Heads of Security attention gates cut RL-Hammer prompt injection success to 10%

The paper was posted to arXiv on October 27, 2026 as 2610.37657v1. It evaluates HoS on Llama-3.3-70B-Instruct and GPT-OSS-20B. It compares HoS against two baselines: SecAlign++, which the authors call a state-of-the-art finetuning-based defense, and ASIDE, which, like HoS, builds instruction-data separation into the model architecture. This note works from the abstract, which is truncated, so it can report only the claims the abstract makes.

For teams building agents that read untrusted text, the choice is between defenses that change model weights, defenses that change model architecture, and defenses that sit outside the model. HoS belongs to the architectural group alongside ASIDE, because it changes how attention behaves inside the model. Whether it is worth adopting depends on the robustness numbers the abstract gives and on the cost numbers it leaves out.

According to the abstract, HoS "learns how each head should redistribute attention between trusted and untrusted tokens." The intervention works at the level of individual attention heads. The abstract describes the learned component as "a small set of learned per-head attention gates". It describes SecAlign++, by contrast, as finetuning-based. The abstract does not say whether the base model's weights stay frozen while the gates are trained.

The gates act on trusted and untrusted tokens, so the model has to know which tokens belong to which class. The abstract does not say how that labeling is produced, how many heads are gated in Llama-3.3-70B-Instruct or GPT-OSS-20B, or what data the gates are trained on. A team integrating this into an agent stack would likely need to track where each token came from (system prompt, user turn or tool result) down to the token level. The full paper may describe this, but the abstract does not.

The headline result is against RL-Hammer, a black-box attack. Its attack success rate (ASR) is 97% against GPT-OSS-20B, 85% against SecAlign and 10% against HoS. The abstract names GPT-OSS-20B as the target only for the 97% figure. It does not say which base model the SecAlign and HoS figures use.

The abstract gives no RL-Hammer figure for Llama-3.3-70B-Instruct or for ASIDE. It uses both "SecAlign" and "SecAlign++" and does not make clear whether the 85% figure refers to SecAlign++. A 10% ASR is not zero. In an agent that processes many untrusted documents, one successful injection in ten attempts is still a real exposure, so HoS reduces the risk rather than removing it.

For the white-box case, the authors use Claudini, which they describe as a state-of-the-art white-box attack. They strengthened Claudini against HoS through autoresearch. The abstract does not explain what that process involved. After that strengthening, Claudini needs 3 times more FLOPs to reach the same ASR on HoS as it does on GPT-OSS-20B or SecAlign.

A 3x compute multiplier raises the attacker's cost but does not stop the attack. An attacker with white-box access and three times the compute budget reaches the same success rate. The abstract does not give Claudini's absolute ASR or the FLOP budget involved, so the practical meaning of 3x is hard to judge. In deployments where attackers can obtain the model weights, this white-box figure matters more than the black-box one.

On capability, the abstract makes three claims. HoS "preserves base-model utility across standard multiple-choice benchmarks and prompting setups." Compared with SecAlign++ and ASIDE, it shows better performance on standard utility benchmarks. It also matches top performance on standard agentic prompt injection benchmarks.

The abstract names none of these benchmarks, gives no scores and does not quantify the utility advantage over SecAlign++ or ASIDE. Multiple-choice benchmarks do not directly measure long-form generation or multi-step tool use, which are central to agent workloads. On the agentic benchmarks the abstract claims parity, "matches top performance", not an improvement. The robustness advantage it does claim is under adaptive attacks.

The source does not support a comparison between HoS and prompt-level or classifier defenses. Both baselines, SecAlign++ and ASIDE, change the model itself. The abstract reports no results against delimiter or spotlighting prompts and none against input or output injection classifiers.

Deployment effort is also unreported. HoS changes the attention computation and its gates are learned, so using it would likely require modified attention code or weights for Llama-3.3-70B-Instruct or GPT-OSS-20B, plus a training run for the gates. The abstract does not cover any of the following:

As described, HoS needs access to the model's attention computation, so it cannot be added to a model that is reachable only through a hosted API. Defenses that only rewrite the prompt or filter inputs and outputs do not need that access. This difference matters for teams that do not control the model they serve.

For teams that serve their own models in agent pipelines, the HoS results justify a closer look at the full paper. By the abstract's own figures, a 10% RL-Hammer ASR compared with 85% for SecAlign, with utility preserved on multiple-choice benchmarks, is a large reduction. HoS should still be one layer among several. Under Claudini it raises attack cost by a measured 3x but does not block an attacker with white-box access and enough compute.

Before adopting it, an engineer would want the following from the full paper or a code release:

Until those are available, the reported results are the RL-Hammer and Claudini figures above and a qualitative claim of preserved utility.