mlsanityData to 14 Oct 2026

PromptLocate: Localizing Prompt Injection Attacks

arXiv 2510.12252 ↗First posted 14 Oct 2025cs.CR cs.AIcited by 28

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

Prompt injection attacks deceive a large language model into completing an attacker-specified task instead of its intended task by contaminating its input data with an injected prompt, which consists of injected instruction(s) and data. Localizing the injected prompt within contaminated data is crucial for post-attack forensic analysis and data recovery. Despite its growing importance, prompt injection localization remains largely unexplored. In this work, we bridge this gap by proposing PromptLocate, the first method for localizing injected prompts. PromptLocate comprises three steps: (1) splitting the contaminated data into semantically coherent segments, (2) identifying segments contaminated by injected instructions, and (3) pinpointing segments contaminated by injected data. We show PromptLocate accurately localizes injected prompts across eight existing and eight adaptive attacks.

Key facts. Cited by 28 papers in the map (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 32 of its 49 references that are in the map. First posted on arXiv 14 Oct 2025.

Builds on

32 of 49 references.

Closest ancestors · 20

Same direction, newest first

  1. 2025A Critical Evaluation of Defenses against Prompt Injection Attacks23 May
  2. 2025Lessons from Defending Gemini Against Indirect Prompt Injections20 May
  3. 2025WebInject: Prompt Injection Attack to Web Agents16 May
  4. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  5. 2025DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks15 Apr
  6. 2025Defeating Prompt Injections by Design24 Mar
  7. 2025Can Indirect Prompt Injection Attacks Be Detected and Removed?23 Feb
  8. 2024Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignment18 Oct
  9. 2024Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy9 Oct
  10. 2024SecAlign: Defending Against Prompt Injection with Preference Optimization7 Oct
  11. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective27 Sep
  12. 2024Get my drift? Catching LLM Task Drift with Activation Deltas2 Jun
8 more
  1. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions19 Apr
  2. 2024Optimization-based Prompt Injection Attack to LLM-as-a-Judge26 Mar
  3. 2024Automatic and Universal Prompt Injection Attacks against Large Language Models7 Mar
  4. 2024Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks6 Mar
  5. 2024StruQ: Defending Against Prompt Injection with Structured Queries9 Feb
  6. 2023Jatmo: Prompt Injection Defense by Task-Specific Finetuning29 Dec
  7. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defenses19 Oct
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection23 Feb

Other references · 12

  1. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  2. 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
  3. 2023Mistral 7Bcited by 3,164
  4. 2013Visualizing and Understanding Convolutional Networkscited by 2,290
  5. 2018RISE: Randomized Input Sampling for Explanation of Black-box Modelscited by 838
  6. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  7. 2020Making Monolingual Sentence Embeddings Multilingual using Knowledge Distillationcited by 593
  8. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  9. 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 127
  10. 2025Securing AI Agents with Information-Flow Controlcited by 121
  11. 2024Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?cited by 81
  12. 2025Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interfacecited by 17

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 24.

28 papers.

Sort:

By area:

  1. 2025Defending Against Prompt Injection with DataFiltercited by 35
  2. 2026The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysiscited by 30
  3. 2026ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injectioncited by 27
  4. 2025PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Featurescited by 20
  5. 2025ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Datacited by 18
  6. 2026PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defensescited by 16
  7. 2026A Framework for Formalizing LLM Agent Securitycited by 16
  8. 2026Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysiscited by 13
  9. 2026WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agentscited by 11
  10. 2026Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden Statescited by 7
  11. 2026AgentWatcher: A Rule-based Prompt Injection Monitorcited by 6
  12. 2026AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualizationcited by 6
16 more
  1. 2026AlignSentinel: Alignment-Aware Detection of Prompt Injection Attackscited by 5
  2. 2026Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screeningcited by 5
  3. 2025AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applicationscited by 3
  4. 2026RedVisor: Reasoning-Aware Prompt Injection Defense via Zero-Copy KV Cache Reusecited by 2
  5. 2026Who Broke the System? Failure Localization in LLM-Based Multi-Agent Systemscited by 2
  6. 2026Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifoldscited by 1
  7. 2026Efficient and Adaptable Detection of Malicious LLM Prompts via Bootstrap Aggregationcited by 0
  8. 2026A Sentence Relation-Based Approach to Sanitizing Malicious Instructionscited by 0
  9. 2026Cordyceps: Covert Control Attacks on LLMs via Data Poisoningcited by 0
  10. 2026Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agentscited by 0
  11. 2026CPInj: Uncovering Prompt Injection Risks in Textual Collaborative Prompt Optimizationcited by 0
  12. 2026Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agentscited by 0
  13. 2026ContextLeak: Exfiltrating LLM Agent Context via Malicious Toolscited by 0
  14. 2026Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputscited by 0
  15. 2026Origin Is All You Need: Provenance-Aware Transformers for Structural Trust-Boundary Separationcited by 0
  16. 2026Render Before Reading: Visual Rendering as a Prompt Injection Defensecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026The Anatomy of a Prompt Injection: A Component Model for Structured Analysis
  2. 2025System Prompt Poisoning: Persistent Attacks on Large Language Models Beyond User Injection
  3. 2025PromptShield: Deployable Detection for Prompt Injection Attacks
  4. 2026BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes
  5. 2025PromptSleuth: Detecting Prompt Injection via Semantic Intent Invariance
  6. 2026LongPIBench: A Long-Context Benchmark for Prompt Injection
  7. 2023Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injection
  8. 2025Defending against Indirect Prompt Injection by Instruction Detection