{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,31]],"date-time":"2026-10-31T20:04:36Z","timestamp":1793477076590,"version":"4.5.0"},"reference-count":69,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/satml68715.2026.00017","type":"proceedings-article","created":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T19:10:56Z","timestamp":1790104256000},"page":"139-157","source":"Crossref","is-referenced-by-count":1,"title":["Defending Against Prompt Injection with DataFilter"],"prefix":"10.1109","author":[{"given":"Yizhu","family":"Wang","sequence":"first","affiliation":[{"name":"UC Berkeley"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sizhe","family":"Chen","sequence":"additional","affiliation":[{"name":"UC Berkeley"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Raghad","family":"Alkhudair","sequence":"additional","affiliation":[{"name":"KACST"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Basel","family":"Alomair","sequence":"additional","affiliation":[{"name":"KACST"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Wagner","sequence":"additional","affiliation":[{"name":"UC Berkeley"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Introducing computer use, a new claude 3.5 sonnet, and claude 3.5 haiku","year":"2024"},{"key":"ref2","article-title":"Operator system card","year":"2025"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623985"},{"key":"ref4","article-title":"Ignore previous prompt: Attack techniques for language models","volume-title":"NeurIPS ML Safety Workshop","author":"Perez"},{"key":"ref5","article-title":"Zombais: From prompt injection to c2 with claude computer use","author":"Rehberger","year":"2024"},{"key":"ref6","article-title":"Chatgpt operator: Prompt injection exploits & defenses","author":"Red","year":"2025"},{"key":"ref7","article-title":"Hacking google bard - from prompt injection to data exfiltration","author":"Rehberger","year":"2023"},{"key":"ref8","article-title":"2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps","year":"2025"},{"key":"ref9","article-title":"Defeating prompt injections by design","author":"Debenedetti","year":"2025"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.emnlp-main.53"},{"key":"ref11","article-title":"cellmate: Sandboxing browser ai agents","author":"Meng","year":"2025"},{"key":"ref12","article-title":"The attacker moves second: Stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections","author":"Nasr","year":"2025"},{"key":"ref13","article-title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","author":"Chen","year":"2025"},{"key":"ref14","article-title":"StruQ: Defending against prompt injection with structured queries","volume-title":"USENIX Security Symposium","author":"Chen"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3744836"},{"key":"ref16","article-title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","author":"Wallace","year":"2024"},{"key":"ref17","article-title":"Lessons from defending gemini against indirect prompt injections","author":"Shi","year":"2025"},{"key":"ref18","article-title":"Rl is a hammer and llms are nails: A simple reinforcement learning recipe for strong prompt injection","author":"Wen","year":"2025"},{"key":"ref19","article-title":"PromptArmor: Simple yet effective prompt injection defenses","author":"Shi","year":"2025"},{"key":"ref20","article-title":"Learn prompting","author":"Schulhoff","year":"2023"},{"key":"ref21","article-title":"Can llms separate instructions from data? and what do we even mean by that?","volume-title":"International Conference on Learning Representations (ICLR)","author":"Zverev"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.624"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2636"},{"key":"ref24","article-title":"AlpacaEval: An Automatic Evaluator of Instruction-following Models","author":"Li","year":"2023"},{"key":"ref25","article-title":"Slack ai"},{"key":"ref26","article-title":"Data exfiltration from slack ai via indirect prompt injection","year":"2024"},{"key":"ref27","article-title":"Introducing operator","year":"2025"},{"key":"ref28","article-title":"Comet browser: A personal ai assistant","year":"2025"},{"key":"ref29","article-title":"Agentic browser security: Indirect prompt injection in perplexity comet","year":"2025"},{"key":"ref30","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023"},{"key":"ref31","article-title":"GPT-5 system card","year":"2025"},{"key":"ref32","article-title":"System card: Claude sonnet 4.5","year":"2025"},{"key":"ref33","article-title":"New prompt injection attacks spotted in bing chat and copilot sidebar","author":"Vincent","year":"2023","journal-title":"SecurityWeek"},{"key":"ref34","article-title":"Cve-2025-32711: Echoleak \u2013 email-based prompt injection in microsoft 365 copilot","year":"2025"},{"key":"ref35","article-title":"Formalizing and benchmarking prompt injection attacks and defenses","volume-title":"USENIX Security Symposium","author":"Liu"},{"key":"ref36","article-title":"Prompt injection attacks against GPT-3","author":"Willison","year":"2022"},{"key":"ref37","article-title":"Automatic and universal prompt injection attacks against large language models","author":"Liu","year":"2024"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3689932.3694764"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.52202\/085713-0666"},{"key":"ref40","article-title":"Redteamcua: Realistic adversarial testing of computer-use agents in hybrid web-os environments","author":"Liao","year":"2025"},{"key":"ref41","article-title":"Prompt guard","year":"2024"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00250"},{"key":"ref43","article-title":"UniGuardian: A unified defense for detecting prompt injection, backdoor attacks and adversarial attacks in large language models","author":"Lin","year":"2025"},{"key":"ref44","article-title":"Attention is all you need","author":"Vaswani","year":"2017"},{"key":"ref45","article-title":"Prompt shields in azure ai","author":"Zarfati","year":"2024"},{"key":"ref46","article-title":"Instructional segment embedding: Improving llm safety with instruction hierarchy","volume-title":"International Conference on Learning Representations (ICLR)","author":"Wu"},{"key":"ref47","doi-asserted-by":"crossref","DOI":"10.1109\/TPAMI.2026.3660147","article-title":"Jailbreak and guard aligned language models with only few in-context demonstrations","volume-title":"International Conference on Machine Learning (ICML)","author":"Wei"},{"key":"ref48","article-title":"Sandwich defense","author":"Schulhoff","year":"2024"},{"key":"ref49","article-title":"Effectively controlling reasoning models through thinking intervention","author":"Wu","year":"2025"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3690624.3709179"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3733799.3762982"},{"key":"ref52","article-title":"MELON: Provable defense against indirect prompt injection attacks in ai agents","volume-title":"International Conference on Machine Learning (ICML)","author":"Zhu"},{"key":"ref53","article-title":"The dual llm pattern for building ai assistants that can resist prompt injection","author":"Willison","year":"2023"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241131"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/SP63933.2026.00105"},{"key":"ref56","article-title":"Defending against indirect prompt injection attacks with spotlighting","author":"Hines","year":"2024"},{"key":"ref57","first-page":"1519","article-title":"Detection of imperative and declarative question-answer pairs in email conversations","volume-title":"International Joint Conference on Artificial Intelligence (IJCAI)","author":"Kwong"},{"key":"ref58","article-title":"Introducing llama 3.1: Our most capable models to date","year":"2024"},{"key":"ref59","article-title":"Stanford Alpaca: An Instruction-following LLaMA model","author":"Taori","year":"2023"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3571730"},{"key":"ref61","article-title":"Zero"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1308"},{"key":"ref63","article-title":"Length-controlled alpacaeval: A simple way to debias automatic evaluators","author":"Dubois","year":"2024"},{"key":"ref64","article-title":"Chatbot Arena: An Open Platform for Evaluating LLMs by Human Preference","volume-title":"International Conference on Machine Learning (ICML)","author":"Chiang"},{"key":"ref65","article-title":"Stronger enforcement of instruction hierarchy via augmented intermediate representations","author":"Kariyappa","year":"2025"},{"key":"ref66","article-title":"Llama 3.1 8b instruct - apl, providers, stats openrouter"},{"key":"ref67","article-title":"Chatgpt 4o - apl, providers, stats openrouter"},{"key":"ref68","article-title":"Gpt 5.1 - apl, providers, stats openrouter"},{"key":"ref69","article-title":"Cleaned Alpaca Dataset","author":"Ruebsamen","year":"2024"}],"event":{"name":"2026 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","location":"Munich, Germany","start":{"date-parts":[[2026,3,23]]},"end":{"date-parts":[[2026,3,25]]}},"container-title":["2026 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11691582\/11691603\/11691927.pdf?arnumber=11691927","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T05:16:28Z","timestamp":1790140588000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11691927\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":69,"URL":"https:\/\/doi.org\/10.1109\/satml68715.2026.00017","relation":{},"subject":[],"published":{"date-parts":[[2026,3]]}}}