Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data

Summary

This paper proposes EDIC, a decomposed reward framework that trains LLMs to classify each instruction embedded in external data as beneficial or harmful, then follow the former and reject the latter. A generative judge, initialized by SFT and refined with GRPO, attributes compliance per instruction to produce separate rewards. Across two backbones and five benchmarks, EDIC improves harmful-rejection by up to 7.7% and Arena-Hard-Auto utility by 12.5% on Qwen3-4B over the strongest prior defense.

Related items

• MediumCVE-2026-95183: DeepSeek Harness context-compaction prompt injection via external contentSimilar attack · NVD/CVE Database
• InfoMobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoIgnored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware RetrievalSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoGRAD: Graph-Structured Antibody Defense for LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)