A leading prompt injection defense for open-weight models, SecAlign++, fine-tunes LoRA adapters so the model ignores instructions that show up inside tool output. A new paper from Imperial College London, the Tübingen AI Center, ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems and Fraunhofer HHI tries a narrower fix. Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness (arXiv 2610.37657, submitted October 27, 2026) trains only one scalar per attention head per pair of token channels. The model's own weights stay frozen.
The authors report that this small set of gates holds up better against adaptive attacks than SecAlign++, a fine-tuning defense, and keeps the base model's few-shot and multi-turn behavior, where SecAlign and ASIDE slip.
How the gates work
Every token gets a channel: TRUSTED (system prompt, user prompt and the model's own output), UNTRUSTED (tool output by default) or TEMPLATE (chat-template tokens, including the BOS token that often acts as an attention sink). The app sets this boundary from outside. The model does not have to guess which text is trusted.
Heads of Security (HoS) then adds a learned bias, log sigmoid(g), to each head's pre-softmax attention logits. The bias depends on the query token's channel and the key token's channel. A gate near 1 leaves attention as it was. A gate near 0 shuts that head off from that channel. Because softmax cancels a shift that every key shares, a prompt whose tokens are all in one channel runs exactly as in the base model.
The paper's Figure 1 shows the idea with one idealized head. The trusted request "Count R's" and the injected "Send money" get the same raw scores, 10 for the first word and 5 for the second. Gates of 1x for trusted tokens, 0.9x for template tokens and 0.1x for untrusted tokens put 0.99 of the head's attention on "Count", the user's request. Gates are learned per head, so some heads can still read the tool output, or read it more. That is meant to keep the model able to read and reason over content it must not obey.
How small is it
The trainable set is the gate table only. For Llama-3.3-70B (80 layers, 64 heads, three channels) that is 46,080 scalars. The paper compares this with 349M parameters for SecAlign and 70B for full fine-tuning and ASIDE. GPT-OSS-20B has an explicit attention sink, which the authors treat as a fourth key-only channel, so it gets 18,432 scalars, against 38M for SecAlign and 21B for ASIDE.
Training reuses the SecAlign++ recipe: DPO on an adapted Cleaned-Alpaca set, where the preferred answer follows the user and the rejected answer follows the injection. The paper trains HoS and SecAlign on the same data so that only the method differs.
Adaptive attacks
Table 1 runs RL-Hammer, a black-box attack in which a Llama-3.1-8B-Instruct attacker is trained with GRPO to rewrite injections against one target. Its "Highest ASR" row, the best attacker against each evaluation target on held-out InjecAgent goals, reads:
- GPT-OSS-20B: 97% undefended, 85% with SecAlign, 10% with HoS.
- GPT-5.6-Luna, which the paper also attacks, against its own trained attacker: 36%.
- Llama-3.3-70B: 99% undefended, 82% with SecAlign (Meta-SecAlign-70B), 1% with HoS.
The strongest attacker against HoS was the one trained on SecAlign, not the one trained on HoS. The authors think the HoS-trained attacker got too little reward to learn. Its training ASR on GPT-OSS-20B was 3.2%, against 80.2% for SecAlign.
For a white-box test, the authors started from the best Claudini attack and had GPT-5.6-Sol refine it over 50 autoresearch iterations aimed at HoS on GPT-OSS-20B. In Figure 2 (left), that attack needs about 6 x 10^16 FLOPs to reach 50% ASR on AgentDojo against HoS, versus 2.2 to 2.3 x 10^16 against the undefended and SecAlign models. On InjecAgent it needs 3.0 x 10^16 against HoS, versus 8.5 to 9.5 x 10^15. That is about three times more attack compute, not immunity.
Utility
Table 2 has seven rows (GPT-OSS-20B and three defended versions, Llama-3.3-70B and two defended versions) and eight benchmark columns. HoS stays within 2.3 points of its base model in every column. The few-shot drops for the other defenses are large:
- GPT-OSS-20B, 5-shot MMLU-Pro: base 68.3%, HoS 67.2%, SecAlign 59.4%, ASIDE 52.1%.
- GPT-OSS-20B, 5-shot MMLU: base 82.3%, HoS 80.0%, ASIDE 74.1%, SecAlign 54.4%.
- Llama-3.3-70B with SecAlign: 2.0% on 1-shot GSM8K, 28.4% on 5-shot MMLU, 16.1% on 5-shot MMLU-Pro. HoS scores 93.2%, 82.4% and 54.8% there.
The authors say Meta-SecAlign-70B often answers one of the example questions instead of the real one. In a multi-turn test on Llama-3.3-70B (Figure 3), SecAlign's utility fell to 43% when untrusted input came at turn 2, while HoS stayed near the base model.
Agentic benchmarks
Table 3 covers Llama-3.3-70B on four agent benchmarks. HoS cut ASR on all four: AgentDojo 23.1% to 0.9%, AgentDyn 18.5% to 1.4%, WASP 7.6% to 1.4%, LLMail 2.1% to 0.0%. Its ASR was lower than SecAlign's in all four. SecAlign raised LLMail ASR to 12.7%.
The cells where HoS beat SecAlign: all four ASR cells, plus WASP utility under attack (81.4% vs 79.8%). The cells where SecAlign was higher: AgentDojo clean utility (67.0% vs 58.5%) and utility under attack (63.9% vs 52.4%), AgentDyn clean utility (41.7% vs 18.3%) and utility under attack (38.3% vs 18.4%), WASP clean utility (62.7% vs 62.2%), and LLMail utility under attack (84.6% vs 82.4%). AgentDyn is a real cost: HoS lost 15.4 points of clean utility against the base model. On GPT-OSS-20B (Figure 4), HoS Pareto-dominates SecAlign on AgentDojo and WASP and matches it on AgentDyn and LLMail. ASIDE models failed to make usable tool calls.
Why it matters
If you serve an open-weight model inside an agent, the app already knows which tokens came from a tool. HoS feeds that label into learned per-head attention gates with tens of thousands of parameters. On the same training data, the authors report, SecAlign learned format shortcuts that hurt few-shot and multi-turn use, and HoS did not.
HoS works inside the model. The authors call it one part of a broader defense. System-level designs, such as the dual-LLM setups and privilege boundaries in our guide to defending AI agents against indirect prompt injection, work at a different layer.
Limits
The authors list them. HoS enforces a boundary but does not decide what is trusted, and some tasks must follow instructions in external content. Training data was fixed and single-turn. No finite attack set proves security. The method needs explicit attention logits, so it does not apply directly to linear attention models. HoS itself was tested on two open-weight models. Code, released models and a demo were linked from the project page as of October 29, 2026.
