Research
A Review of Indirect Prompt Injection and Its Defenses Using Large-Scale Public Red-Teaming Competition Data
Publication date unknown · Discovered openreview.net
Page published
Publication date unknown · First observed: 13 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
The study shows that most published IPI defenses do not hold up against realistic human-generated attacks, warning defenders who deploy LLM agents in high-stakes applications that single defenses are insufficient and ensembles are needed.
A research paper by authors from Georgia Tech and GraySwan.ai evaluates 12 published indirect prompt injection (IPI) defenses against 13k+ unique human-authored IPI attacks and 26k+ successful break trajectories from public red-teaming competitions. The study finds that most defenses fail to generalize, four of six classifier defenses fall short of published precision/recall, and system-level designs like Plan-Then-Execute, Code-Then-Execute, and Dual-LLM generalize best (one cutting attack success from 61.9% to 1.6%) but still leave residual attack surfaces and reduce utility.