System-Prompt Anchoring with Cross-Attention Layers
Not on the map. Why?
Abstract (arXiv)
Cross-attention provides a dedicated route from a selected information source into a model's computation, but the effect of where that route is inserted remains underexplored. We study this question when the source is a privileged system-prompt span. We insert Cross-Attention Layer (CAL) blocks between the system prompt and text while keeping the causal-decoder backbone frozen. A ten-configuration sweep on a 1.5B backbone shows that performance is task-dependent and strongly affected by placement: later placements are generally more effective and parameter-efficient. In an 8B scaling study, we train only the overall best configuration and compare it with parameter-matched adaptation baselines. Across the evaluated benchmarks, the effects remain task-dependent: cross-attention changes instruction-following and security behavior while largely preserving general-task performance. Together, these experiments characterize placement as an important design variable when injecting system-prompt information through cross-attention.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 29 of its 36 references that are in the map. First posted on arXiv 10 May 2026.
Builds on
29 of 36 references.
References · 29
- 2017Attention Is All You Needcited by 60,361
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
- 2021Training Verifiers to Solve Math Word Problemscited by 10,109
- 2020Measuring Massive Multitask Language Understandingcited by 7,963
- 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
- 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,503
- 2024Qwen2.5 Technical Reportcited by 4,942
- 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,386
- 2023FlashAttention-2: Faster Attention with Better Parallelism and Work Partitioningcited by 2,598
- 2020GLU Variants Improve Transformercited by 1,804
- 2018Know What You Don't Know: Unanswerable Questions for SQuADcited by 1,554
- 2019Root Mean Square Layer Normalizationcited by 1,480
17 more
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
- 2019ZeRO: Memory Optimizations Toward Training Trillion Parameter Modelscited by 1,301
- 2021Improving language models by retrieving from trillions of tokenscited by 1,293
- 2023Instruction-Following Evaluation for Large Language Modelscited by 1,228
- 2021Towards a Unified View of Parameter-Efficient Transfer Learningcited by 872
- 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 538
- 2022Transformer Feed-Forward Layers Build Predictions by Promoting Concepts in the Vocabulary Spacecited by 532
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
- 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 375
- 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 210
- 2023Tensor Trust: Interpretable Prompt Injection Attacks from an Online Gamecited by 145
- 2024SysBench: Can Large Language Models Follow System Messages?cited by 28
- 2026IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMscited by 15
- 2025Stronger Enforcement of Instruction Hierarchy via Augmented Intermediate Representationscited by 9
Built on by
Not cited yet.