SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense

What it is

SpanGuard is an external, black-box guardrail against indirect prompt injection (IPI), from Yinxiang Wang and colleagues at USTC (arXiv 2610.26013v1, October 2026, ICLR 2027 paper). It intercepts each tool output before the agent sees it, removes blocks judged to contain unauthorized instructions, and passes on the rest. It needs only the user's instruction and the tool output, not access to the agent's weights or reasoning.

How it works

The paper's claim is that small models fail as guardrails because they must find the injected text and judge its authorization in one pass. SpanGuard splits these.

Localization (no judge LLM, no attack data).

• The input is split at sentence and line boundaries. Adjacent words are also split where the cosine similarity of their mean-pooled contextual embeddings falls below a fixed threshold γ.
• Units are merged greedily left to right. The boundary score is the negative log-likelihood of the next unit's first token given the current block. If the score is below τ the unit joins the block, otherwise it starts a new block.
• τ is calibrated only on benign tool outputs. A search finds the τ whose false-boundary rate on benign data is close to a target α.

Authorization (small LLM, per block). Each block is judged on its own, with the user task and the block's provenance (the tool call and field it came from). The prompt asks two questions in order: does the block contain a directive to the assistant, and are that directive's content and source authorized by the user's task? The output is 0 or 1, and blocks marked 1 are removed.

Results (AgentDojo)

The headline run uses gpt-4.1-mini as the victim and a 7B guardrail model. The page does not say which 7B model.

• Benign utility with no attack is 70.53% for SpanGuard against 73.68% with no defense, a drop of about 3 points. PromptArmor scores 66.32% and CausalArmor 72.63% on the same measure.
• The attacks tested are direct, ignore-previous, system-message, InjecAgent, important-instructions and tool-knowledge. SpanGuard has 0.00% ASR on four of them. The other two are direct and ignore-previous, at 0.95% each.
• Several baselines look strong on ASR only by wrecking utility. PIGuard and Llama Guard 3 drop utility under attack to 28.10% and 30.63%.

Caveats

• The fetched text cuts off in the llama-3.3-70b rows, so the claim that smaller guardrail models still work has no numbers here. Check the full paper for the model sweep.
• The reported 0.32% is from one benchmark and one victim model in the visible table. The page shows no tests against attacks written to evade the segmentation.
• The method assumes injected text is semantically discontinuous from its surroundings. The paper describes this as typical ("often"), not guaranteed.
• The values of γ and α, and the segmentation model, are not given in the fetched text.