@inproceedings{geng-etal-2026-pisanitizer,
title = "{PIS}anitizer: Preventing Prompt Injection to Long-Context {LLM}s via Prompt Sanitization",
author = "Geng, Runpeng and
Wang, Yanting and
Yin, Chenlong and
Cheng, Minhao and
Chen, Ying and
Jia, Jinyuan",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.942/",
pages = "21706--21729",
ISBN = "979-8-89176-459-0",
abstract = "Long-context LLMs are vulnerable to prompt injection, where an attacker injects an instruction into a long context to hijack the LLM{'}s output. Existing defenses, designed for short contexts, have limited effectiveness in long-context scenarios because the injected instruction constitutes only a small portion of the context. We propose PISanitizer, which pinpoints and sanitizes injected tokens in a context before a backend LLM generates its response. PISanitizer builds on two observations: (1) prompt injection attacks craft instructions that compel an LLM to follow them, and (2) LLMs leverage attention to focus on influential input tokens during generation. Accordingly, we intentionally let an LLM follow any instructions in the context and then sanitize tokens receiving high attention from the resulting instruction-following behavior. This design creates a dilemma for attackers: the more effectively an injected instruction compels the LLM to follow it, the more likely it is to be sanitized. Comprehensive evaluations demonstrate that PISanitizer successfully and efficiently prevents prompt injection, maintains utility, outperforms existing defenses, and is robust to optimization-based and adaptive attacks. The code is available at https://github.com/sleeepeer/PISanitizer."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="geng-etal-2026-pisanitizer">
<titleInfo>
<title>PISanitizer: Preventing Prompt Injection to Long-Context LLMs via Prompt Sanitization</title>
</titleInfo>
<name type="personal">
<namePart type="given">Runpeng</namePart>
<namePart type="family">Geng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yanting</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Chenlong</namePart>
<namePart type="family">Yin</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Minhao</namePart>
<namePart type="family">Cheng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ying</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jinyuan</namePart>
<namePart type="family">Jia</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>Long-context LLMs are vulnerable to prompt injection, where an attacker injects an instruction into a long context to hijack the LLM’s output. Existing defenses, designed for short contexts, have limited effectiveness in long-context scenarios because the injected instruction constitutes only a small portion of the context. We propose PISanitizer, which pinpoints and sanitizes injected tokens in a context before a backend LLM generates its response. PISanitizer builds on two observations: (1) prompt injection attacks craft instructions that compel an LLM to follow them, and (2) LLMs leverage attention to focus on influential input tokens during generation. Accordingly, we intentionally let an LLM follow any instructions in the context and then sanitize tokens receiving high attention from the resulting instruction-following behavior. This design creates a dilemma for attackers: the more effectively an injected instruction compels the LLM to follow it, the more likely it is to be sanitized. Comprehensive evaluations demonstrate that PISanitizer successfully and efficiently prevents prompt injection, maintains utility, outperforms existing defenses, and is robust to optimization-based and adaptive attacks. The code is available at https://github.com/sleeepeer/PISanitizer.</abstract>
<identifier type="citekey">geng-etal-2026-pisanitizer</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.942/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>21706</start>
<end>21729</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T PISanitizer: Preventing Prompt Injection to Long-Context LLMs via Prompt Sanitization
%A Geng, Runpeng
%A Wang, Yanting
%A Yin, Chenlong
%A Cheng, Minhao
%A Chen, Ying
%A Jia, Jinyuan
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F geng-etal-2026-pisanitizer
%X Long-context LLMs are vulnerable to prompt injection, where an attacker injects an instruction into a long context to hijack the LLM’s output. Existing defenses, designed for short contexts, have limited effectiveness in long-context scenarios because the injected instruction constitutes only a small portion of the context. We propose PISanitizer, which pinpoints and sanitizes injected tokens in a context before a backend LLM generates its response. PISanitizer builds on two observations: (1) prompt injection attacks craft instructions that compel an LLM to follow them, and (2) LLMs leverage attention to focus on influential input tokens during generation. Accordingly, we intentionally let an LLM follow any instructions in the context and then sanitize tokens receiving high attention from the resulting instruction-following behavior. This design creates a dilemma for attackers: the more effectively an injected instruction compels the LLM to follow it, the more likely it is to be sanitized. Comprehensive evaluations demonstrate that PISanitizer successfully and efficiently prevents prompt injection, maintains utility, outperforms existing defenses, and is robust to optimization-based and adaptive attacks. The code is available at https://github.com/sleeepeer/PISanitizer.
%U https://aclanthology.org/2026.emnlp-main.942/
%P 21706-21729
Markdown (Informal)
[PISanitizer: Preventing Prompt Injection to Long-Context LLMs via Prompt Sanitization](https://aclanthology.org/2026.emnlp-main.942/) (Geng et al., EMNLP 2026)
ACL