Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation

Summary

ERASE is a defense against multimodal indirect prompt injection that replaces the injected region of image, audio, or video with modality-appropriate blank content while keeping the rest of the media. A student model learns from a frozen base model reading the erased view through on-policy self-distillation. On 3B audio it reaches 60.1% attacked-input accuracy versus 33.1% for ARGUS, within 0.5 points of the undefended clean-input level.

Mitigation

The source describes ERASE as a proposed defense method, not a fix for a specific vulnerability, and states the code will be publicly available upon acceptance.

Topics

• Prompt injection and jailbreaks

Related items

• MediumTop AI coding agent security resources — November 2026Similar attack · Adversa AI Blog
• MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSimilar attack · NVD/CVE Database
• HighCVE-2026-61789: DBHub read-only SQL validation bypass on MySQL and MariaDB connectorsSimilar attack · NVD/CVE Database
• InfoSecPO: Principled Adversarial Training for Prompt Injection SecuritySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)