tasks and interact with untrusted external data, prompt injection emerges as a significant security threat. By injecting malicious instructions into the data that LLMs access, an attacker can arbitrarily override the original user task and redirect the agent toward unintended, potentially harmful actions. Existing defenses either require access to model weights (fine-tuning), incur substantial utility loss (detection-based), or demand non-trivial system redesign (system-level). Motivated by this, we propose DataFilter, a test-time model-agnostic defense that removes malicious instructions from the data before it reaches the backend LLM. DataFilter is trained with supervised fine-tuning on simulated injections and leverages both the user's instruction and the data to selectively strip adversarial content while preserving benign information. Across multiple benchmarks, DataFilter consistently reduces the prompt injection attack success rates to near zero while maintaining the LLMs' utility. DataFilter delivers strong security, high utility, and plug-and-play deployment, making it a strong practical defense to secure black-box commercial LLMs against prompt injection. Our DataFilter model is released at https://huggingface.co/JoyYizhu/DataFilter for immediate use, with the code to reproduce our results at https://github.com/yizhu-joy/DataFilter.

翻译：随着大型语言模型（LLM）智能体日益广泛地部署于任务自动化及与不可信外部数据的交互中，提示注入已成为一项重大的安全威胁。攻击者通过向LLM访问的数据中注入恶意指令，能够任意覆盖原始用户任务，并将智能体导向非预期且可能有害的操作。现有防御方法或需访问模型权重（微调），或导致显著的效用损失（基于检测的方法），或要求复杂的系统重构（系统级方法）。受此启发，我们提出DataFilter——一种在测试时使用的、与模型无关的防御机制，其核心是在数据抵达后端LLM之前移除其中的恶意指令。DataFilter通过在有监督微调下利用模拟注入数据进行训练，并同时结合用户指令与数据内容，以选择性剥离对抗性内容，同时保留良性信息。在多个基准测试中，DataFilter持续将提示注入攻击成功率降低至接近零，同时保持了LLM的实用性。DataFilter具备强大的安全性、高实用性以及即插即用的部署特性，使其成为保护黑盒商用LLM免受提示注入攻击的一种强效实用防御方案。我们的DataFilter模型已发布于 https://huggingface.co/JoyYizhu/DataFilter 以供即时使用，复现实验结果的代码可在 https://github.com/yizhu-joy/DataFilter 获取。