---
title: "BERM: Low-Overhead Prompt-Injection Detection via In-Situ Benign Representation Modeling"
authors:
  - "Maihao Guo"
  - "Chaoyang Zhao"
  - "Jinqiao Wang"
doi: "10.24963/ijcai.2026/68"
url: "https://ijcai.org/proceedings/2026/68"
pdf: "https://ijcai.org/proceedings/2026/0068.pdf"
venue: "Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence"
year: 2026
pages: "599-607"
track: "Main Track"
keywords:
  - "Multidisciplinary Topics and Applications: Security and privacy"
  - "Natural Language Processing: Language models"
  - "AI Ethics, Trust, Fairnes: Safety and robustness"
  - "Machine Learning: Representation learning"
  - "Natural Language Processing: Embeddings"
---

# BERM: Low-Overhead Prompt-Injection Detection via In-Situ Benign Representation Modeling

Maihao Guo, Chaoyang Zhao, Jinqiao Wang

*Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence*, pages 599-607. DOI: [10.24963/ijcai.2026/68](https://doi.org/10.24963/ijcai.2026/68)

## Abstract

Real-world deployment of large language models (LLMs) necessitates a robust and low-latency approach to detect prompt injections; existing low-overhead methods fail to simultaneously boost robustness and reduce latency. Current defenses for prompt injection either rely on brittle heuristics or invoke costly auxiliary models, imposing a significant runtime burden. We introduce BERM, a lightweight framework that performs in-situ detection by modeling a host LLM’s internal representations extracted during prefill, adding negligible overhead. Our approach trains a lightweight classifier atop the LLM by learning a compact manifold of benign representations via joint contrastive learning to maximize the separation from malicious representations. At inference, this pre-trained classifier enables in-situ detection without invoking auxiliary guard models. On a diverse landscape of prompt injection attacks, our framework establishes a new state-of-the-art, achieving an F1-score 5.2 percentage points (pp) higher than the best prior work. Critically, BERM achieves this while being over 12x faster, reducing inference overhead to near-zero.