🤖 machine learning

Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense

The paper introduces SCOUT, a dynamic framework that optimizes prompt-injection defense by adaptively allocating heterogeneous detectors and LLM judges based on predicted reliability and latency, achieving significant reductions in attack success rates and latency compared to static single-detector or always-on judge approaches.

Original authors: Shuhao Zhang, Jiarui Li, Qi Cao, Ruiyi Zhang, Pengtao Xie

Published 2026-06-01

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Shuhao Zhang, Jiarui Li, Qi Cao, Ruiyi Zhang, Pengtao Xie

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the security chief of a busy airport. Your job is to stop terrorists (prompt-injection attacks) from hijacking the planes (Large Language Models) while letting regular passengers (benign requests) through quickly.

In the past, security teams tried two main approaches:

The "Super-Scanner" Approach: You hire one incredibly smart, expensive security guard who checks every single person. This person is great at spotting bad guys but is slow, expensive, and creates long lines.
The "One-Tool" Approach: You pick one specific tool (like a metal detector) and force everyone through it. It's fast, but if a terrorist is hiding a bomb made of plastic (a type of attack the metal detector misses), they get through.

The problem is that bad guys are clever. They change their tactics. Sometimes they hide in plain sight; sometimes they use complex codes. No single security guard or tool is perfect at catching every type of threat.

Enter SCOUT: The "Smart Security Dispatcher"

The paper introduces a new system called SCOUT. Instead of forcing every passenger through the same gate, SCOUT acts like a smart dispatcher who looks at each person before they reach the gate and decides exactly which security team is best suited to check them.

Here is how it works, using simple analogies:

1. The "Fingerprint" Library

Imagine every security guard in your building has a "fingerprint" of their past performance.

Guard A is amazing at spotting people hiding weapons in their shoes but terrible at spotting people hiding them in their luggage.
Guard B is great at luggage but misses shoe threats.
Guard C is the "Super-Scanner" (the expensive AI judge) who catches almost everything but takes 10 minutes per person.

SCOUT doesn't just guess; it keeps a detailed log (a fingerprint) of how each guard performed on thousands of past passengers. It knows exactly which guard is reliable for which type of passenger.

2. The "Pre-Hoc" Prediction (Looking Before You Leap)

When a new passenger arrives, SCOUT doesn't just send them to a random guard. It asks a small, fast AI assistant: "Based on how this passenger looks and what they are carrying, which guards have successfully caught people like this in the past?"

This is the "Pre-hoc Reasoning" part. It predicts the outcome before the actual check happens.

If the passenger looks like a "shoe threat," SCOUT sends them to Guard A.
If they look like a "luggage threat," it sends them to Guard B.
If the passenger is very complex and the fast guards are unsure, it sends them to the "Super-Scanner" (the expensive AI).

3. The "Team Vote"

SCOUT often sends the passenger to a team of fast guards to check them all at the same time (in parallel).

If Guard A and Guard B both say, "This person is safe," SCOUT lets them through immediately.
If they disagree or seem unsure, SCOUT escalates the case to the "Super-Scanner" for a final, definitive verdict.

4. The "Speed vs. Safety" Dial

The best part is that the airport manager (the operator) gets a single dial to turn.

Turn it left (Low Safety, High Speed): SCOUT relies mostly on the fast guards. It's incredibly quick, but a few bad guys might slip through.
Turn it right (High Safety, Lower Speed): SCOUT sends more people to the "Super-Scanner." It catches almost everyone, but the line gets longer.

The system predicts exactly how long the line will be for any setting of the dial, so the manager can choose the perfect balance before the day even starts.

What Did They Find?

The researchers built a new, tough test called SCOUT-450 (a collection of tricky, complex attacks that older tests missed). They tested their system against:

Using only fast guards (missed many attacks).
Using only the "Super-Scanner" (caught attacks but was very slow).
SCOUT (The Dispatcher).

The Results:

Safety: SCOUT caught 46% more attacks than just using the "Super-Scanner" alone.
Speed: It was 40% faster than using the "Super-Scanner" for everyone.
Flexibility: If you add a new security guard to the team, SCOUT can learn to use them instantly without needing to be retrained from scratch. It just looks at their "fingerprint" and starts using them.

The Bottom Line

SCOUT changes the game from "One size fits all" to "Right tool for the right job." It uses a smart, fast predictor to decide which security team to use for each specific request, ensuring you get the best safety without the unbearable wait times. It's like having a security system that knows exactly which lock to pick for every specific door.

Technical Summary: SCOUT – Pre-hoc Reasoning for Adaptive Detector Allocation

Problem Statement
Prompt-injection detectors are inherently heterogeneous; each detector excels on specific slices of attack categories (e.g., lexical rules, attention probes, lightweight classifiers) while failing on others. Existing defense systems typically rely on fixed pipelines, such as a single detector or a static cascade, which forces every request through a specific detector's blind spots. Furthermore, the most accurate defense, an LLM judge (e.g., GPT-4o), incurs prohibitive latency (approx. 1.5 seconds per request) compared to lightweight detectors (sub-millisecond to tens of milliseconds). The core challenge is to balance safety (catching attacks) against utility (minimizing latency and maintaining benign pass-through rates) without committing to a single detector's limitations or the high cost of always-on LLM judging.

Methodology: SCOUT Framework
The authors propose SCOUT (Scalable and Controllable Outcome-prediction for Uncertainty-aware Triage), a framework that reframes defense as a per-input detector allocation problem. Instead of a fixed cascade, SCOUT dynamically decides which detectors to run for each specific request and whether to escalate to an LLM judge.

The system operates through three main components:

Detector Fingerprints and Retrieval:
- SCOUT maintains a fixed set of "anchor" inputs (Anchor-400) representing diverse injection structures.
- For every detector in the pool, a fingerprint is constructed by recording its behavior (verdict, correctness, and latency) on these anchors.
- At inference, for a new request $x$ , the system retrieves the top- $K$ most similar anchors based on injection structure (category, hiding strategy, carrier, mechanism) rather than topical content. This retrieval is detector-agnostic.
Outcome Predictor (Pre-hoc Reasoning):
- A small language model (Qwen3-4B) acts as a predictor. It takes the retrieved fingerprint records and the target sample as input.
- Using a two-stage training process (Supervised Fine-Tuning with hindsight-distilled rationales followed by Group Relative Policy Optimization), the predictor estimates two values for each detector $D$ $D$ on input $x$ $x$ :
  - Predicted Correctness ( $pred\_corr$ ): Whether $D$ will correctly classify $x$ .
  - Predicted Latency ( $pred\_lat$ ): How long $D$ will take to run.
- The predictor is trained to emit a reasoning chain (Chain-of-Thought) before the structured prediction, which improves calibration.
Uncertainty-Aware Triage (Routing):
- Subset Selection: The router filters the "light pool" of detectors, keeping only those where $pred\_corr = 1$ .
- Trust-Weighted Vote: The selected detectors run in parallel. Their votes are aggregated using a trust weight that mixes local evidence (accuracy on retrieved anchors) and global priors (overall accuracy).
- Escalation Gate: If the weighted vote is uncertain (agreement $< \tau$ ), the system considers escalating to the LLM judge. Crucially, escalation occurs only if the predictor also estimates the judge to be reliable on that specific input.
- Latency Control: Because the predictor estimates latency, the system can predict the total wall-clock time for any threshold $\tau$ before running the request. Operators can set $\tau$ to meet a specific latency budget.

Key Contributions

Reframing Defense: The paper shifts the paradigm from fixed detection pipelines to per-input detector allocation, allowing the system to match the detector to the specific attack category of the input.
The SCOUT Framework: A novel architecture combining behavioral fingerprints, a small outcome predictor, and a controllable routing rule. It enables new detectors to join the pool with no retraining (only a single pass over anchors to generate a fingerprint).
SCOUT-450 Benchmark: A new evaluation benchmark enriched with structurally complex, agent-facing injections (specifically the hidden_tricky category) that older benchmarks under-represent. It includes 255 attack and 195 benign samples.
Controllability: The system exposes a single operator threshold ( $\tau$ ) that trades safety for latency, with the ability to predict the total wall-clock cost beforehand.

Results
Evaluated on SCOUT-450 and three external benchmarks (BIPIA, IPI, IHEval), SCOUT demonstrates significant improvements over baselines:

Safety-Utility Frontier: On SCOUT-450, at the headline operating point ( $\tau=0.875$ ), SCOUT reduces the Attack Success Rate (ASR) by 46% and total wall-clock latency by 40% compared to an always-on GPT-4o judge.
Accuracy: SCOUT achieves an accuracy of 0.933, surpassing the best single detector (PIGuard, 0.669) and the always-on judge (GPT-4o, 0.924).
Benign Utility: While SCOUT incurs a 5.1-point drop in benign utility compared to the always-on judge (0.928 vs. 0.979), it maintains high throughput while significantly reducing latency.
Generalization: The system transfers to external benchmarks (BIPIA, IPI, IHEval) without retraining, adapting to different attack distributions by re-allocating detectors. For instance, on BIPIA, it reduces latency by 3.7x compared to the GPT-5.1 judge while maintaining high accuracy.
Ablations: The study confirms that the gain comes from the predictor's ability to calibrate reliability estimates (outperforming non-LLM predictors like KNN/MLP) and the per-input allocation strategy (outperforming uniform-trust cascades).

Significance and Claims
The paper claims that SCOUT offers a scalable and controllable solution to prompt injection defense.

Scalability: Adding a new detector requires only generating its fingerprint on the anchor set; no retraining of the retriever, predictor, or router is needed.
Controllability: Operators can tune the system to a specific latency budget or safety target using the single threshold $\tau$ , with the system predicting the cost in advance.
Heterogeneity Awareness: By recognizing that no single detector is universally strong, SCOUT leverages the diverse strengths of a heterogeneous pool, routing difficult cases to the LLM judge only when necessary and when the judge is predicted to be reliable.

The authors acknowledge limitations, noting that SCOUT cannot outperform the collective capability of the available detector pool and that its effectiveness depends on the anchor set covering the structural axes of the test distribution. They also note that the framework does not currently defend against adaptive attackers targeting the router itself.