SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense

Summary

SpanGuard is a lightweight guardrail against indirect prompt injection (IPI) that splits detection into two steps. It first locates candidate injected instructions in tool outputs using unsupervised segmentation, then uses a small language model to judge whether each block is authorized by the user's request. The authors report a 0.32% attack success rate with negligible loss in benign utility, while remaining effective with substantially smaller models.

Topics

• Prompt injection and jailbreaks

Related items

• HighCVE-2026-77926: Aix-DB remote code execution through ChatBI common agent execute toolSimilar attack · NVD/CVE Database
• HighCVE-2026-109440: LangAlpha indirect prompt injection through agent-retrieved web contentSimilar attack · NVD/CVE Database
• HighCVE-2026-107366: IBM Langflow OSS message endpoints lack ownership verificationSimilar attack · NVD/CVE Database
• HighCVE-2026-112308: crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows…Similar attack · NVD/CVE Database
• InfoFake News, Real Crashes: Information Injection Attacks on LLM Financial Trading AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)