---
title: "CachePrune — paper by Wang et al. (2026) — summary and ideas"
description: "The paper addresses indirect prompt injection, where an LLM obeys commands hidden inside supplied context (e.g., a… 48 references."
authors: ["Rui Wang", "Junda Wu", "Yu Xia", "Tong Yu", "Ruiyi Zhang", "Ryan A. Rossi", "Subrata Mitra", "Lina Yao", "Julian McAuley"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.70/"
doi: "10.18653/v1/2026.acl-long.70"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/wang-2026-cacheprune-teaching-llms-what-not/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/wang-2026-cacheprune-teaching-llms-what-not/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/24/) / CachePrune: Teaching LLMs What Not to Follow via KV-Cache Editing

# CachePrune: Teaching LLMs What Not to Follow via KV-Cache Editing

**Authors:** [Rui Wang](https://md.research.elamur.ai/free/en/authors/rui-wang/), [Junda Wu](https://md.research.elamur.ai/free/en/authors/junda-wu/), [Yu Xia](https://md.research.elamur.ai/free/en/authors/yu-xia/), [Tong Yu](https://md.research.elamur.ai/free/en/authors/tong-yu/), [Ruiyi Zhang](https://md.research.elamur.ai/free/en/authors/ruiyi-zhang/), [Ryan A. Rossi](https://md.research.elamur.ai/free/en/authors/ryan-a-rossi/), Subrata Mitra, [Lina Yao](https://md.research.elamur.ai/free/en/authors/lina-yao/) and [Julian McAuley](https://md.research.elamur.ai/free/en/authors/julian-mcauley/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.70/) · [PDF](https://aclanthology.org/2026.acl-long.70.pdf) · [DOI 10.18653/v1/2026.acl-long.70](https://doi.org/10.18653/v1/2026.acl-long.70) · [OpenAlex](https://openalex.org/W4417522396)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
The paper addresses indirect prompt injection, where an LLM obeys commands hidden inside supplied context (e.g., a retrieved passage) instead of answering the user's actual request. The authors attribute this to the model failing to separate data from instructions. Their method, CachePrune, works in two stages. First, it finds neurons in the key/value activations of the context that push the model toward obeying injected text. It does this with a gradient-times-activation attribution score driven by a "preferential attribution loss," which compares sampled clean and poisoned responses and is shown to bound the DPO objective from above. Second, it masks those neurons only when building the KV cache for the context span. A regularizing subset keeps user-instruction following intact. The attribution also exploits a "triggering effect": the first few response tokens best reveal whether the output will be poisoned. Because only a pruning mask is applied, CachePrune leaves the prompt format untouched and adds no generation-time cost. It also fits context-caching setups. Experiments, mainly on SQuAD with Llama3-8B, show large drops in attack success rate (ASR) while clean-answer F1 is preserved.

## Key points
- Attribution needs only a few prompt samples. Each neuron's scores are aggregated by taking the maximum over context tokens, and up to p% of neurons are pruned from a "safe" subset Φ.
- Using only the earliest response tokens works better than using the full response. On SQuAD with Llama3-8B, ASR is 5.57 with k=2 and 7.44 with k=1, versus 14.81 when all tokens are used.
- Masks transfer across injection types:
  - **Code injections:** ASR drops from 17.5 (no defense) to 1.77 with a code-learned mask and 3.20 with a text-learned mask.
  - **Text injections:** ASR drops from 45.15 to 9.23 (text-learned mask) and 16.9 (code-learned mask).
  - **Sources:** code tasks come from Chaudhary (2023) and text tasks from Ji et al. (2023).
- Masks also generalize across four different attack instructions, with off-diagonal transfers performing comparably to matched ones.
- Pruned neurons cluster in middle layers and are mostly key rather than value neurons. This suggests the method changes attention to the context while largely preserving the context's content.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [University of California San Diego](https://md.research.elamur.ai/free/en/universities/university-of-california-san-diego/) — University, San Diego, United States · 73 works · 51,948 citations
- [Adobe Systems](https://md.research.elamur.ai/free/en/companies/adobe-systems/) — Company, San Jose, United States · 35 works · 3,711 citations
- [UNSW Sydney](https://md.research.elamur.ai/free/en/universities/unsw-sydney/) — University, Sydney, Australia · 34 works · 1,509 citations

📚 Shelves (5): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works · [🗄️ Information Systems](https://md.research.elamur.ai/free/en/shelves/computer-science/information-systems/) · 1,437 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works

## Cite

Cite as: Rui Wang, Junda Wu, Yu Xia, Tong Yu, Ruiyi Zhang, Ryan A. Rossi, Subrata Mitra, Lina Yao and Julian McAuley. 2026. CachePrune: Teaching LLMs What Not to Follow via KV-Cache Editing. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{wang2026cacheprune,
  title = {{CachePrune: Teaching LLMs What Not to Follow via KV-Cache Editing}},
  author = {Rui Wang, Junda Wu, Yu Xia, Tong Yu, Ruiyi Zhang, Ryan A. Rossi, Subrata Mitra, Lina Yao and Julian McAuley},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.70},
  url = {https://doi.org/10.18653/v1/2026.acl-long.70}
}
```

- [← previous C-ReD: A Comprehensive Chinese Benchmark for AI-Generated Text Detection Derived from Real-World Prompts](https://md.research.elamur.ai/free/en/papers/qing-2026-c-red-comprehensive-chinese-benchmark/)
- [next → Caged Birds and Cute Bookworms: Feminine Tropes and Implicit Gender Bias in Large Language Models](https://md.research.elamur.ai/free/en/papers/nishal-2026-caged-birds-cute-bookworms-feminine/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/24/)

## References

48 references, 20 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. 2025. gemin-cc. [http://ai.google.dev/](http://ai.google.dev/) gemini-api/docs/caching?lang=python. 2025. openai-cc. https://openai.com/index/ api-prompt-caching/. 2025. Owasp. https://genai.owasp.org/. [↗](http://ai.google.dev/)
2. Sahar Abdelnabi, Aideen Fay, Giovanni Cherubin, Ahmed Salem, Mario Fritz, and Andrew Paverd. 2024. Are you still on track!? catching llm task drift with activations. arXiv preprint arXiv:2406.00799. — [arXiv:2406.00799](https://arxiv.org/abs/2406.00799) [find](https://scholar.google.com/scholar?q=Sahar+Abdelnabi%2C+Aideen+Fay%2C+Giovanni+Cherubin%2C+Ahmed+Salem%2C+Mario+Fritz%2C+and+Andrew+Paverd%2E+2024%2E+Are+you+still+on+track%21%3F+catching+llm+task+drift+with+activations%2E+arXiv+preprint+arXiv%3A2406%2E00799%2E+%E2%80%94)
3. Sahar Abdelnabi, Aideen Fay, Giovanni Cherubin, Ahmed Salem, Mario Fritz, and Andrew Paverd. 2025. Get my drift? catching llm task drift with activation deltas. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 43–67. IEEE. [find](https://scholar.google.com/scholar?q=Sahar+Abdelnabi%2C+Aideen+Fay%2C+Giovanni+Cherubin%2C+Ahmed+Salem%2C+Mario+Fritz%2C+and+Andrew+Paverd%2E+2025%2E+Get+my+drift%3F+catching+llm+task+drift+with+activation+deltas%2E+In+2025+IEEE+Conference+on+Secure+and+T)
4. Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, Alon Benhaim, Misha Bilenko, Johan Bjorck, Sébastien Bubeck, Martin Cai, Qin Cai, Vishrav Chaudhary, Dong Chen, Dongdong Chen, and 110 others. 2024. Phi-… — [Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone](https://md.research.elamur.ai/free/en/papers/abdin-2024-phi-3-technical-report-highly/)
5. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). arXiv preprint arXiv:2303.08774.
6. Lin Ai, Zheng Hui, Zizhou Liu, and Julia Hirschberg. 2024. Enhancing pre-trained generative language models with question attended span extraction on machine reading comprehension. arXiv preprint arXiv:2404.17991. [find](https://scholar.google.com/scholar?q=Lin+Ai%2C+Zheng+Hui%2C+Zizhou+Liu%2C+and+Julia+Hirschberg%2E+2024%2E+Enhancing+pre%2Dtrained+generative+language+models+with+question+attended+span+extraction+on+machine+reading+comprehension%2E+arXiv+preprint+arXi)
7. Md Ahsan Ayub and Subhabrata Majumdar. 2024. Embedding-based classifiers can detect prompt injection attacks. arXiv preprint arXiv:2410.22284. — [arXiv:2410.22284](https://arxiv.org/abs/2410.22284) [find](https://scholar.google.com/scholar?q=Md+Ahsan+Ayub+and+Subhabrata+Majumdar%2E+2024%2E+Embedding%2Dbased+classifiers+can+detect+prompt+injection+attacks%2E+arXiv+preprint+arXiv%3A2410%2E22284%2E+%E2%80%94+%5BarXiv%3A2410%2E22284%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2410%2E22284%29)
8. Jonas Becker, Jan Philip Wahle, Bela Gipp, and Terry Ruas. 2024. Text generation: A systematic literature review of tasks, evaluation, and challenges. arXiv preprint arXiv:2405.15604. — [arXiv:2405.15604](https://arxiv.org/abs/2405.15604) [find](https://scholar.google.com/scholar?q=Jonas+Becker%2C+Jan+Philip+Wahle%2C+Bela+Gipp%2C+and+Terry+Ruas%2E+2024%2E+Text+generation%3A+A+systematic+literature+review+of+tasks%2C+evaluation%2C+and+challenges%2E+arXiv+preprint+arXiv%3A2405%2E15604%2E+%E2%80%94+%5BarXiv%3A2405%2E15)
9. Sahil Chaudhary. 2023. Code alpaca: An instruction-following llama model for code generation. [https://github.com/sahil280114/codealpaca](https://github.com/sahil280114/codealpaca). [↗](https://github.com/sahil280114/codealpaca)
10. Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. 2024a. Struq: Defending against prompt injection with structured queries. arXiv preprint arXiv:2402.06363. — [arXiv:2402.06363](https://arxiv.org/abs/2402.06363) [find](https://scholar.google.com/scholar?q=Sizhe+Chen%2C+Julien+Piet%2C+Chawin+Sitawarin%2C+and+David+Wagner%2E+2024a%2E+Struq%3A+Defending+against+prompt+injection+with+structured+queries%2E+arXiv+preprint+arXiv%3A2402%2E06363%2E+%E2%80%94+%5BarXiv%3A2402%2E06363%5D%28https%3A%2F%2Farx)
11. Sizhe Chen, Arman Zharmagambetov, Saeed Mahloujifar, Kamalika Chaudhuri, and Chuan Guo. 2024b. Aligning llms to be robust against prompt injection. arXiv preprint arXiv:2410.05451. — [arXiv:2410.05451](https://arxiv.org/abs/2410.05451) [find](https://scholar.google.com/scholar?q=Sizhe+Chen%2C+Arman+Zharmagambetov%2C+Saeed+Mahloujifar%2C+Kamalika+Chaudhuri%2C+and+Chuan+Guo%2E+2024b%2E+Aligning+llms+to+be+robust+against+prompt+injection%2E+arXiv+preprint+arXiv%3A2410%2E05451%2E+%E2%80%94+%5BarXiv%3A2410%2E05451)
12. Mor Geva, Roei Schuster, Jonathan Berant, and Omer Levy. 2021. Transformer feed-forward layers are key-value memories. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5484–5495. [find](https://scholar.google.com/scholar?q=Mor+Geva%2C+Roei+Schuster%2C+Jonathan+Berant%2C+and+Omer+Levy%2E+2021%2E+Transformer+feed%2Dforward+layers+are+key%2Dvalue+memories%2E+In+Proceedings+of+the+2021+Conference+on+Empirical+Methods+in+Natural+Language+Pr)
13. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. [Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection](https://md.research.elamur.ai/free/en/papers/greshake-2023-ve-signed-up-compromising-real/). In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security,…
14. Keegan Hines, Gary Lopez, Matthew Hall, Federico Zarfati, Yonatan Zunger, and Emre Kiciman. 2024. Defending against indirect prompt injection attacks with spotlighting. arXiv preprint arXiv:2403.14720. — [arXiv:2403.14720](https://arxiv.org/abs/2403.14720) [find](https://scholar.google.com/scholar?q=Keegan+Hines%2C+Gary+Lopez%2C+Matthew+Hall%2C+Federico+Zarfati%2C+Yonatan+Zunger%2C+and+Emre+Kiciman%2E+2024%2E+Defending+against+indirect+prompt+injection+attacks+with+spotlighting%2E+arXiv+preprint+arXiv%3A2403%2E14720)
15. Chengkai Huang, Kaige Xie, Rui Wang, Tong Yu, and Lina Yao. 2024. Learn when (not) to trust language models: A privacy-centric adaptive model-aware approach. arXiv preprint arXiv:2404.03514. — [arXiv:2404.03514](https://arxiv.org/abs/2404.03514) [find](https://scholar.google.com/scholar?q=Chengkai+Huang%2C+Kaige+Xie%2C+Rui+Wang%2C+Tong+Yu%2C+and+Lina+Yao%2E+2024%2E+Learn+when+%28not%29+to+trust+language+models%3A+A+privacy%2Dcentric+adaptive+model%2Daware+approach%2E+arXiv+preprint+arXiv%3A2404%2E03514%2E+%E2%80%94+%5BarXiv%3A)
16. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. [Beavertails: Towards improved safety alignment of llm via a human-preference dataset](https://md.research.elamur.ai/free/en/papers/ji-2023-beavertails-towards-improved-safety-alignment/). Advances in Neural Information Processing Systems, 36:24678–24704.
17. Feiran Jia, Tong Wu, Xin Qin, and Anna Squicciarini. 2025. [The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents](https://md.research.elamur.ai/free/en/papers/jia-2025-task-shield-enforcing-task-alignment/). In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 29680–29697.
18. Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, and 1 others. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825. [find](https://scholar.google.com/scholar?q=Albert+Q+Jiang%2C+Alexandre+Sablayrolles%2C+Arthur+Mensch%2C+Chris+Bamford%2C+Devendra+Singh+Chaplot%2C+Diego+de+las+Casas%2C+Florian+Bressand%2C+Gianna+Lengyel%2C+Guillaume+Lample%2C+Lucile+Saulnier%2C+and+1+others%2E+202)
19. Hao Li, Xiaogeng Liu, Ning Zhang, and Chaowei Xiao. 2025. [Piguard: Prompt injection guardrail via mitigating overdefense for free](https://md.research.elamur.ai/free/en/papers/li-2025-piguard-prompt-injection-guardrail-mitigating/). In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 30420–30437.
20. Miles Q Li and Benjamin CM Fung. 2025. Security concerns for [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). Journal of Information Security and Applications, 95:104284.
21. Chin-Yew Lin. 2004. [Rouge: A package for automatic evaluation of summaries](https://md.research.elamur.ai/free/en/papers/lin-2004-rouge-package-automatic-evaluation-summaries/). In Text Summarization Branches Out, pages 74–81, Barcelona, Spain. Association for Computational Linguistics.
22. Ruofan Liu, Yun Lin, Zhiyong Huang, and Jin Song Dong. 2025. Drip: Defending prompt injection via token-wise representation editing and residual instruction fusion. arXiv preprint arXiv:2511.00447. — [arXiv:2511.00447](https://arxiv.org/abs/2511.00447) [find](https://scholar.google.com/scholar?q=Ruofan+Liu%2C+Yun+Lin%2C+Zhiyong+Huang%2C+and+Jin+Song+Dong%2E+2025%2E+Drip%3A+Defending+prompt+injection+via+token%2Dwise+representation+editing+and+residual+instruction+fusion%2E+arXiv+preprint+arXiv%3A2511%2E00447%2E+%E2%80%94+)
23. Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. 2024. Automatic and universal prompt injection attacks against large language models. arXiv preprint arXiv:2403.04957. — [arXiv:2403.04957](https://arxiv.org/abs/2403.04957) [find](https://scholar.google.com/scholar?q=Xiaogeng+Liu%2C+Zhiyuan+Yu%2C+Yizhe+Zhang%2C+Ning+Zhang%2C+and+Chaowei+Xiao%2E+2024%2E+Automatic+and+universal+prompt+injection+attacks+against+large+language+models%2E+arXiv+preprint+arXiv%3A2403%2E04957%2E+%E2%80%94+%5BarXiv%3A240)
24. Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2023. Prompt injection attacks and defenses in llm-integrated applications. arXiv preprint arXiv:2310.12815. [find](https://scholar.google.com/scholar?q=Yupei+Liu%2C+Yuqi+Jia%2C+Runpeng+Geng%2C+Jinyuan+Jia%2C+and+Neil+Zhenqiang+Gong%2E+2023%2E+Prompt+injection+attacks+and+defenses+in+llm%2Dintegrated+applications%2E+arXiv+preprint+arXiv%3A2310%2E12815%2E)
25. Fábio Perez and Ian Ribeiro. 2022. [Ignore previous prompt: Attack techniques for language models](https://md.research.elamur.ai/free/en/papers/perez-2022-ignore-previous-prompt-attack-techniques/). arXiv preprint arXiv:2211.09527.
26. Julien Piet, Maha Alrashed, Chawin Sitawarin, Sizhe Chen, Zeming Wei, Elizabeth Sun, Basel Alomair, and David Wagner. 2024. Jatmo: Prompt injection defense by task-specific finetuning. In European Symposium on Research in Computer Security, pages 105–124. Springer Nature Switzerland Cham. [find](https://scholar.google.com/scholar?q=Julien+Piet%2C+Maha+Alrashed%2C+Chawin+Sitawarin%2C+Sizhe+Chen%2C+Zeming+Wei%2C+Elizabeth+Sun%2C+Basel+Alomair%2C+and+David+Wagner%2E+2024%2E+Jatmo%3A+Prompt+injection+defense+by+task%2Dspecific+finetuning%2E+In+European+Sym)
27. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2024. [Direct preference optimization: Your language model is secretly a reward model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). Advances in Neural Information Processing Systems, 36.
28. P Rajpurkar. 2016. [Squad: 100,000+ questions for machine comprehension of text](https://md.research.elamur.ai/free/en/papers/rajpurkar-2016-squad-100-000-questions-machine/). arXiv preprint arXiv:1606.05250.
29. Sander Schulhoff, Jeremy Pinto, Anaum Khan, L-F Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Liu Kost, Christopher Carnahan, and Jordan Boyd-Graber. 2023. Ignore this title and hackaprompt: Exposing systemic vulnerabilities of llms through a global scale prompt hacking competition.… [find](https://scholar.google.com/scholar?q=Sander+Schulhoff%2C+Jeremy+Pinto%2C+Anaum+Khan%2C+L%2DF+Bouchard%2C+Chenglei+Si%2C+Svetlina+Anati%2C+Valen+Tagliabue%2C+Anson+Liu+Kost%2C+Christopher+Carnahan%2C+and+Jordan+Boyd%2DGraber%2E+2023%2E+Ignore+this+title+and+hackap)
30. Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. 2017. [Learning important features through propagating activation differences](https://md.research.elamur.ai/free/en/papers/shrikumar-2017-learning-important-features-through-propagating/). In International conference on machine learning, pages 3145–3153. PMlR.
31. Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, and 1 others. 2023. [Llama: Open and efficient foundation language models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-open-efficient-foundation-language/). arXiv preprint arXiv:2302.13971.
32. Prashant Upadhyay, Rishabh Agarwal, Sumeet Dhiman, Abhinav Sarkar, and Saumya Chaturvedi. 2024. A comprehensive survey on answer generation methods using nlp. Natural Language Processing Journal, 8:100088. [find](https://scholar.google.com/scholar?q=Prashant+Upadhyay%2C+Rishabh+Agarwal%2C+Sumeet+Dhiman%2C+Abhinav+Sarkar%2C+and+Saumya+Chaturvedi%2E+2024%2E+A+comprehensive+survey+on+answer+generation+methods+using+nlp%2E+Natural+Language+Processing+Journal%2C+8%3A10)
33. Jiongxiao Wang, Fangzhou Wu, Wendi Li, Jinsheng Pan, Edward Suh, Z Morley Mao, Muhao Chen, and Chaowei Xiao. 2024. Fath: Authentication-based test-time defense against indirect prompt injection attacks. arXiv preprint arXiv:2410.21492. — [arXiv:2410.21492](https://arxiv.org/abs/2410.21492) [find](https://scholar.google.com/scholar?q=Jiongxiao+Wang%2C+Fangzhou+Wu%2C+Wendi+Li%2C+Jinsheng+Pan%2C+Edward+Suh%2C+Z+Morley+Mao%2C+Muhao+Chen%2C+and+Chaowei+Xiao%2E+2024%2E+Fath%3A+Authentication%2Dbased+test%2Dtime+defense+against+indirect+prompt+injection+attack)
34. A Waswani, N Shazeer, N Parmar, J Uszkoreit, L Jones, A Gomez, L Kaiser, and I Polosukhin. 2017. [Attention is all you need](https://md.research.elamur.ai/free/en/papers/vaswani-2017-attention-all-need/). In NIPS.
35. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36:80079–80110.
36. Fangzhao Wu, Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, and Xing Xie. 2023. Defending chatgpt against jailbreak attack via self-reminder. [find](https://scholar.google.com/scholar?q=Fangzhao+Wu%2C+Yueqi+Xie%2C+Jingwei+Yi%2C+Jiawei+Shao%2C+Justin+Curl%2C+Lingjuan+Lyu%2C+Qifeng+Chen%2C+and+Xing+Xie%2E+2023%2E+Defending+chatgpt+against+jailbreak+attack+via+self%2Dreminder%2E)
37. Fangzhou Wu, Shutong Wu, Yulong Cao, and Chaowei Xiao. 2024. Wipi: A new web threat for llm-driven web agents. arXiv preprint arXiv:2402.16965. — [arXiv:2402.16965](https://arxiv.org/abs/2402.16965) [find](https://scholar.google.com/scholar?q=Fangzhou+Wu%2C+Shutong+Wu%2C+Yulong+Cao%2C+and+Chaowei+Xiao%2E+2024%2E+Wipi%3A+A+new+web+threat+for+llm%2Ddriven+web+agents%2E+arXiv+preprint+arXiv%3A2402%2E16965%2E+%E2%80%94+%5BarXiv%3A2402%2E16965%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2402%2E16965%29)
38. Nakyeong Yang, Yunah Jang, Hwanhee Lee, Seohyeong Jung, and Kyomin Jung. 2022. Task-specific compression for multi-task language models using attribution-based pruning. arXiv preprint arXiv:2205.04157. [find](https://scholar.google.com/scholar?q=Nakyeong+Yang%2C+Yunah+Jang%2C+Hwanhee+Lee%2C+Seohyeong+Jung%2C+and+Kyomin+Jung%2E+2022%2E+Task%2Dspecific+compression+for+multi%2Dtask+language+models+using+attribution%2Dbased+pruning%2E+arXiv+preprint+arXiv%3A2205%2E04157)
39. Nakyeong Yang, Taegwan Kang, Jungkyu Choi, Honglak Lee, and Kyomin Jung. 2023. Mitigating biases for instruction-following language models via bias neurons elimination. arXiv preprint arXiv:2311.09627. [find](https://scholar.google.com/scholar?q=Nakyeong+Yang%2C+Taegwan+Kang%2C+Jungkyu+Choi%2C+Honglak+Lee%2C+and+Kyomin+Jung%2E+2023%2E+Mitigating+biases+for+instruction%2Dfollowing+language+models+via+bias+neurons+elimination%2E+arXiv+preprint+arXiv%3A2311%2E09627)
40. Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William W Cohen, Ruslan Salakhutdinov, and Christopher D Manning. 2018. [Hotpotqa: A dataset for diverse, explainable multi-hop question answering](https://md.research.elamur.ai/free/en/papers/yang-2018-hotpotqa-dataset-diverse-explainable-multi/). arXiv preprint arXiv:1809.09600.
41. Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. 2023. Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv preprint arXiv:2312.14197. — [arXiv:2312.14197](https://arxiv.org/abs/2312.14197) [find](https://scholar.google.com/scholar?q=Jingwei+Yi%2C+Yueqi+Xie%2C+Bin+Zhu%2C+Emre+Kiciman%2C+Guangzhong+Sun%2C+Xing+Xie%2C+and+Fangzhao+Wu%2E+2023%2E+Benchmarking+and+defending+against+indirect+prompt+injection+attacks+on+large+language+models%2E+arXiv+prep)
42. Jiahao Yu, Yuhang Wu, Dong Shu, Mingyu Jin, and Xinyu Xing. 2023. Assessing prompt injection risks in 200+ custom gpts. arXiv preprint arXiv:2311.11538. — [arXiv:2311.11538](https://arxiv.org/abs/2311.11538) [find](https://scholar.google.com/scholar?q=Jiahao+Yu%2C+Yuhang+Wu%2C+Dong+Shu%2C+Mingyu+Jin%2C+and+Xinyu+Xing%2E+2023%2E+Assessing+prompt+injection+risks+in+200%2B+custom+gpts%2E+arXiv+preprint+arXiv%3A2311%2E11538%2E+%E2%80%94+%5BarXiv%3A2311%2E11538%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2311)
43. Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. [Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents](https://md.research.elamur.ai/free/en/papers/zhan-2024-injecagent-benchmarking-indirect-prompt-injections/). arXiv preprint arXiv:2403.02691.
44. Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi. 2020. Bertscore: Evaluating text generation with BERT. In Proceedings of the International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Tianyi+Zhang%2C+Varsha+Kishore%2C+Felix+Wu%2C+Kilian+Q%2E+Weinberger%2C+and+Yoav+Artzi%2E+2020%2E+Bertscore%3A+Evaluating+text+generation+with+BERT%2E+In+Proceedings+of+the+International+Conference+on+Learning+Represen)
45. Wenting Zhao, Xiang Ren, Jack Hessel, Claire Cardie, Yejin Choi, and Yuntian Deng. 2024. [Wildchat: 1m chatgpt interaction logs in the wild](https://md.research.elamur.ai/free/en/papers/zhao-2024-wildchat-1m-chatgpt-interaction-logs/). arXiv preprint arXiv:2405.01470.
46. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, and 1 others. 2024. [Judging llm-as-a-judge with mt-bench and chatbot arena](https://md.research.elamur.ai/free/en/papers/zheng-2023-judging-llm-judge-mt-bench/). Advances in Neural Information Processing Systems, 36.
47. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.
48. Egor Zverev, Sahar Abdelnabi, Soroush Tabesh, Mario Fritz, and Christoph H Lampert. 2024. Can llms separate instructions from data? and what do we even mean by that? arXiv preprint arXiv:2403.06833. — [arXiv:2403.06833](https://arxiv.org/abs/2403.06833) [find](https://scholar.google.com/scholar?q=Egor+Zverev%2C+Sahar+Abdelnabi%2C+Soroush+Tabesh%2C+Mario+Fritz%2C+and+Christoph+H+Lampert%2E+2024%2E+Can+llms+separate+instructions+from+data%3F+and+what+do+we+even+mean+by+that%3F+arXiv+preprint+arXiv%3A2403%2E06833%2E+%E2%80%94)

*Updated 1 November 2026*