Heads of Security: 18,432 learned attention scalars gate untrusted tokens — RL-Hammer ASR drops 97% → 10% with base weights frozen
Per-head pre-softmax gates, trained in ~4 GPU-hours with DPO, enforce instruction–data separation on GPT-OSS-20B and Llama-3.3-70B without touching the base weights.
Heads of Security (HoS), a defense from Imperial College London and the Tübingen AI Center, cuts prompt-injection attack success on GPT-OSS-20B from 97% to 10% by training only 18,432 per-head attention scalars — the base model's weights never change. The same recipe takes Llama-3.3-70B-Instruct from 99% to 1% under a black-box RL attack, while preserving benchmark utility that the SecAlign and ASIDE baselines lose.
What shipped
HoS enforces instruction–data separation — the rule that external content may be read and analyzed but not treated as instructions — through learned per-head attention gates. Each token is assigned to one of three channels: trusted (user instructions and conversation), untrusted (tool results), or chat-template formatting. Before the softmax, every attention head scales its scores by channel-dependent scalar gates, so a head that follows instructions can be blocked from reading untrusted tokens while other heads keep processing them. The model can still reason over untrusted content; it just cannot be steered by it (project site, full text).
Only the gates are trained: 18,432 scalars on GPT-OSS-20B and 46,080 on Llama-3.3-70B — a few tens of thousands of parameters on models with tens of billions — using the SecAlign++ DPO recipe: preferred responses follow the user's task, rejected responses follow the injection (project site). Training takes about four hours on eight 80 GB GPUs for GPT-OSS-20B and about two hours for Llama-3.3-70B, on SecAlign's CleanAlpaca data augmented with reasoning traces from GPT-OSS-120B (PyPI). The trust boundary is not learned: the caller marks which tokens are untrusted — the vLLM server treats tool results as untrusted automatically — and the gates enforce that boundary (full text).
The headline numbers come from adaptive attacks, not static ones. RL-Hammer, a black-box attack that uses GRPO to train a Llama-3.1-8B attacker against each target and evaluates on held-out InjecAgent goals, reaches 97% ASR on undefended GPT-OSS-20B and 85% on SecAlign, but only 10% on HoS. On Llama-3.3-70B the same attack hits 99% undefended, 82% against Meta-SecAlign-70B, and 1% against HoS (arXiv abstract, project site). Transfer holds: an attacker trained against HoS-defended GPT-OSS reaches 46% ASR on SecAlign but only 3% on HoS, and a GPT-5.6-Luna-trained attacker gets 36% on Luna versus a 10% ceiling on HoS (project site).
The white-box results are the strongest. Claudini, an optimization-based attack, was further optimized specifically against HoS in an autoresearch loop (50 iterations, 120-token suffix, 10^17 FLOP budget). It still needs roughly 3x more compute to reach 50% ASR on HoS than on the base model or SecAlign (arXiv abstract, project site).
Utility holds where the baselines fall apart. On 5-shot MMLU-Pro, HoS scores 67.2% on GPT-OSS-20B versus the base model's 68.3%, while SecAlign drops to 59.4% and ASIDE to 52.1%. On Llama-3.3-70B the gap is similar (54.8% vs 56.3%) while SecAlign collapses to 16.1% (project site). The paper shows SecAlign answering few-shot demonstrations instead of the final question, and the same failure in multi-turn AlpacaFarm conversations, where undefended Llama and HoS stay near 100% instruction completion while SecAlign stays degraded (project site). ASIDE, which rotates the embeddings of untrusted content, breaks tool calling: near-zero utility on three agentic benchmarks and 10% on AgentDojo (arXiv abstract).
On agentic benchmarks with static attacks, HoS and SecAlign are comparable on security, and HoS stays closer to base utility. On Llama-3.3-70B: AgentDojo ASR falls 23.1% → 0.9% with utility up 53.7% → 58.5%; WASP ASR falls 7.6% → 1.4% with utility-under-attack up 62.4% → 81.4%; LLMail-Inject ASR falls 2.1% → 0.0% (project site). The one clear cost is AgentDyn, where utility drops from 33.7% to 18.3% even as ASR falls 18.5% → 1.4%. SecAlign, by contrast, raises LLMail ASR to 12.7% by fabricating tool calls with attacker-supplied values (project site).
An ablation confirms the mechanism: a single untrained gate value shared across all heads and layers cannot reproduce the trade-off. At a strong suppression setting, ASR reaches 1.5% but utility-under-attack falls to 50.8%, versus HoS's 1.1% ASR at 59.6% utility-under-attack on GPT-OSS-20B AgentDojo (alphaXiv). Per-head routing, not suppression strength, is doing the work (alphaXiv).
Release: the code ships as the heads-of-security pip package (v0.1.0, MIT, published Oct 8, 2026) with a load_gated_model() API and vLLM server integration (PyPI); the GPT-OSS-20B gate weights are public on Hugging Face (model card). The Llama gates and the DPO dataset are gated, and the GitHub repo linked from the project site currently returns 404 — the pip package is the distribution channel.
Why it matters
Prompt injection is the unsolved problem for anyone shipping agents with tool access. The paper notes that adaptive attacks still succeed against extensively evaluated frontier systems, and that open-weight models are substantially worse under comparable red-teaming (full text). HoS attacks the mechanism — attention routing — rather than patching behavior with finetuning, and it does so with a footprint small enough to treat as a deployable component rather than a retraining project.
The design is a clean abstraction for agent tooling: gates enforce separation, the runtime owns trust. The caller (or the vLLM server) labels tool results as untrusted, and the gates stop instruction-following heads from reading them. That is a contract an agent framework can implement today, and the MIT-licensed package plus public GPT-OSS-20B gates make it cheap to try: a few tens of thousands of scalars, a few hours of training on eight GPUs to retrain for a new base model, no base-weight changes.
The comparison set matters. SecAlign shows what finetuning-based defenses cost — few-shot and multi-turn collapse, and worse LLMail behavior — while ASIDE shows the risk of architectural fixes that break tool calling. HoS's per-head gates preserve the model's ability to reason over untrusted data, which is the property agent builders need.
Caveats
This is a preprint with no independent replication; every number above is self-reported by the authors. Only two open-weight models were tested. HoS enforces a trust boundary but does not decide where it lies — a caller that mislabels channels gets no protection. The paper does not measure the gates' latency or inference cost. The AgentDyn utility drop on Llama is real and unexplained. Claudini comes from the same research group (a co-author of this paper), so the white-box result is self-referential even though the attack was optimized against HoS specifically. Transfer attacks still reach up to 3% ASR on HoS-defended GPT-OSS (2% from the Luna-trained attacker) and 0–1% on HoS-defended Llama, not zero, and no finite evaluation can establish security against future attacks (alphaXiv).