AlignSentinel: Alignment-Aware Detection of Prompt Injection Attacks

Prompt injection attacks insert malicious instructions into an LLM's input to steer it toward an attacker-chosen task instead of the intended one. Existing detection defenses typically classify any input containing an instruction as malicious, leading to misclassification of benign inputs containing instructions that align with the intended task. In this work, we account for the instruction hierarchy and distinguish among three categories: inputs with misaligned instructions, inputs with aligned instructions, and non-instruction inputs. We introduce AlignSentinel, an alignment-aware detection method that flags an input only when the instruction it carries overrides the higher-priority instruction rather than whenever it carries an instruction at all, using a three-class classifier over features derived from the LLM's attention maps. To support evaluation, we construct the first systematic benchmark containing inputs from all three categories. Experiments on both our benchmark and existing ones—where inputs with aligned instructions are largely absent—show that AlignSentinel accurately detects inputs with misaligned instructions and substantially outperforms baselines.