RedVisor: Reasoning-Aware Prompt Injection Defense via Zero-Copy KV Cache Reuse

TL;DR

RedVisor addresses prompt injection vulnerabilities in LLMs by unifying detection explainability with prevention, avoiding the utility loss typical of fine-tuning. It introduces a lightweight, top-layer Gated Parallel Adapter that briefly analyzes inputs to generate a reasoning trace, then switches to the frozen backbone for guarded generation, reusing the KV cache via zero-copy transition. Empirical results across Llama-3, Mistral, and Qwen show superior detection accuracy, near-zero attack success rates, and maintained benign utility with notable throughput gains in RAG scenarios. This approach offers a practical, efficient defense suitable for open-source models and real-time deployments, with broad implications for secure context-rich AI systems.

Abstract

Large Language Models (LLMs) are increasingly vulnerable to Prompt Injection (PI) attacks, where adversarial instructions hidden within retrieved contexts hijack the model's execution flow. Current defenses typically face a critical trade-off: prevention-based fine-tuning often degrades general utility via the "alignment tax", while detection-based filtering incurs prohibitive latency and memory costs. To bridge this gap, we propose RedVisor, a unified framework that synthesizes the explainability of detection systems with the seamless integration of prevention strategies. To the best of our knowledge, RedVisor is the first approach to leverage fine-grained reasoning paths to simultaneously detect attacks and guide the model's safe response. We implement this via a lightweight, removable adapter positioned atop the frozen backbone. This adapter serves a dual function: it first generates an explainable analysis that precisely localizes the injection and articulates the threat, which then explicitly conditions the model to reject the malicious command. Uniquely, the adapter is active only during this reasoning phase and is effectively muted during the subsequent response generation. This architecture yields two distinct advantages: (1) it mathematically preserves the backbone's original utility on benign inputs; and (2) it enables a novel KV Cache Reuse strategy, eliminating the redundant prefill computation inherent to decoupled pipelines. We further pioneer the integration of this defense into the vLLM serving engine with custom kernels. Experiments demonstrate that RedVisor outperforms state-of-the-art defenses in detection accuracy and throughput while incurring negligible utility loss.

Figures (5)

• Figure 1: The framework overview of RedVisor. Phase 1 employs the adapter for security reasoning, while Phase 2 mutes the adapter to generate the response guided by the retained reasoning context.
• Figure 2: The architecture of the Gated Self-Attention Adapter. It operates in parallel with the frozen LLM head, utilizing a learned gate $\alpha$ to modulate its influence.
• Figure 3: Utility on AlpacaEval 2.0. RedVisor preserves original capability, while fine-tuning defenses suffer degradation.
• Figure 4: Total latency for processing 1,000 RAG queries on NQ-simplified. RedVisor (solid red) significantly outperforms both the baselines and its own decoupled variant (hatched red) by eliminating the redundant prefill cost.
• Figure 5: Training Dynamics Comparison. Left: The validation loss trajectories showing consistent convergence. Right: The evolution of the learnable gating parameter $\alpha^2$, illustrating the increasing weight of the gated component.