Imagine a nightclub with a bouncer who doesn't serve drinks or DJ — they just check IDs and pat people down. They're cheaper than hiring a second bartender to do security, and they catch almost everyone with a fake ID. That's what this paper does to retrieval-augmented generation: it inserts a small, single-purpose model between the web and the language model, and that model's only job is to say yes or no to each retrieved passage. The committed claim: a released open-weight decision model (Kev-4B), which answers typed questions about a text without generating tokens, can serve as a pre-retrieval gate against both prompt injection and search-result pollution — two distinct threat categories usually addressed separately. On a 1,000-question injection benchmark built from forum-style HTML pages with hidden instructions, the gate drops attack success from 27.9% (no defense) to 5.7%, compared to 13.6% with the published mitigations alone (sanitization, normalization, citation prompting). On a 200-query pollution testbed where two-thirds of candidate pages are synthetic fakes, pre-filtering holds fake-page exposure to 0.5% and accuracy at 83%, versus 28% accuracy with no filter. The architectural bet is interesting: decision models sit in a different family from generative LLMs. They read a passage and answer a structured question — "Does this contain injected instructions?" — without producing free-form text. This matters because the attack surface for prompt injection lives in the generation pathway. A model that never generates tokens can't be hijacked the same way. The gate operates on raw HTML rather than extracted plain text, which turns out to matter: HTML-mode catches more attacks because injection payloads often hide in markup (invisible text, CSS tricks, comment fields). At 76ms per passage, latency is negligible relative to the generation step. The ladder comparison is honest but limited. The paper's primary baseline is the published mitigation stack (sanitization + normalization + citation prompting), which represents a reasonable current-practice defense. Large LLM judges score higher on detection (AUROC 0.99 vs 0.94) but cost ten times more — the paper frames this as a Pareto trade-off rather than claiming outright superiority. The false-positive rate on benign pages is low (4 of 186 benign pages with instructions wrongly flagged), and clean-query responsiveness barely moves (85.6% to 86.2%). What's missing is comparison against dedicated prompt-injection classifiers like Rebuff, Lakera Guard, or the Anthropic constitutional-AI filtering approach. The integrity picture is mixed. The injection benchmark (1,000 questions over forum-style pages) and pollution testbed (200 queries, 2/3 fake pages) are custom-built, not community-standard. The paper uses automatic measurement for attack success, which is appropriate but introduces the question of whether the automatic judge's definition of "successful attack" matches real-world harm. Every model is open-weight, which is a strong reproducibility signal. But there's no pre-registration, no independent replication, and the benchmarks were clearly constructed alongside the method. The 5-page length means many details that would let you stress-test the claims are compressed or absent. The milestone to watch is whether this architecture holds against adaptive adversaries. Current injection attacks are mostly static payloads — hidden text, CSS tricks, Unicode manipulation. The real test is whether a 4B decision model can withstand adversarial attacks specifically designed to fool it, which is a different and harder problem than screening out existing-pattern injections. The gap between 5.7% residual attack success and something deployable in production (sub-1%) is meaningful, and closing it likely requires both better decision models and adversarial robustness testing. The obvious experiment not run: adversarial red-teaming against the gate itself. If you know the gate reads HTML and asks structured questions, you can craft injections specifically designed to pass decision-model scrutiny while still activating the downstream LLM. The authors almost certainly know this — it's the standard next move in any security paper — and the honest read is (a) plus (c): they ran out of page budget in a 5-page paper and are saving the adversarial robustness story for the follow-up.
