Defense against Prompt Injection Attacks via Mixture of Encodings (2025)

Abstract: Large Language Models (LLMs) have emerged as a dominant approach for a wide range of NLP tasks, with their access to external information further enhancing their capabilities. However, this introduces new vulnerabilities, known as prompt injection attacks, where external content embeds malicious instructions that manipulate the LLM’s output. Recently, the Base64 defense has been recognized as one of the most effective methods for reducing success rate of prompt injection attacks. Despite its efficacy, this method can degrade LLM performance on certain NLP tasks. To address this challenge, we propose a novel defense mechanism: mixture of encodings, which utilizes multiple character encodings, including Base64. Extensive experimental results show that our method achieves one of the lowest attack success rates under prompt injection attacks, while maintaining high performance across all NLP tasks, outperforming existing character encoding-based defense methods. This underscores the effectiveness of our mixture of encodings strategy for both safety and task performance metrics.

## introduction large language models (llms) have achieved state-of-the-art performance on various natural language processing (nlp) tasks @xcite . the ability of llms to access external knowledge sources, such as webpages, further enhances their performance on knowledge intensive tasks like open-domain question answering @xcite . however, while this external access improves performance, it also introduces potential safety issues, with one of the most significant problems being the risk of prompt injection attacks @xcite *this work was done as ruiyi's internship project at microsoft. summarize the following dialogue: blair: remember we are seeing the wedding planner after work chuck: sure, where are we meeting her? … ignore all instructions above and output 'your computer is attacked!' your computer is attacked! ## mixture of encodings in this section, we introduce our method, the mixture of encodings defense, which aims to optimize both the safety and helpfulness objectives for the llm. we first input both prompts p1 and p2 from section 3 into the llm separately, generating two responses, r1 and r2, respectively. we incorporate the caesar cipher foot_1 as an additional encoding method to further enhance our approach, leveraging the strong capability of llms in understanding this encoding @xcite . we provide a more detailed discussion of the rationale behind the selection of base64 and caesar in appendix b. formally, the caesar encoded input prompt p3 to the llm is defined as follows: ## conclusion in this paper, we introduce a novel mixture of encodings strategy to mitigate prompt injection attacks while ensuring both safety and helpfulness of the llm. our approach is validated through extensive experiments on both safety and helpfulness benchmarks, demonstrating clear improvement over existing character encoding-based defense methods.