Research map / Large language models / Reasoning and chain of thought

RedVisor: Reasoning-Aware Prompt Injection Defense via Zero-Copy KV Cache Reuse

ICML 2026 · Large language models › Reasoning and chain of thought · approach: KV cache compression · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes RedVisor, a removable top-layer gated adapter on a frozen LLM that first generates an injection-localization reasoning trace and then, with the adapter muted, answers the query while reusing the KV cache, aiming to defend against indirect prompt injection.

Problem

Indirect prompt injection hidden in retrieved context hijacks LLMs; existing defenses either fine-tune and incur an alignment tax or use detectors that add latency and memory cost.

Approach

A lightweight gated parallel adapter at the top layer of a frozen backbone generates explainable reasoning about injected segments; muting the adapter for response generation keeps backbone states unchanged so the phase-1 KV cache is reused without recomputation.

Key results

• On Alpaca-Farm with Llama-3-8B, RedVisor reaches 0.00 ASR on Naive, Ignore, Escape and GCG attacks, versus 0.58 to 0.71 for no defense and 0.04 to 0.06 for SecAlign on the simple attacks.
• Detection ROUGE-L on Completion and Multi-round attacks stays above 0.80 for RedVisor (Llama 0.86 and 0.81) where PromptLocate reaches 0.74 and 0.69.
• Per the paper, RedVisor processes NQ-simplified queries more than 2x faster than its decoupled variant; AlpacaEval win rate for Llama-3 is 85.78% vs 87.27% baseline.

Surprising findings

• Appending ground-truth reasoning to context drove ASR to 0% on all three models, suggesting the vulnerability is failure to detect rather than failure to refuse.
• Even the reasoning-only variant without the adapter (None) significantly reduces ASR relative to standard attacks.

Limitations

• Evaluation relies on rule-based and templated injections; adaptive attacks are limited to GCG suffixes and utility is judged by an LLM judge.
• Theoretical latency and complexity claims are asserted rather than fully measured, and the vLLM kernel integration is described at a high level.
• Reasoning labels are synthesized from templates with spaCy intent extraction, so the detector may learn template-specific patterns.

Experimental setup

Datasets: Alpaca-Cleaned Alpaca-Farm AgentDojo NQ-simplified

Benchmarks: Alpaca-Farm AgentDojo NQ-simplified AlpacaEval 2.0

Metrics: ROUGE-L F1 embedding similarity attack success rate win rate latency throughput

Baselines: PromptArmor PromptLocate DataFilter Sandwich Defense StruQ SecAlign

Builds on: LoRA AdapterFusion DPO vLLM PromptLocate

Closest papers by meaning

• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.87)
• Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization (ICML 2026 · similarity 0.87)
• A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory (ICML 2026 · similarity 0.87)
• Semantic Representation Attack against Aligned Large Language Models (NeurIPS 2025 · similarity 0.87)
• Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge (NeurIPS 2026 · similarity 0.87)
• RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards (NeurIPS 2025 · similarity 0.86)