SCOUT

Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense

Prompt-injection defenses should not send every request through the same detector. SCOUT predicts which detectors are worth using for the current input, then spends the expensive judge only when the light detectors disagree.

Shuhao Zhang*1, Jiarui Li*2, Qi Cao1, Ruiyi Zhang1, Pengtao Xie1†

1 UC San Diego   2 University of Illinois Urbana-Champaign

* Equal contribution   † Corresponding author: p1xie@ucsd.edu

Paper Code HF Models HF Data

Main figure

SCOUT overview showing detector error patterns, per-input routing, and detector invocation share across thresholds.
SCOUT makes a per-input routing decision: trust the light detector pool when its predicted behavior is clear, or escalate to the LLM judge when it is not.

News

  • 2026-05-29 Project page, arXiv paper, code, and Hugging Face releases are online.

Detector allocation instead of detector commitment

Prompt-injection detectors fail in different places. Some are cheap but brittle; stronger judges are slower and costly to run on every request.

SCOUT treats defense as a routing problem. For each input, it estimates how each detector is likely to behave, runs the light detectors that look reliable, and calls the LLM judge only when the vote is still uncertain.

A single threshold, tau, controls the trade-off. Higher values call the judge more often; lower values lean on the light pool and reduce latency.

  • Per-input detector allocation instead of a fixed single-detector pipeline.
  • Detector correctness and latency estimates built from similar past inputs.
  • One threshold for moving between stronger safety and lower wall-clock time.
  • Evaluation on SCOUT-450, with transfer tests on BIPIA, IPI, and IHEval.

Fingerprint, predict, route

SCOUT first looks at how detectors behaved on similar inputs. It then predicts detector reliability and latency for the current request before making the routing decision.

For a new request, SCOUT retrieves nearby examples from Anchor-400 and uses their detector outcomes as a behavioral fingerprint. A small predictor reads that fingerprint and estimates correctness and latency for each detector.

The router keeps the detectors predicted to be reliable, weights their votes by trust, and checks the vote confidence against the threshold. If the light pool cannot give a clear answer, SCOUT escalates to the LLM judge.

SCOUT framework showing fingerprint construction, detector outcome prediction, and uncertainty-aware triage.
SCOUT retrieves similar anchor examples, predicts detector behavior, and sends each request either to a light-pool vote or to judge escalation.

Results

On SCOUT-450, the tau = 0.875 operating point gives the lowest total ASR and the highest accuracy among the reported systems, while using about 60% of the wall-clock time of an always-on GPT-4o judge.

Comparison with individual detectors

SCOUT is compared with fixed detector choices and an always-on GPT-4o judge on SCOUT-450.

Wall-clock versus quality frontier on SCOUT-450 across the SCOUT threshold sweep.
SCOUT-450 latency-quality frontier. Raising tau shifts the system toward lower ASR and higher accuracy, at the cost of more wall-clock time.

Lower ASR is better; higher BU and accuracy are better.

Method Total ASR Total BU Total Lat Acc
Rule-based .651 .733 0.1 .516
DeBERTa .231 .672 9 .727
PIGuard .098 .364 203 .669
GPT-4o .118 .979 656 .924
SCOUT (tau = 0.55) .106 .795 87 .851
SCOUT (tau = 0.75) .075 .872 222 .902
SCOUT (tau = 0.875) .063 .928 395 .933

Ablation study

These ablations separate the effect of detector allocation, predictor choice, and trust-aware routing.

Allocation and predictor quality both matter.

Method Acc ASR BU Total Lat
KNN predictor .909 .110 .933 412.1
MLP predictor .898 .086 .877 339.1
Qwen3-4B 5-shot CoT .907 .110 .928 388.2
SFT-CoT .904 .098 .908 333.6
Always judge .924 .118 .979 655.5
No-predictor cascade .920 .090 .933 462.6
Uniform-trust cascade .927 .078 .933 515.7
SCOUT .933 .063 .928 395.1

The gain comes from the routing rule and from predicting detector reliability per input.

Ablation curves varying predictor recipe, routing rule, and trust mixing on SCOUT-450.
Ablation curves. The strongest frontier comes from combining per-input prediction with trust-aware routing.

Cross-benchmark transfer

The same SCOUT configuration is evaluated on BIPIA, IPI, and IHEval without retraining.

Cross-benchmark latency-quality plots for BIPIA, IPI, and IHEval.
Transfer without retraining. The same SCOUT configuration reduces wall-clock time on BIPIA, IPI, and IHEval.

SCOUT-30K, Anchor-400, and SCOUT-450

The released data separates detector training, predictor supervision, fingerprint retrieval, and evaluation.

  • SCOUT-30K: 29,551 hindsight-distilled sample-detector examples for predictor supervision.
  • Anchor-400: 400 examples used for kNN retrieval and detector trust priors.
  • SCOUT-450: 450 evaluation samples, with 255 attacks and 195 benign cases, enriched for harder agent-facing injections.

The page centers on SCOUT-450, but the routing setup depends on keeping these roles separate.

Dataset composition across SCOUT-30K, Anchor-400, and SCOUT-450.
Composition of the released SCOUT splits across attack and benign categories.

Reference

@misc{zhang2026scout,
  title = {Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense},
  author = {Zhang, Shuhao and Li, Jiarui and Cao, Qi and Zhang, Ruiyi and Xie, Pengtao},
  year = {2026},
  eprint = {2605.30837},
  archivePrefix = {arXiv},
  primaryClass = {cs.CR},
  url = {https://arxiv.org/abs/2605.30837}
}