When a computer answers a question by pulling text from the web, some of that text may be written to trick it. An attacker might hide a command in the page's code, or fill the search results with fake pages. Current defenses reduce these attacks but don't stop them all.
This work tested a small model that only answers yes-or-no questions about a page without writing new text. For each retrieved page, it checks three things: does the page command the computer, is it junk, and is it relevant. Pages that fail the first two checks are thrown away.
The model stopped most attacks, attack success fell from 27.9% to 5.7%, and kept accuracy high at 86.2%. It also filtered out fake pages so they appeared in only 0.5% of answers. It runs quickly and uses far less computing power than a large language model.