Spectral Guardrails: Detecting Prompt Injection via Attention Graph Fracture in Large Language Models

Abstract Prompt injection attacks redirect an LLM away from its system instructions by embedding ad- versarial directives in the user turn. Text-based detectors exploit lexical artifacts present in cur- rent benchmarks, artifacts that vanish under para- phrasing, leaving them blind to semantically novel attacks. We ask a different question: what hap- pens inside the model during an injection? We prove that a successful injection must collapse the algebraic connectivity of the attention graph because a functional injection and a healthy at- tention graph are mathematically incompatible (Eq. 1). Evaluated across seven models (1.1B– 14B) including GQA architectures, our Layerwise Multi-Metric probe (LMM-LR) achieves ROC- AUC 0.90–0.99, surpassing TF-IDF on the least lexically structured benchmark (0.965 vs. 0.951) and DeBERTa-v3 on two of three benchmarks, without ever reading the input text.