Long-context LLMs are vulnerable to prompt injection, where an attacker injects an instruction into a long context to hijack the LLM’s output. Existing defenses, designed for short contexts, have limited effectiveness in long-context scenarios because the injected instruction constitutes only a small portion of the context. We propose PISanitizer, which pinpoints and sanitizes injected tokens in a context before a backend LLM generates its response. PISanitizer builds on two observations: (1) prompt injection attacks craft instructions that compel an LLM to follow them, and (2) LLMs leverage attention to focus on influential input tokens during generation. Accordingly, we intentionally let an LLM follow any instructions in the context and then sanitize tokens receiving high attention from the resulting instruction-following behavior. This design creates a dilemma for attackers: the more effectively an injected instruction compels the LLM to follow it, the more likely it is to be sanitized. Comprehensive evaluations demonstrate that PISanitizer successfully and efficiently prevents prompt injection, maintains utility, outperforms existing defenses, and is robust to optimization-based and adaptive attacks. The code is available at https://github.com/sleeepeer/PISanitizer.

Prompt injection attacks pose serious security risks across a wide range of real-world applications. While receiving increasing attention, the community faces a critical gap: the lack of a unified platform for prompt injection evaluation. This makes it challenging to reliably compare defenses, understand their true robustness under diverse attacks, or assess how well they generalize across tasks and benchmarks. For instance, many defenses initially reported as effective were later found to exhibit limited robustness on diverse datasets and attacks. To bridge this gap, we introduce PIArena, a unified and extensible platform for prompt injection evaluation that enables users to easily integrate state-of-the-art attacks and defenses and evaluate them across a variety of existing and new benchmarks. We also design a dynamic strategy-based attack that adaptively optimizes injected prompts based on defense feedback. Through comprehensive evaluation using PIArena, we uncover critical limitations of state-of-the-art defenses: limited generalizability across tasks, vulnerability to adaptive attacks, and fundamental challenges when an injected task aligns with the target task. The code and datasets are available at https://github.com/sleeepeer/PIArena.