Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2308.10819

Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injection

Zekun Li·Baolin Peng·Pengcheng He·Xifeng Yan
View original source ↗Read source document ↗Export metadata ↓

Abstract

Large Language Models (LLMs) have demonstrated exceptional proficiency in instruction-following, becoming increasingly crucial across various applications. However, this capability brings with it the risk of prompt injection attacks, where attackers inject instructions into LLMs' input to elicit undesirable actions or content. Understanding the robustness of LLMs against such attacks is vital for their safe implementation. In this work, we establish a benchmark to evaluate the robustness of instruction-following LLMs against prompt injection attacks. Our objective is to determine the extent to which LLMs can be influenced by injected instructions and their ability to differentiate between these injected and original target instructions. Through extensive experiments with leading instruction-following LLMs, we uncover significant vulnerabilities in their robustness to such attacks. Our results indicate that some models are overly tuned to follow any embedded instructions in the prompt, overly focusing on the latter parts of the prompt without fully grasping the entire context. By contrast, models with a better grasp of the context and instruction-following capabilities will potentially be more susceptible to compromise by injected instructions. This underscores the need to shift the focus from merely enhancing LLMs' instruction-following capabilities to improving their overall comprehension of prompts and discernment of instructions that are appropriate to follow. We hope our in-depth analysis offers insights into the underlying causes of these vulnerabilities, aiding in the development of future solutions. Code and data are available at https://github.com/Leezekun/instruction-following-robustness-eval

Explore related subjects

cs.CLcs.AI

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Zekun Li, Baolin Peng, Pengcheng He, Xifeng Yan. 2023-11-25. Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injection. https://arxiv.org/abs/2308.10819

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Hierarchical attention interpretation: an interpretable speech-level transformer for bi-modal depression detection

Depression is a common mental disorder. Automatic depression detection tools using speech, enabled by machine learning, help early screening of depression. This paper addresses two limitations that may hinder the clinical implementations of such tools: noise resulting from segment-level labelling and a lack of model interpretability. We propose a bi-modal speech-level transformer to avoid segment-level labelling and introduce a hierarchical interpretation approach to provide both speech-level and sentence-level interpretations, based on gradient-weighted attention maps derived from all attention layers to track interactions between input features. We show that the proposed model outperforms a model that learns at a segment level ($p$=0.854, $r$=0.947, $F1$=0.897 compared to $p$=0.732, $r$=0.808, $F1$=0.768). For model interpretation, using one true positive sample, we show which sentences within a given speech are most relevant to depression detection; and which text tokens and Mel-spectrogram regions within these sentences are most relevant to depression detection. These interpretations allow clinicians to verify the validity of predictions made by depression detection tools, promoting their clinical implementations.

cs.CL↗
arXiv2026

Cultural Alignment in Large Language Models Using Soft Prompt Tuning

Large Language Model (LLM) alignment is commonly achieved through supervised fine-tuning or reinforcement learning, both of which require labeled or preference data and update model weights. Without targeted cultural adaptation, however, deployed LLMs often exhibit culturally homogeneous behavior that fails to reflect diverse local values. Aligning models to cultural value frameworks such as Hofstede's Value Survey Module (VSM13) presents a distinct challenge: alignment signals are available only as aggregated survey-level scores computed after generating responses to an entire survey, providing no per-token gradient and requiring no preference data by construction. This makes standard gradient-based alignment methods ill-suited to the task. We propose a deployment-friendly approach that encodes cultural behavior in short, tunable soft prompts optimized with Differential Evolution (DE), while keeping model weights frozen and requiring no preference data. At inference, the system inserts the appropriate cultural-specific prompt to adapt model responses for different cultures. Experiments across four countries and four instruction-tuned models show that DE-optimized prompts generally reduce discrepancy with VSM13 reference profiles, improve rank agreement with the World Values Survey (WVS), an independent framework not seen during optimization, and are preferred in blinded pairwise evaluations using majority voting across three LLM judges.

cs.CL↗
arXiv2026

VQ-Logits: Compressing the Output Bottleneck of Large Language Models via Vector Quantized Logits

Large Language Models (LLMs) have achieved remarkable success but face significant computational and memory challenges, particularly due to their extensive output vocabularies. The final linear projection layer, mapping hidden states to vocabulary-sized logits, often constitutes a substantial portion of the model's parameters and computational cost during inference. Existing methods like adaptive softmax or hierarchical softmax introduce structural complexities. In this paper, we propose VQ-Logits, a novel approach that leverages Vector Quantization (VQ) to drastically reduce the parameter count and computational load of the LLM output layer. VQ-Logits replaces the large V * dmodel output embedding matrix with a small, shared codebook of K embedding vectors (K << V ). Each token in the vocabulary is mapped to one of these K codebook vectors. The LLM predicts logits over this compact codebook, which are then efficiently "scattered" to the full vocabulary space using the learned or preassigned mapping. We demonstrate through extensive experiments on standard language modeling benchmarks (e.g., WikiText-103, C4) that VQ-Logits can achieve up to 99% parameter reduction in the output layer and 6x speedup in logit computation, with only a marginal 4% increase in perplexity compared to full softmax baselines. We further provide detailed ablation studies on codebook size, initialization, and learning strategies, showcasing the robustness and effectiveness of our approach.

cs.CL↗