Loading article...
Loading article...
Stream/Area:
-
Subject:
-
Paper ID:
IJSREM65178
Volume:
10 |
6 |
Jun 2026
Pages:
1-8
Publication Frequency:
Monthly (12 issues per year)
License:International Journal of Scientific Research in Engineering and Management follows the Creative Commons Attribution 4.0 (CC BY 4.0) License, allowing free use and distribution with proper attribution.
Department of Information Technology
Vidya Pratishthan's Kamalnayan Bajaj Institute of Engineering and Technology, Baramati, Pune, Maharashtra, India
Department of Information Technology
Vidya Pratishthan's Kamalnayan Bajaj Institute of Engineering and Technology, Baramati, Pune, Maharashtra, India
Department of Information Technology
Vidya Pratishthan's Kamalnayan Bajaj Institute of Engineering and Technology, Baramati, Pune, Maharashtra, India
Department of Information Technology
Vidya Pratishthan's Kamalnayan Bajaj Institute of Engineering and Technology, Baramati, Pune, Maharashtra, India
Department of Information Technology
Vidya Pratishthan's Kamalnayan Bajaj Institute of Engineering and Technology, Baramati, Pune, Maharashtra, India
Prompt injection represents one of the main security vulner-abilities in LLM-powered applications, including autonomous agents op-erating in complex environments. State-of-the art approaches for prompt injection detection rely on expensive fine-tuning on large LLMs, caus-ing long inference times, GPU dependence, and increased False Positive Rate (FPR). Our proposed approach, named AURA (Adaptive Univer-sal Retrieval Augmentation), is aimed at developing a lightweight and CPU-only middleware model-agnostic prompt injection detector. This method consists of three main components: (1) precision-based regex filters for detecting jailbreaks and exfiltration attempts, (2) anomaly detectors based on structural information such as entropy and length statistics and (3) semantic intent clustering using zero-shot methods with small embedding size (BAAI/bge-small-en-v1.5). During extensive evalu-ations on our dataset of 60 carefully crafted adaptable prompt injections and 125 benign prompts (including 15 hard-to-distinguish Benign Utility queries) we achieved True Positive Rate (TPR) of 90.0%, FPR of 0.00% , Accuracy of 96.8% and Benign Utility Score of 100.0% at average la-tency 12.1 ms (P99 22.0 ms) in CPU-only settings. We were also able to detect 60.0% of indirect prompt injection attacks provided by BIPIA, at the cost of lower absolute TPR rates in favor of deploying lightweight defenses and ensuring minimal FPR rates. We conclude that even simple semantic and structural filters provide an efficient solution as an external layer to protect LLMs against prompt injections.
KEYWORDS
This paper introduced AURA, a lightweight, CPU-only, tri-layer hybrid ap-proach to detect prompt injections in LLM-powered systems. Through leverag-ing highly accurate regex filters, analyzing structural anomalies, and comparing semantics via small models, AURA reaches 90.0% TPR, 0.00% FPR, 96.8% accu-racy, and 100.0% Benign Utility on an aggregate curated and adaptive dataset with approximately 12.1 ms mean latency in pure-CPU runtime. For BIPIA-based attacks, AURA detects 60.0% of the attacks without having access to model internals. Instead of substituting heavyweight white-box or system-level defenses, AURA provides practical model-agnostic middleware shielding for scenarios where such defenses would be impractical. Our future research plans include improvements in handling indirect and adaptive attacks, studying integration with attack re-moval approaches, and benchmarking on publicly available datasets.
1. Greshake, K., et al.: Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In: Proc. 16th ACM Workshop on AI and Security (2023) 2. Yi, J., et al.: Benchmarking and Defending against Indirect Prompt Injection At-tacks on Large Language Models. In: Proc. 31st ACM SIGKDD (2023) 3. Liu, Y., et al.: Prompt Injection Attack against LLM-Integrated Applications. arXiv:2306.05499 (2023) 4. Zhan, Q., et al.: InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. arXiv:2403.02691 (2024) 5. Lan, Q., Kaul, A., Jones, S.: Prompt Injection Detection in LLM Integrated Ap-plications. International Journal of Network Dynamics and Intelligence (2025) 6. Chen, Y., et al.: Can Indirect Prompt Injection Attacks Be Detected and Removed? (2025) 7. Wen, T., et al.: Defending against Indirect Prompt Injection by Instruction Detec-tion. arXiv:2505.06311 (2025) 8. Hines, K., et al.: Defending Against Indirect Prompt Injection Attacks With Spot-lighting. arXiv:2403.14720 (2024) 9. An, H., et al.: IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents (2025) 10. Debenedetti, E., et al.: Defeating Prompt Injections by Design. arXiv:2503.18813 (2025)
Publication Date
6/19/2026
Peer Review Type
Double-Blind Peer Review
Review Rounds: 2
Documents
Article Views
0
Total views since publication
PDF Downloads
3
Total downloads since publication
Geographic Reach
5
Digital Preservation: This article is permanently archived on Zenodo and complies with all data preservation standards across major indexing platforms.
Plagiarism Screening
This manuscript has been checked for plagiarism using TurnitinPlagiarismChecker software.
Conflict of Interest
The authors declare no conflict of interest related to this research work.
Funding Information
No funding information available for this research.
Related research in the same subject area
Loading similar articles...