@inproceedings{chen-etal-2026-beyond-refusal,
title = "Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds",
author = "Chen, Jiahao and
Yin, Rui and
Li, Xinfeng and
Ma, Qianli and
Du, Tianyu and
Fu, Zhihui and
Wang, Jun and
Wang, Zhaoxiang and
Ji, Shouling",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.188/",
pages = "3995--4001",
ISBN = "979-8-89176-462-0",
abstract = "Large Language Models (LLMs) integrated into complex ecosystems (e.g., code agents) face critical safety threats from Indirect Prompt Injection (IPI) attacks, where malicious instructions are embedded in retrieved data. Existing defenses face an intractable safety-utility trade-off: sanitization-based guardrails incur high latency, while detection-based guardrails suffer from severe over-refusal. We first demonstrate, both theoretically and empirically, that LLMs can intrinsically separate instructions from data. Inspired by this insight, we propose AEGIS (*A*daptive *E*nsemble *G*uard for *I*njection *S*hielding), a training-free defense that extracts instruction-sensitive projectors to identify malicious instructions and leverages a Unified Multi-Layer Consensus that aggregates topologically distinct signals across the network depth. Evaluations on eight IPI attacks and ten baselines show that AEGIS achieves state-of-the-art detection accuracy while reducing the false positive rate on benign tasks to below 1{\%}. Code is available at [Github](https://github.com/xaddwell/AEGIS)."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="chen-etal-2026-beyond-refusal">
<titleInfo>
<title>Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds</title>
</titleInfo>
<name type="personal">
<namePart type="given">Jiahao</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Rui</namePart>
<namePart type="family">Yin</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xinfeng</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Qianli</namePart>
<namePart type="family">Ma</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tianyu</namePart>
<namePart type="family">Du</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhihui</namePart>
<namePart type="family">Fu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhaoxiang</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Shouling</namePart>
<namePart type="family">Ji</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Large Language Models (LLMs) integrated into complex ecosystems (e.g., code agents) face critical safety threats from Indirect Prompt Injection (IPI) attacks, where malicious instructions are embedded in retrieved data. Existing defenses face an intractable safety-utility trade-off: sanitization-based guardrails incur high latency, while detection-based guardrails suffer from severe over-refusal. We first demonstrate, both theoretically and empirically, that LLMs can intrinsically separate instructions from data. Inspired by this insight, we propose AEGIS (*A*daptive *E*nsemble *G*uard for *I*njection *S*hielding), a training-free defense that extracts instruction-sensitive projectors to identify malicious instructions and leverages a Unified Multi-Layer Consensus that aggregates topologically distinct signals across the network depth. Evaluations on eight IPI attacks and ten baselines show that AEGIS achieves state-of-the-art detection accuracy while reducing the false positive rate on benign tasks to below 1%. Code is available at [Github](https://github.com/xaddwell/AEGIS).</abstract>
<identifier type="citekey">chen-etal-2026-beyond-refusal</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.188/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>3995</start>
<end>4001</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds
%A Chen, Jiahao
%A Yin, Rui
%A Li, Xinfeng
%A Ma, Qianli
%A Du, Tianyu
%A Fu, Zhihui
%A Wang, Jun
%A Wang, Zhaoxiang
%A Ji, Shouling
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F chen-etal-2026-beyond-refusal
%X Large Language Models (LLMs) integrated into complex ecosystems (e.g., code agents) face critical safety threats from Indirect Prompt Injection (IPI) attacks, where malicious instructions are embedded in retrieved data. Existing defenses face an intractable safety-utility trade-off: sanitization-based guardrails incur high latency, while detection-based guardrails suffer from severe over-refusal. We first demonstrate, both theoretically and empirically, that LLMs can intrinsically separate instructions from data. Inspired by this insight, we propose AEGIS (*A*daptive *E*nsemble *G*uard for *I*njection *S*hielding), a training-free defense that extracts instruction-sensitive projectors to identify malicious instructions and leverages a Unified Multi-Layer Consensus that aggregates topologically distinct signals across the network depth. Evaluations on eight IPI attacks and ten baselines show that AEGIS achieves state-of-the-art detection accuracy while reducing the false positive rate on benign tasks to below 1%. Code is available at [Github](https://github.com/xaddwell/AEGIS).
%U https://aclanthology.org/2026.findings-emnlp.188/
%P 3995-4001
Markdown (Informal)
[Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds](https://aclanthology.org/2026.findings-emnlp.188/) (Chen et al., Findings 2026)
ACL
- Jiahao Chen, Rui Yin, Xinfeng Li, Qianli Ma, Tianyu Du, Zhihui Fu, Jun Wang, Zhaoxiang Wang, and Shouling Ji. 2026. Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 3995–4001, Budapest, Hungary. Association for Computational Linguistics.