ReasAlign: Reasoning Enhanced Safety Alignment against Prompt Injection Attack

ICLR 2026 Conference Submission15648 Authors

Keywords: prompt injection attack, defense, LLM safety

TL;DR: A reasoning-enhanced guardrail for defending prompt injection attack.

Abstract: Large Language Models (LLMs) have enabled the development of powerful agentic systems capable of automating complex workflows across various fields. However, these systems are highly vulnerable to indirect prompt injection attacks, where malicious instructions embedded in external data can hijack agent behavior. In this work, we present ReasAlign, a model-level solution to improve safety alignment against indirect prompt injection attacks. The core idea of ReasAlign is to incorporate structured reasoning steps to analyze user queries, detect conflicting instructions, and preserve the continuity of the user’s intended tasks to defend against indirect injection attacks. To further ensure reasoning logic and accuracy, we introduce a test-time scaling mechanism with a preference-optimized judge model that scores reasoning steps and selects the best trajectory. Comprehensive evaluations across various benchmarks show that ReasAlign maintains utility comparable to an undefended model while consistently outperforming SecAlign++, the strongest prior guardrail. On the representative open-ended CyberSecEval2 benchmark, which includes multiple prompt-injected tasks, ReasAlign achieves 94.6% utility and only 3.6% ASR, far surpassing both the undefended LLaMA baseline (78.2% utility and 43.6% ASR) and the state-of-the-art defensive model SecAlign++ (56.4% utility and 74.4% ASR). These results demonstrate that ReasAlign achieves the best trade-off between security and utility, establishing a robust and practical defense against prompt injection attacks in real-world agentic systems. Our code and experimental results could be found at https://anonymous.4open.science/r/ReasAlign-DDC4.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 15648