{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,30]],"date-time":"2026-10-30T07:47:31Z","timestamp":1793346451527,"version":"4.5.0"},"publisher-location":"New York, NY, USA","reference-count":44,"publisher":"ACM","funder":[{"name":"National Science Foundation","award":["2530786"],"award-info":[{"award-number":["2530786"]}]},{"name":"National Science Foundation","award":["2450935"],"award-info":[{"award-number":["2450935"]}]},{"name":"National Science Foundation","award":["2414406"],"award-info":[{"award-number":["2414406"]}]},{"name":"National Science Foundation","award":["2112562"],"award-info":[{"award-number":["2112562"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,7,8]]},"DOI":"10.1145\/3750555.3811884","type":"proceedings-article","created":{"date-parts":[[2026,6,24]],"date-time":"2026-06-24T18:14:56Z","timestamp":1782324896000},"page":"265-270","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["A Critical Evaluation of Defenses against Prompt Injection Attacks: [Dataset\/Tool Paper]"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-2954-3609","authenticated-orcid":false,"given":"Yuqi","family":"Jia","sequence":"first","affiliation":[{"name":"Duke University, Durham, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-6022-8654","authenticated-orcid":false,"given":"Zedian","family":"Shao","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4300-758X","authenticated-orcid":false,"given":"Yupei","family":"Liu","sequence":"additional","affiliation":[{"name":"The Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9785-7769","authenticated-orcid":false,"given":"Jinyuan","family":"Jia","sequence":"additional","affiliation":[{"name":"The Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9745-6802","authenticated-orcid":false,"given":"Dawn","family":"Song","sequence":"additional","affiliation":[{"name":"University of California, Berkeley, Berkeley, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9900-9309","authenticated-orcid":false,"given":"Neil","family":"Gong","sequence":"additional","affiliation":[{"name":"Duke University, Durham, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,8]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Detecting Language Model Attacks with Perplexity. arXiv","author":"Alon Gabriel","year":"2023","unstructured":"Gabriel Alon and Michael Kamfonas. 2023. Detecting Language Model Attacks with Perplexity. arXiv (2023)."},{"key":"e_1_3_2_1_2_1","volume-title":"International conference on machine learning. PMLR, 274-283","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning. PMLR, 274-283."},{"key":"e_1_3_2_1_3_1","volume-title":"Embedding-based classifiers can detect prompt injection attacks. arXiv preprint arXiv:2410.22284","author":"Ayub Md Ahsan","year":"2024","unstructured":"Md Ahsan Ayub and Subhabrata Majumdar. 2024. Embedding-based classifiers can detect prompt injection attacks. arXiv preprint arXiv:2410.22284 (2024)."},{"key":"e_1_3_2_1_4_1","volume-title":"Jeremy McHugh, Leyla Hujer, Aditya Bahl, Daniel del Castillo Iglesias, Ron Heichman, and Ramesh Darwishi.","author":"Branch Hezekiah J.","year":"2022","unstructured":"Hezekiah J. Branch, Jonathan Rodriguez Cefalu, Jeremy McHugh, Leyla Hujer, Aditya Bahl, Daniel del Castillo Iglesias, Ron Heichman, and Ramesh Darwishi. 2022. Evaluating the Susceptibility of Pre-Trained Language Models via Handcrafted Adversarial Examples. arXiv (2022)."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"e_1_3_2_1_6_1","volume-title":"StruQ: Defending Against Prompt Injection with Structured Queries. In USENIX Security Symposium.","author":"Chen Sizhe","year":"2025","unstructured":"Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. 2025. StruQ: Defending Against Prompt Injection with Structured Queries. In USENIX Security Symposium."},{"key":"e_1_3_2_1_7_1","volume-title":"Aligning LLMs to Be Robust Against Prompt Injection. arXiv preprint arXiv:2410.05451","author":"Chen Sizhe","year":"2024","unstructured":"Sizhe Chen, Arman Zharmagambetov, Saeed Mahloujifar, Kamalika Chaudhuri, and Chuan Guo. 2024. Aligning LLMs to Be Robust Against Prompt Injection. arXiv preprint arXiv:2410.05451 (2024)."},{"key":"e_1_3_2_1_8_1","volume-title":"Rohan Taori, Tianyi Zhang, Ishaan Gulrajani, Jimmy Ba, Carlos Guestrin, Percy S Liang, and Tatsunori B Hashimoto.","author":"Dubois Yann","year":"2024","unstructured":"Yann Dubois, Chen Xuechen Li, Rohan Taori, Tianyi Zhang, Ishaan Gulrajani, Jimmy Ba, Carlos Guestrin, Percy S Liang, and Tatsunori B Hashimoto. 2024. Alpacafarm: A simulation framework for methods that learn from human feedback. Advances in Neural Information Processing Systems, Vol. 36 (2024)."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"crossref","unstructured":"Kai Greshake Sahar Abdelnabi Shailesh Mishra Christoph Endres Thorsten Holz and Mario Fritz. 2023. Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In AISec.","DOI":"10.1145\/3605764.3623985"},{"key":"e_1_3_2_1_10_1","unstructured":"Rich Harang. 2023. Securing LLM Systems Against Prompt Injection. https:\/\/developer.nvidia.com\/blog\/securing-llm-systems-against-prompt-injection."},{"key":"e_1_3_2_1_11_1","volume-title":"Deberta: Decoding-enhanced bert with disentangled attention. arXiv preprint arXiv:2006.03654","author":"He Pengcheng","year":"2020","unstructured":"Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. 2020. Deberta: Decoding-enhanced bert with disentangled attention. arXiv preprint arXiv:2006.03654 (2020)."},{"key":"e_1_3_2_1_12_1","volume-title":"Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300","author":"Hendrycks Dan","year":"2020","unstructured":"Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2020. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300 (2020)."},{"key":"e_1_3_2_1_13_1","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Hendrycks Dan","year":"2021","unstructured":"Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring Massive Multitask Language Understanding. Proceedings of the International Conference on Learning Representations (ICLR) (2021)."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"crossref","unstructured":"Bo Hui Haolin Yuan Neil Gong Philippe Burlina and Yinzhi Cao. 2024. PLeak: Prompt Leaking Attacks against Large Language Model Applications. In CCS.","DOI":"10.1145\/3658644.3670370"},{"key":"e_1_3_2_1_15_1","volume-title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs. arXiv preprint arXiv:2411.00348","author":"Hung Kuo-Han","year":"2024","unstructured":"Kuo-Han Hung, Ching-Yun Ko, Ambrish Rawat, I-Hsin Chung, Winston H. Hsu, and Pin-Yu Chen. 2024. Attention Tracker: Detecting Prompt Injection Attacks in LLMs. arXiv preprint arXiv:2411.00348 (2024)."},{"key":"e_1_3_2_1_16_1","volume-title":"Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein.","author":"Jain Neel","year":"2023","unstructured":"Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline Defenses for Adversarial Attacks Against Aligned Language Models. arXiv (2023)."},{"key":"e_1_3_2_1_17_1","volume-title":"Hashimoto","author":"Li Xuechen","year":"2023","unstructured":"Xuechen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, Ishaan Gulrajani, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. AlpacaEval: An Automatic Evaluator of Instruction-following Models. https:\/\/github.com\/tatsu-lab\/alpaca_eval."},{"key":"e_1_3_2_1_18_1","volume-title":"Automatic and universal prompt injection attacks against large language models. arXiv preprint arXiv:2403.04957","author":"Liu Xiaogeng","year":"2024","unstructured":"Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. 2024b. Automatic and universal prompt injection attacks against large language models. arXiv preprint arXiv:2403.04957 (2024)."},{"key":"e_1_3_2_1_19_1","volume-title":"USENIX Security Symposium.","author":"Liu Yupei","year":"2024","unstructured":"Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024a. Formalizing and benchmarking prompt injection attacks and defenses. In USENIX Security Symposium."},{"key":"e_1_3_2_1_20_1","volume-title":"DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks. In IEEE Symposium on Security and Privacy.","author":"Liu Yupei","year":"2025","unstructured":"Yupei Liu, Yuqi Jia, Jinyuan Jia, Dawn Song, and Neil Zhenqiang Gong. 2025. DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks. In IEEE Symposium on Security and Privacy."},{"key":"e_1_3_2_1_21_1","unstructured":"Alexandra Mendes. 2023. Ultimate ChatGPT prompt engineering guide for general users and developers. https:\/\/www.imaginarycloud.com\/blog\/chatgpt-prompt-engineering."},{"key":"e_1_3_2_1_22_1","unstructured":"Meta. 2024. PromptGuard Prompt Injection Guardrail. https:\/\/www.llama.com\/docs\/model-cards-and-prompt-formats\/prompt-guard\/."},{"key":"e_1_3_2_1_23_1","unstructured":"Yohei Nakajima. 2022. Yohei's blog post. https:\/\/twitter.com\/yoheinakajima\/status\/1582844144640471040."},{"key":"e_1_3_2_1_24_1","unstructured":"OpenAI. 2022. OpenAI GPT-3.5 API [text-davinci-003]. https:\/\/platform.openai.com\/docs\/guides\/text-generation."},{"key":"e_1_3_2_1_25_1","unstructured":"OpenAI. 2024. GPT-4o mini: advancing cost-efficient intelligence. https:\/\/openai.com\/index\/gpt-4o-mini-advancing-cost-efficient-intelligence\/."},{"key":"e_1_3_2_1_26_1","unstructured":"OWASP. 2023. OWASP Top 10 for Large Language Model Applications. https:\/\/owasp.org\/www-project-top-10-for-large-language-model-applications\/assets\/PDF\/OWASP-Top-10-for-LLMs-2023-v1_1.pdf."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3689932.3694764"},{"key":"e_1_3_2_1_28_1","volume-title":"Ignore Previous Prompt: Attack Techniques For Language Models. In NeurIPS ML Safety Workshop.","author":"Perez F\u00e1bio","year":"2022","unstructured":"F\u00e1bio Perez and Ian Ribeiro. 2022a. Ignore Previous Prompt: Attack Techniques For Language Models. In NeurIPS ML Safety Workshop."},{"key":"e_1_3_2_1_29_1","volume-title":"Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.09527","author":"Perez F\u00e1bio","year":"2022","unstructured":"F\u00e1bio Perez and Ian Ribeiro. 2022b. Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.09527 (2022)."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"crossref","unstructured":"Rafael Rafailov Archit Sharma Eric Mitchell Christopher D Manning Stefano Ermon and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. In NeurIPS.","DOI":"10.52202\/075280-2338"},{"key":"e_1_3_2_1_31_1","unstructured":"Sander Schulhoff. 2023a. Instruction defense. https:\/\/learnprompting.org\/docs\/prompt_hacking\/defensive_measures\/instruction."},{"key":"e_1_3_2_1_32_1","unstructured":"Sander Schulhoff. 2023b. Sandwitch defense. https:\/\/learnprompting.org\/docs\/prompt_hacking\/defensive_measures\/sandwich_defense."},{"key":"e_1_3_2_1_33_1","volume-title":"Making LLMs Vulnerable to Prompt Injection via Poisoning Alignment. arXiv preprint arXiv:2410.14827","author":"Shao Zedian","year":"2024","unstructured":"Zedian Shao, Hongbin Liu, Jaden Mu, and Neil Zhenqiang Gong. 2024. Making LLMs Vulnerable to Prompt Injection via Poisoning Alignment. arXiv preprint arXiv:2410.14827 (2024)."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690291"},{"key":"e_1_3_2_1_35_1","volume-title":"Neil Zhenqiang Gong, and Lichao Sun","author":"Shi Jiawen","year":"2025","unstructured":"Jiawen Shi, Zenghui Yuan, Guiyao Tie, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. 2025. Prompt Injection Attack to Tool Selection in LLM Agents. arXiv preprint arXiv:2504.19793 (2025)."},{"key":"e_1_3_2_1_36_1","unstructured":"R Gorman Stuart Armstrong. 2023. Using GPT-Eliezer against ChatGPT Jailbreaking. https:\/\/www.alignmentforum.org\/posts\/pNcFYZnPdXyL2RfgA\/using-gpt-eliezer-against-chatgpt-jailbreaking."},{"key":"e_1_3_2_1_37_1","volume-title":"The instruction hierarchy: Training llms to prioritize privileged instructions. arXiv preprint arXiv:2404.13208","author":"Wallace Eric","year":"2024","unstructured":"Eric Wallace, Kai Xiao, Reimar Leike, Lilian Weng, Johannes Heidecke, and Alex Beutel. 2024. The instruction hierarchy: Training llms to prioritize privileged instructions. arXiv preprint arXiv:2404.13208 (2024)."},{"key":"e_1_3_2_1_38_1","unstructured":"Simon Willison. 2022. Prompt injection attacks against GPT-3. https:\/\/simonwillison.net\/2022\/Sep\/12\/prompt-injection\/."},{"key":"e_1_3_2_1_39_1","unstructured":"Simon Willison. 2023. Delimiters won't save you from prompt injection. https:\/\/simonwillison.net\/2023\/May\/11\/delimiters-wont-save-you."},{"key":"e_1_3_2_1_40_1","volume-title":"Chong Xiang, Prateek Mittal, and Wenxuan Zhou.","author":"Wu Tong","year":"2024","unstructured":"Tong Wu, Shujian Zhang, Kaiqiang Song, Silei Xu, Sanqiang Zhao, Ravi Agrawal, Sathish Reddy Indurthi, Chong Xiang, Prateek Mittal, and Wenxuan Zhou. 2024. Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy. arXiv preprint arXiv:2410.09102 (2024)."},{"key":"e_1_3_2_1_41_1","unstructured":"An Yang Baosong Yang Beichen Zhang Binyuan Hui Bo Zheng Bowen Yu Chengyuan Li Dayiheng Liu Fei Huang Haoran Wei et al. 2024. Qwen2. 5 Technical Report. arXiv preprint arXiv:2412.15115 (2024)."},{"key":"e_1_3_2_1_42_1","volume-title":"Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv preprint arXiv:2312.14197","author":"Yi Jingwei","year":"2023","unstructured":"Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. 2023. Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv preprint arXiv:2312.14197 (2023)."},{"key":"e_1_3_2_1_43_1","volume-title":"Prompts should not be seen as secrets: Systematically measuring prompt extraction attack success. arXiv preprint arXiv:2307.06865","author":"Zhang Yiming","year":"2023","unstructured":"Yiming Zhang and Daphne Ippolito. 2023. Prompts should not be seen as secrets: Systematically measuring prompt extraction attack success. arXiv preprint arXiv:2307.06865 (2023)."},{"key":"e_1_3_2_1_44_1","volume-title":"Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043","author":"Zou Andy","year":"2023","unstructured":"Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023)."}],"event":{"name":"SACMAT '26: The 31st ACM Symposium on Access Control Models and Technologies","location":"Waterloo ON Canada","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 31st ACM Symposium on Access Control Models and Technologies"],"original-title":[],"deposited":{"date-parts":[[2026,6,24]],"date-time":"2026-06-24T18:20:55Z","timestamp":1782325255000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3750555.3811884"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,8]]},"references-count":44,"alternative-id":["10.1145\/3750555.3811884","10.1145\/3750555"],"URL":"https:\/\/doi.org\/10.1145\/3750555.3811884","relation":{},"subject":[],"published":{"date-parts":[[2026,7,8]]},"assertion":[{"value":"2026-07-08","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}