Indirect prompt injection (IPI) is a growing threat where malicious instructions are hidden inside data that an LLM processes. Many defenses rely on a second LLM as a guardrail, but that approach has a clear weakness: when the guardrail model is small or weak, detection quality drops sharply. That makes it hard to deploy robust IPI protection on resource-constrained systems.
The new arXiv paper introduces SpanGuard, a method that tackles this by splitting the task into two parts. Instead of asking the guardrail model to both locate suspicious instructions and decide whether they are authorized, SpanGuard handles localization and authorization separately. The idea is that each subtask is simpler, so the overall defense can work with a lighter model.
The abstract is brief and does not include experimental details, so it is not yet possible to say how well SpanGuard performs in practice. The paper's contribution is the architectural separation itself, which may offer a path toward IPI defense that does not depend so heavily on the raw capability of the guardrail LLM.