Imagine a nightclub bouncer who has to simultaneously scan the crowd for fake IDs AND decide whether each person is on the guest list. That's what current LLM guardrails do against indirect prompt injection: they look at a messy blob of tool outputs and try to both locate suspicious instructions and judge whether those instructions are authorized — all at once, in one pass. SpanGuard's insight is dead simple: give the bouncer a metal detector first, then hand the flagged people to a clipboard-checker. Separate the spatial problem from the semantic one. The core claim is that small LLMs fail at IPI detection not because either subtask is hard, but because doing both jointly overwhelms their limited reasoning capacity. Injected instructions tend to be semantically discontinuous with surrounding content — they stick out like a paragraph of French in an English document. You don't need GPT-4 to find that boundary. You need unsupervised segmentation, which is cheap and model-agnostic. Once you've partitioned the observation into local blocks, the remaining question — 'did the user authorize this?' — becomes a narrow, localized judgment that even a small LLM can handle reliably. The architecture is a two-stage pipeline: Stage 1 performs attack-agnostic localization via lightweight unsupervised segmentation (no learned parameters, no adversarial training). Stage 2 feeds each segmented block to a small language model for a binary authorization check against the user's original request. The key design choice is that localization requires no language-model reasoning at all — it operates on semantic discontinuity signals that are structural, not inferential. The headline number is a 0.32% attack success rate with 'negligible loss in benign utility.' That's the core empirical result. The paper claims this performance holds even when the guardrail model is 'substantially smaller' than what prior LLM-based guardrails require, though the abstract doesn't name the specific model sizes or the exact baselines beaten. This is the ladder gap: we know the direction of the result but not the exact rung. Integrity-wise, this is under review with 15 pages and 4 figures, which suggests a full experimental section lives behind the abstract. But from what's visible: no named baselines with numbers, no pre-registration, no code release mentioned, and no independent replication. The 0.32% ASR is striking, but without knowing what models were tested, what attack types were included, and whether the benchmark suite was chosen before or after the method was designed, the number floats without full context. The conceptual contribution is genuinely useful regardless: the decoupling principle — separate localization from authorization — is a transferable architectural insight that could reshape how the field thinks about guardrail design. It reframes the IPI defense problem from 'get a smarter model' to 'decompose the task so dumb models suffice.' That's the kind of structural insight that outlasts any particular benchmark number. The obvious next experiment is scaling the attack surface: adversarially crafted injections designed to defeat unsupervised segmentation by minimizing semantic discontinuity. If an attacker writes an injection that reads like a natural continuation of the surrounding content, the localization stage breaks. The authors almost certainly know this. Whether they tested it and found a limit, or are saving it for the adversarial robustness follow-up, is the open question.
