Cascade injection detection with attention probes to stop over-refusing legitimate instructions
arXiv 2608.08027·medium signal
BASIS uses sparse linear probes on an Attention Competition Ratio (ρ) computed at prefill to cascade prompt-injection detection with per-sample breach prediction. It holds near-perfect injection detection while substantially reducing false rejections across six open-source LLMs. The contribution is aimed at the failure mode that actually kills injection defenses in production — over-refusal on robust, legitimate instructions makes teams turn the guard off.