An Explainable Graph Attention Network for Indirect Prompt Injection Detection in RAG Systems

Summary

Researchers built a Graph Attention Network that flags malicious instructions hidden in documents retrieved for RAG systems, before those documents reach the language model. Each document is split into sentences encoded with a frozen DeBERTa-v3-base model, and a two-layer GAT with about 0.4 million trainable parameters classifies it as benign or malicious. On a 2,000-sample test set of financial and corporate policy documents, the model reached 99.80% accuracy and an F1-score of 0.998, though the authors say performance on unseen data remains to be established.

Topics

• Prompt injection and jailbreaks
• Retrieval-augmented generation

Related items

• InfoTrueFoundry & Straiker | AI Gateway Security for AgentsSimilar attack · Straiker Blog
• InfoThe Agent Smith Dilemma: Governing Agentic IdentitiesSimilar attack · SecurityWeek
• MediumTop AI agent security resources — November 2026Similar attack · Adversa AI Blog
• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• InfoSecureGARD: Dynamic Ontology-Guided Governance for Secure Tool-Using LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)