StruQ: Defending Against Prompt Injection with Structured Queries

Sizhe Chen, Julien Piet, Chawin Sitawarin, David Wagner

34th USENIX Security Symposium · Day 1

The proliferation of Large Language Models (LLMs) has ushered in a new era of LLM-integrated applications, from intelligent chatbots to sophisticated data analysis tools. However, this rapid innovation has also exposed significant security vulnerabilities, with **prompt injection** attacks emerging as a critical threat. These attacks exploit the LLM's inherent ability to follow instructions and its inability to differentiate between application-defined prompts and user-supplied data, leading to unauthorized task deviation or malicious output generation. OWASP has notably identified prompt injection as the number one security risk for LLM applications.

AI review

Solid, well-executed defense research that correctly identifies prompt injection as a data/control separation problem and actually builds the fix. The structured query approach with reserved tokens and fine-tuning is the right architectural move — this is SQL prepared statements for LLMs, and it works. Loses a star because the optimization-based attack results (58% GCG success) show the defense isn't complete, and the paper is more engineering than novel insight.