Prompt injection defenses evaluated on synthetic benchmarks do not generalize to real enterprise documents, which are longer, denser, and interleave legitimate authority language with factual content. We demonstrate this gap with a real-document benchmark of 122 tasks across five professional domains (financial, legal, medical, scientific, DevOps) using actual SEC filings, Federal Register rules, PubMed abstracts, arXiv papers, and GitHub postmortems. Paraphrasing, the strongest defense on synthetic benchmarks, shows no statistically significant attack success rate reduction on real documents (p=0.500) while degrading utility from 91.8% to 82.8%. We introduce PARSE (Provenance-Aware Retrieval Sanitization), a domain-aware, fact-preserving sanitization pipeline that classifies each sentence by injection likelihood, extracts structured facts before rewriting, and verifies fact preservation via a consistency-checking loop. A directiveness gate routes 59% of real enterprise documents to a lightweight path, concentrating computational cost on high-risk documents. PARSE achieves 15.6% attack success rate -- a 38% reduction versus the 25.4% baseline -- at 86.9% utility, the only condition that is both statistically significant (p=0.014, adequately powered) and maintains near-baseline utility. Practitioners should evaluate defenses on domain-matched real documents, not synthetic proxies.

翻译：针对提示注入攻击的防御措施在合成基准测试中表现良好，但无法泛化至真实企业文档——这类文档长度更长、密度更高，且将合法权威语言与事实性内容交织呈现。我们通过包含122个任务、覆盖五大专业领域（金融、法律、医学、科学、DevOps）的真实文档基准（采用SEC文件、联邦公报法规、PubMed摘要、arXiv论文及GitHub事后分析报告）证明了该差距。在合成基准测试中表现最强的防御策略——释义重写，在真实文档中并未显示出统计学显著性的攻击成功率降低（p=0.500），同时将效用从91.8%降至82.8%。我们提出PARSE（溯源感知检索净化）方法——一种领域感知、事实保留的净化流水线：首先按注入概率对每个句子分类，然后在重写前提取结构化事实，并通过一致性检查循环验证事实保留情况。导向性门控将59%的真实企业文档路由至轻量级路径，将计算成本集中于高风险文档。PARSE实现了15.6%的攻击成功率——相较于25.4%的基线降低38%——并在保持86.9%效用的条件下成为唯一既具有统计学显著性（p=0.014且检验效能充分）又接近基线效用的方案。实践者应使用领域匹配的真实文档而非合成代理进行评估防御措施。