Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines

Local Retrieval-Augmented Generation (RAG) systems let powerful assistants operate over private data, but inherit a growing class of security risks---particularly Indirect Prompt Injection (IPI) and retrieval poisoning, in which adversarial instructions hidden in retrieved content are executed by the model as if trusted. This threat is no longer hypothetical: a recent web-scale measurement validated 15.3K indirect-injection instances across 11.7K pages, roughly 70% of them hidden in non-rendered HTML, and security teams report live agents coerced into payments and data exfiltration. Existing defenses are either retrieval-centric (sanitization) or safety-centric guards trained on direct jailbreaks rather than RAG context consistency. We present nokast-secureRAG, a $\sim$0.5B-parameter Small Language Model (SLM) that acts as a semantic firewall between the retriever and the generator: it jointly reads the user query Q and the retrieved context C and classifies the pair as safe, suspicious, or malicious-instruction. The model is produced by a teacher→judge→student distillation pipeline: a 35B teacher generates 5,233 realistic (Q,C) records across four attack families; an independent, larger 120B judge of a different model family re-labels every record blind, yielding 95.0% agreement; and the agreed data fine-tunes the student via reasoning-first LoRA. On a held-out test set the tuned SLM reaches 0.994 detection recall at 0.026 false-positive rate and 0.006 attack-success-rate (detection-side proxy), versus 0.688 recall for a regex baseline and 0.116 for the same model untuned. On a dedicated judgment-flip test---where an identical sentence is benign in one context and malicious in another---the SLM labels both halves correctly 75% of the time versus 17.5% for a keyword filter, directly demonstrating context-aware detection. The pipeline runs entirely on a single consumer-class device; the detector reaches 37ms amortized throughput per query (single-request latency $\sim$0.4s, set by its reasoning trace). All results are in-distribution; external-benchmark generalization and single-request latency optimization are identified as future work. The model, data-generation pipeline, and evaluation harness are released open source.