ERASE defends multimodal models against prompt injection by teaching them to read past the injected region
In the authors' tests on image, audio and video, the method nearly eliminated observed attacks while keeping task accuracy close to clean-input levels.
Researchers Shuo Hong, Jiaxin Ma, Xidi Cai and Qianli Ma have proposed ERASE, a defense against multimodal indirect prompt injection. In this kind of attack, malicious instructions are hidden inside images, audio or video that also contain information the model needs for the user's task. The authors say existing defenses can block such attacks but also weaken the model's use of the legitimate content. ERASE builds a reference version of each attacked input by erasing the injected region and replacing it with blank content suited to the medium, while leaving the rest of the media intact. A student model reads the attacked media and learns from a frozen base model that reads the erased version. The student receives token-level feedback on its own outputs, a technique called on-policy self-distillation. Across image, audio and video at two model sizes, the paper reports near-zero observed attack success on the benchmark it evaluated, with task performance close to the level of undefended models given clean inputs. On a 3-billion-parameter audio model, ERASE reached 60.1% accuracy on attacked inputs, compared with 33.1% for the ARGUS defense, and came within 0.5 points of the clean-input level. The work addresses a growing risk for agents that process outside media.