soft-instruction-defense

name	soft-instruction-defense
title	Soft Instruction De-escalation Defense
version	0.0.2
engine	skillxiv-v0.0.2-claude-opus-4.6
license	MIT
url	https://arxiv.org/abs/2510.21057
keywords	["Security","Prompt Injection","Agent Safety","Sanitization"]
description	Defends tool-augmented LLM agents against prompt injection via iterative input sanitization. Multi-pass inspection detects malicious instructions in untrusted data, remediates them, and re-evaluates until clean or iteration limit reached. Raises attack barrier while maintaining agent usability.

Soft Instruction De-escalation Defense: Protecting Agent Workflows

Tool-augmented agents process untrusted data from APIs, web responses, and user-provided documents. Prompt injection attacks embed malicious instructions within this data to hijack agent behavior.

SIC (Soft Instruction de-escalation) implements iterative sanitization loops that detect and remediate injected instructions while maintaining partial functionality, making attacks harder and more detectable.

Core Concept

Key insight: single-pass sanitization misses injections that later steps expose. Iterative loops catch missed attacks by:

• Inspecting input for instruction-like content
• Remediating detected malicious instructions
• Re-evaluating sanitized output
• Halting if instructions persist after iterations

This raises the cost for attackers while preserving agent capability.

Architecture Overview

• Instruction pattern detection (imperative verbs, command syntax)
• Remediation strategies (rewriting, masking, removal)
• Iterative sanitization loop with convergence checks
• Failsafe termination when malicious content persists

Implementation Steps

Implement instruction detection that identifies suspicious patterns in untrusted data. This uses heuristics and ML to flag instruction-like content:

class InstructionDetector:
    def __init__(self):
        # Patterns for common injection attacks
        self.imperative_verbs = [
            'ignore', 'forget', 'override', 'bypass', 'execute',
            'run', 'follow', 'replace', 'change', 'disable'
        ]

        # High-risk instruction patterns
        self.instruction_patterns = [
            r'ignore.*instructions',
            r'(from now on|henceforth)',
            ,
            ,
        ]

     ():
        
        detections = []

        
        tokens = text.lower().split()
         i, token  (tokens):
             token  .imperative_verbs:
                
                 i < (tokens) - :
                    detections.append({
                        : ,
                        : i,
                        : .join(tokens[i:(i+, (tokens))])
                    })

        
         pattern  .instruction_patterns:
            matches = re.finditer(pattern, text, re.IGNORECASE)
               matches:
                detections.append({
                    : ,
                    : pattern,
                    : .group()
                })

         detections