Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection

1. Problem Statement

The paper addresses the critical vulnerability of Large Language Model (LLM) applications to prompt injection attacks, where malicious inputs (direct or indirect) steer the model away from intended behavior.

• Current Limitations: Existing open-source defenses rely heavily on two convergent architectural patterns:
  1. Regular Expressions (Regex): Effective for known patterns but fail against paraphrased attacks, synonyms, or non-English inputs.
  2. Fine-tuned Classifiers: Better at semantic understanding but vulnerable to adaptive adversaries. Recent studies (NAACL 2025, arXiv 2025) show that knowledge-informed attackers can bypass these classifiers with >50% success rates by exploiting decision boundaries.
• The Gap: There is a lack of detection mechanisms that are architecturally independent of the regex/classifier paradigm, making it difficult to create defense-in-depth strategies that are robust against adaptive attacks.

2. Methodology: Cross-Domain Porting

The authors propose a paradigm shift: instead of refining LLM-specific defenses, they port detection mechanisms from seven distinct scientific disciplines that have solved structurally analogous problems. These techniques generate detection signals independent of semantic classification or pattern matching.

The seven proposed techniques are:

1. Forensic Linguistics (Stylometric Discontinuity): Detects indirect injections by identifying abrupt shifts in writing style (e.g., function word frequency, sentence length, imperative verbs) between the benign source text and the injected payload.
2. Materials Science (Adversarial Fatigue Tracking): Models "fatigue failure." It tracks a source's history of "near-miss" scans (inputs just below the detection threshold). If a source repeatedly probes the boundary, the system lowers the threshold for that specific source, blocking subsequent lower-confidence attacks.
3. Network Security (Honeypot Tool Definitions): Introduces "canary" tool definitions (e.g., get_admin_access) that have no legitimate use case. Any invocation of these tools is treated as a 100% confirmed injection.
4. Bioinformatics (Local Sequence Alignment): Adapts the Smith-Waterman algorithm with a semantic substitution matrix. Instead of exact string matching, it aligns attack patterns with paraphrased versions, rewarding semantic synonyms and penalizing gaps, similar to DNA mutation analysis.
5. Economics (Prediction-Market Ensemble Scoring): Proposes using a Logarithmic Market Scoring Rule (LMSR) to aggregate detector signals, weighting them by historical accuracy (Brier score) rather than simple majority voting.
6. Epidemiology/Spectral Analysis (Perplexity Spectral Analysis): Analyzes the frequency spectrum of token-level perplexity. Benign text is smooth (low frequency), while injected payloads create high-frequency spikes.
7. Compiler Theory (Runtime Taint Tracking): Applies dataflow analysis to agent pipelines. It tracks the provenance of data; if untrusted user input reaches a privileged "sink" (like a tool call) without passing through a sanitizer, it is flagged.

3. Key Contributions

• Seven Cross-Domain Mechanisms: A comprehensive framework for detection signals that are orthogonal to traditional regex and transformer classifiers.
• Empirical Validation (Three Implemented): Three techniques were implemented in the open-source prompt-shield v0.4.1 library:
  • d027 (Stylometric Discontinuity): Detects style shifts in long-form text.
  • d028 (Local Sequence Alignment): Detects paraphrased attacks using semantic alignment.
  • Fatigue Tracker: Detects probing campaigns via temporal state tracking.
• Comprehensive Benchmarking: Evaluation across six datasets (including public benchmarks like deepset/prompt-injections, NotInject, AgentHarm, and a new synthetic indirect-injection benchmark).
• Honest Limitations: The paper explicitly details failure modes, such as false-positive regressions on specific datasets and the lack of adaptive-attack evaluation for the new detectors.

4. Results

The evaluation used a four-configuration ablation study (Baseline Regex vs. Baseline + d028 vs. Baseline + d027 vs. Combined).

• Deepset Benchmark (Paraphrased Attacks):
  • The baseline regex achieved an F1 of 0.033 (missing 59/60 attacks).
  • Adding d028 (Sequence Alignment) lifted the F1 to 0.378 (catching 14/60 attacks), a 34.6 percentage-point improvement with zero additional false positives.
• Synthetic Indirect-Injection Benchmark:
  • The baseline achieved an F1 of 0.889.
  • Both d027 and d028 individually lifted the F1 to 1.000 (perfect detection) with zero false positives.
• Adversarial Fatigue Tracker:
  • Validated via an integration test: After 10 "near-miss" scans from a single source, the 11th scan (with a lower confidence score than the previous 10) was successfully blocked, while a concurrent scan from a different source at the same confidence level passed.
• Limitations Observed:
  • NotInject: d028 introduced a false-positive rate (FPR) increase from 0.9% to 3.8% due to permissive synonym grouping on benign queries.
  • AgentHarm: No improvement was seen because this benchmark measures "task harmfulness" rather than "injection content," and the baseline regex already caught the harmful patterns.
  • Short Inputs: The stylometric detector (d027) is silent on inputs <100 tokens by design.

5. Significance

• Breaking the Convergence: The paper demonstrates that moving beyond the "regex + classifier" axis yields significant gains, particularly against paraphrased and indirect attacks where traditional methods fail.
• Defense-in-Depth: By using mechanisms from unrelated fields (biology, economics, materials science), the proposed defenses create mechanistically independent invariants. An adversary would need to simultaneously evade semantic alignment, stylistic analysis, and fatigue tracking, which is significantly harder than evading a single improved classifier.
• Stateful vs. Stateless: The introduction of Adversarial Fatigue Tracking shifts the paradigm from stateless, single-sample detection to stateful, temporal analysis, addressing the "probing" behavior of sophisticated attackers.
• Open Science: The authors provide full reproducibility, including code, datasets, and a synthetic benchmark generator, allowing the community to validate and extend these cross-domain approaches.

In conclusion, this work argues that the future of prompt injection defense lies not in better LLM training, but in architectural diversity, leveraging decades of research from other scientific disciplines to create robust, multi-layered detection systems.