Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2503.10566 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866912889171869696 |
|---|---|
| author | Zverev, Egor Kortukov, Evgenii Panfilov, Alexander Volkova, Alexandra Tabesh, Soroush Lapuschkin, Sebastian Samek, Wojciech Lampert, Christoph H. |
| author_facet | Zverev, Egor Kortukov, Evgenii Panfilov, Alexander Volkova, Alexandra Tabesh, Soroush Lapuschkin, Sebastian Samek, Wojciech Lampert, Christoph H. |
| contents | Despite their remarkable performance, large language models lack elementary safety features, making them susceptible to numerous malicious attacks. In particular, previous work has identified the absence of an intrinsic separation between instructions and data as the root cause of the success of prompt injection attacks. In this work, we propose a new architectural element, ASIDE, that allows language models to clearly separate instructions and data at the level of token embeddings. ASIDE applies an orthogonal rotation to the embeddings of data tokens, thus creating clearly distinct representations of instructions and data tokens without introducing any additional parameters. As we demonstrate experimentally across a range of models, instruction-tuning LLMs with ASIDE (1) achieves substantially higher instruction-data separation without performance loss and (2) makes the models more robust to prompt injection benchmarks, even without dedicated safety training. Additionally, we provide insights into the mechanism underlying our method through an analysis of the model representations. The source code and training scripts are openly accessible at https://github.com/egozverev/aside. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2503_10566 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | ASIDE: Architectural Separation of Instructions and Data in Language Models Zverev, Egor Kortukov, Evgenii Panfilov, Alexander Volkova, Alexandra Tabesh, Soroush Lapuschkin, Sebastian Samek, Wojciech Lampert, Christoph H. Machine Learning Despite their remarkable performance, large language models lack elementary safety features, making them susceptible to numerous malicious attacks. In particular, previous work has identified the absence of an intrinsic separation between instructions and data as the root cause of the success of prompt injection attacks. In this work, we propose a new architectural element, ASIDE, that allows language models to clearly separate instructions and data at the level of token embeddings. ASIDE applies an orthogonal rotation to the embeddings of data tokens, thus creating clearly distinct representations of instructions and data tokens without introducing any additional parameters. As we demonstrate experimentally across a range of models, instruction-tuning LLMs with ASIDE (1) achieves substantially higher instruction-data separation without performance loss and (2) makes the models more robust to prompt injection benchmarks, even without dedicated safety training. Additionally, we provide insights into the mechanism underlying our method through an analysis of the model representations. The source code and training scripts are openly accessible at https://github.com/egozverev/aside. |
| title | ASIDE: Architectural Separation of Instructions and Data in Language Models |
| topic | Machine Learning |
| url | https://arxiv.org/abs/2503.10566 |