mlsanityData to 14 Oct 2026

SecInfer: Preventing Prompt Injection via Inference-time Scaling

arXiv 2509.24967 ↗First posted 29 Sep 2025cs.CR cs.AIcited by 10

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

Prompt injection attacks pose a pervasive threat to the security of Large Language Models (LLMs). State-of-the-art prevention-based defenses typically rely on fine-tuning an LLM to enhance its security, but they achieve limited effectiveness against strong attacks. In this work, we propose SecInfer, a novel defense against prompt injection attacks built on inference-time scaling, an emerging paradigm that boosts LLM capability by allocating more compute resources for reasoning during inference. SecInfer consists of two key steps: system-prompt-guided sampling, which generates multiple responses for a given input by exploring diverse reasoning paths through a varied set of system prompts, and target-task-guided aggregation, which selects the response most likely to accomplish the intended task. Extensive experiments show that, by leveraging additional compute at inference, SecInfer effectively mitigates both existing and adaptive prompt injection attacks, outperforming state-of-the-art defenses as well as existing inference-time scaling approaches.

Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 17 of its 78 references that are in the map. First posted on arXiv 29 Sep 2025.

Builds on

17 of 78 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025Trading Inference-Time Compute for Adversarial Robustness31 Jan

Other references · 16

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2025Qwen3 Technical Reportcited by 8,820
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  5. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  6. 2024Measuring short-form factuality in large language modelscited by 373
  7. 2025Defeating Prompt Injections by Designcited by 297
  8. 2025Progent: Securing AI Agents with Privilege Controlcited by 141
  9. 2025Securing AI Agents with Information-Flow Controlcited by 121
  10. 2025PromptArmor: Simple yet Effective Prompt Injection Defensescited by 108
  11. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
  12. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agentscited by 87
4 more
  1. 2024Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attackscited by 85
  2. 2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 55
  3. 2025Lessons from Defending Gemini Against Indirect Prompt Injectionscited by 43
  4. 2025A Critical Evaluation of Defenses against Prompt Injection Attackscited by 36

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 8.

10 papers.

  1. 2026The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysiscited by 30
  2. 2025PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Featurescited by 20
  3. 2026PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defensescited by 16
  4. 2026PIArena: A Platform for Prompt Injection Evaluationcited by 11
  5. 2025Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworkscited by 9
  6. 2026Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memorycited by 7
  7. 2026Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screeningcited by 5
  8. 2026Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMscited by 1
  9. 2026LongPIBench: A Long-Context Benchmark for Prompt Injectioncited by 1
  10. 2026ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Automatic and Universal Prompt Injection Attacks against Large Language Models
  2. 2026Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense
  3. 2026Know Thy Enemy: Securing LLMs Against Prompt Injection via Diverse Data Synthesis and Instruction-Level Chain-of-Thought Learning
  4. 2023Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injection
  5. 2025Prompt Injection as an Emerging Threat: Evaluating the Resilience of Large Language Models
  6. 2025Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression
  7. 2025Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction
  8. 2024Defense Against Prompt Injection Attack by Leveraging Attack Techniques