Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG

What it is

nokast-secureRAG is an open-source ~0.5B-parameter classifier by Abhishek Rai (independent researcher, accepted at the Lifelong Agent Workshop, COLM 2026). It reads the user query Q and the retrieved context C together, emits a short reasoning trace, then labels the pair safe, suspicious or malicious-instruction. The model, data pipeline and evaluation harness are released. The page text cuts off at the LoRA fine-tuning section, so training hyperparameters are not covered here.

How it works

A 35B teacher model generates 5,233 synthetic (Q, C) records. A 120B judge from a different model family re-labels each one blind, and the two agree on 95.0%. Agreed records train the student with reasoning-first LoRA: 3,835 train, 479 validation, 659 test.

Attack families are indirect prompt injection (818 records), knowledge-base poisoning (500), context hijack (400) and PII exfiltration (200). There are also 3,115 benign records and 200 borderline ones. Payloads always sit in C (HTML comments, footers, "ignore previous instructions" clauses), never in Q.

The paper also builds 120 "judgment-flip" pairs, held out for testing. Each pair places the same sentence in a benign documentation context and in an injected context.

Results beyond the headline

Recall on the in-distribution test set:

On flip pairs, where both halves must be labelled correctly, the model scores 75%. Keyword filter 17.5%, ProtectAI DeBERTa 54%, Llama Guard 27%.

In ablations, masking C drops recall to zero. Adding Q to C lowers false positives, so the attack signal is in the context and the query helps only with over-flagging.

Latency is 293-404 ms per single request depending on the serving runtime, above the paper's own sub-100 ms target. Batched throughput is 37 ms amortized.

Preconditions / Affected

The threat model assumes a benign user query and an attacker who controls retrievable content (web pages, documents, memory entries) and embeds instructions in it. It targets local deployments on 16 GB-class VRAM.

Caveats

• All headline numbers are in-distribution on data generated by the same teacher. The author states there is no validated robustness against adaptive adversaries.
• On PoisonedRAG, an external benchmark, recall collapses to near zero. The author attributes this to fluent fact-fabrication attacks falling outside an instruction-consistency threat model. The detector will not catch poisoned passages that contain no instructions.
• The 75% flip-pair score means one in four injected-versus-benign pairs is still mislabelled.
• Prompt-Guard-86M's 0.690 FPR is measured on this synthetic benign set, which includes instructional documentation text.
• The baseline comparison uses the 1B Llama Guard 3 checkpoint run locally.