Imagine you're a bouncer at a nightclub with two lines: VIP guests (trusted instructions) and general admission (untrusted user content). Most bouncers today just memorize a dress code — they can be fooled by someone who dresses right. Heads of Security (HoS) instead installs a separate gate on every door in the building, each gate tuned to how that specific door has historically been exploited. The guests can still mingle inside, but each doorway independently decides how much attention to pay to which line. That's the core mechanism: per-head learned attention gates that redistribute how much each transformer attention head attends to trusted vs. untrusted tokens. The committed claim: you can defend LLMs against prompt injection by learning a small set of scalar gates on existing attention heads — no full fine-tuning, no architectural redesign — and this targeted intervention outperforms both fine-tuning-based (SecAlign++) and architecture-based (ASIDE) defenses, especially under adaptive attack. The strongest number here is RL-Hammer dropping from 97% attack success rate (ASR) against GPT-OSS-20B and 85% against SecAlign to just 10% against HoS. That's not a marginal improvement; it's a category change in robustness. The ladder positioning is unusually honest. The authors benchmark against SecAlign++, the current fine-tuning SOTA, and ASIDE, which shares their architectural-intervention philosophy. On static agentic benchmarks, HoS and SecAlign perform similarly — no claim of dominance there. The gap opens under adaptive attack and on utility preservation. SecAlign and ASIDE degrade in few-shot settings; HoS doesn't. ASIDE's tool-use utility collapses to 10%. The paper doesn't pretend it solves everything — it identifies the specific regime (adaptive adversaries, few-shot prompting) where per-head gating wins. Architecturally, HoS belongs to the mechanistic-interpretability-meets-defense family: it treats individual attention heads as the unit of intervention, learning gates that modulate cross-attention between trust-tagged token sets. This is a lightweight parametric intervention — the number of learned parameters scales with the number of heads, not the number of model parameters. The method was tested on Llama-3.3-70B-Instruct and GPT-OSS-20B, covering both open-weight and closed architectures. The key compute property: the Claudini white-box attack needs 3× more FLOPs to achieve the same ASR against HoS as against the baselines, meaning the defense raises the adversary's cost even when the attacker has full model access. Integrity is mixed but above average for this subspace. The authors test against both black-box (RL-Hammer) and white-box (Claudini) adaptive attacks, including a version of Claudini specifically strengthened against HoS through autoresearch — that's the adversary doing its homework. They use standard multiple-choice benchmarks for utility and agentic prompt injection benchmarks for security. The main gap: no independent replication, no pre-registration, and the autoresearch-strengthened Claudini was designed by the same team. The defense against cherry-picking is that they report the settings where HoS merely matches SecAlign rather than beating it. The milestone question is practical: prompt injection defense needs to survive in production agentic systems where models call tools, browse the web, and process untrusted documents at scale. HoS demonstrates viability at 70B parameters with preserved tool-use utility. The next concrete threshold is deployment-scale validation — can these gates survive real-world red-teaming campaigns with thousands of diverse adversarial prompts, not just benchmark suites? The gap between 'works on benchmarks including adaptive attacks' and 'works in production with continuous adversarial pressure' is where most defenses die. The obvious experiment not run: scaling the gate-learning procedure to frontier-scale models (400B+ parameters, mixture-of-experts architectures) and testing against ensemble adaptive attacks where multiple attack strategies are combined. The honest read is (a) compute budget — training gates on 70B is already expensive, and (c) the authors are likely saving frontier-scale results for a follow-up, especially given the industry affiliations on the author list. The absence of ensemble adversarial evaluation is more concerning — it's the natural next stress test and its omission may reflect either compute constraints or less favorable preliminary results.
