A Cross-Lingual Security Evaluation of Prompt Injection Defenses in Small Language Models

• Pedro Fuziwara Filho USP
• Erikson J. de Aguiar USP
• Agma J. M. Traina USP

DOI: https://doi.org/10.5753/sbseg_estendido.2026.33794

Resumo

Although language models are increasingly deployed in multilingual settings, the literature offers limited insight into the robustness of optimization-based defenses trained in a single language. In this paper, we investigate whether, and in what ways, the language used to construct a prompt influences its effectiveness against prompt injection in small language models. We also examine a defensive strategy against prompt injection, called DefensiveTokens, which can generalize to languages not observed during training. Our findings show that DefensiveTokens provide a robust defense against prompt injection attacks in multilingual applications.

Referências

Elliot Bolton, Abhinav Venigalla, Michihiro Yasunaga, David Hall, Betty Xiong, Tony Lee, Roxana Daneshjou, Jonathan Frankle, Percy Liang, Michael Carbin, and Christopher D. Manning. Biomedlm: A 2.7b parameter language model trained on biomedical text, 2024.

Heri Zhao et al. Codegemma: Open code models based on gemma, 2024.

Wei-Cheng Chang, Felix X. Yu, Yin-Wen Chang, Yiming Yang, and Sanjiv Kumar. Pre-training tasks for embedding-based large-scale retrieval, 2020.

Fali Wang, Zhiwei Zhang, Xianren Zhang, Zongyu Wu, TzuHao Mo, Qiuhao Lu, Wanjing Wang, Rui Li, Junjie Xu, Xianfeng Tang, Qi He, Yao Ma, Ming Huang, and Suhang Wang. A comprehensive survey of small language models in the era of large language models: Techniques, enhancements, applications, collaboration with llms, and trustworthiness. ACM Transactions on Intelligent Systems and Technology, 16(6):1–87, November 2025.

Yuling Wang, Changxin Tian, Binbin Hu, Yanhua Yu, Ziqi Liu, Zhiqiang Zhang, Jun Zhou, Liang Pang, and Xiao Wang. Can small language models be good reasoners for sequential recommendation? In Proceedings of the ACM Web Conference 2024, WWW ’24, page 3876–3887, New York, NY, USA, 2024. Association for Computing Machinery.

OWASP. Owasp top 10 for large language model applications 2025, 2025. Accessed: 2026-04-29.

B. ElSaify and M. Baderelden. Adversarial and multilingual threats in retrieval-augmented generation: From prompt injection to model exploitation. In 2025 2nd International Generative AI and Computational Language Modelling Conference (GACLM), pages 155–162, Valencia, Spain, 2025.

Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. Multilingual jailbreak challenges in large language models. In The International Conference on Learning Representations, 2024.

Sunjia Fan, Yichao Yang, Weiqi Huang, Ke Ma, Yucen Liu, and Yuxin Zheng. Defense methods against multi-language and multi-intent LLM attacks. In Liang Hu and Pavel Loskot, editors, International Conference on Algorithms, High Performance Computing, and Artificial Intelligence (AHPCAI 2024), volume 13403, page 134031L. International Society for Optics and Photonics, SPIE, 2024.

Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. Multilingual jailbreak challenges in large language models, 2024.

Sizhe Chen, Yizhu Wang, Nicholas Carlini, Chawin Sitawarin, and David Wagner. Defending against prompt injection with a few defensivetokens. In Proceedings of the 2025 Workshop on Artificial Intelligence and Security, AISec ’25, page 11, New York, NY, USA, 2025. ACM.

Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. StruQ: Defending against prompt injection with structured queries. In 34th USENIX Security Symposium (USENIX Security 25), pages 2383–2400, Seattle, WA, August 2025. USENIX Association.

Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1831–1847, Philadelphia, PA, August 2024. USENIX Association.

Dario Pasquini, Martin Strohmeier, and Carmela Troncoso. Neural exec: Learning (and learning from) execution triggers for prompt injection attacks. In Proceedings of the 2024 Workshop on Artificial Intelligence and Security, AISec ’24, page 89–100, New York, NY, USA, 2024. Association for Computing Machinery.

Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. Automatic and universal prompt injection attacks against large language models, 2024.

Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box llms automatically, 2024.

Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023.

Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models. In NeurIPS ML Safety Workshop, 2022.

Sizhe Chen, Arman Zharmagambetov, Saeed Mahloujifar, Kamalika Chaudhuri, David Wagner, and Chuan Guo. Secalign: Defending against prompt injection with preference optimization. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS ’25, page 2833–2847, New York, NY, USA, 2025. Association for Computing Machinery.

Fernanda Bufon Färber, Iago Alves Brito, Julia Soares Dollis, Pedro Schindler Freire Brasil Ribeiro, Rafael Teixeira Sousa, and Arlindo Rodrigues Galvão Filho. Medpt: A massive medical question answering dataset for brazilian-portuguese speakers, 2026.

Marta R. Costa-jussà et al. No language left behind: Scaling human-centered machine translation, 2022.