Context-Aware Semantic Prompt (CASP)

• CASP is a family of methods that constructs prompts by integrating full interaction context, including task, instance, and domain knowledge.
• It employs mechanisms like natural-language templating, instance-conditioned embedding, and context extraction to enhance LLM performance in diverse applications.
• CASP improves system security and alignment by dynamically conditioning prompt behavior to defend against injection attacks and ensure reliable task execution.

Searching arXiv for the provided topic and papers to ground the article in current literature. Context-Aware Semantic Prompt (CASP), an Editor’s term, denotes prompt construction and prompt-adjacent control mechanisms that encode the semantics of the full interaction context—task, instance, history, policy, domain knowledge, or modality-specific priors—rather than treating the latest input in isolation. Across recent work, this idea appears in prompt-injection defense, instance-conditioned prompt tuning, prompt recommendation, moderation, dialogue generation, prompt compression, and multimodal alignment, although the literature does not present a single canonical CASP formalism. This suggests CASP is best understood as a family of methods that map enriched context to prompts, prompt embeddings, or prompt-like control signals for inference and decision making (Kholkar et al., 18 May 2025, Liu et al., 19 Oct 2025, Kim et al., 12 Dec 2025).

1. Conceptual scope and formal structure

Several papers provide compatible but distinct formalizations of context-aware prompting. In domain-specific prompt recommendation, the pipeline is written as

$\text{CASP}: (q, c, K, S) \mapsto \mathcal{P},$

where $q$ is a user query, $c$ is contextual representation, $K$ is retrieved knowledge, $S$ is a candidate skill set, and $\mathcal{P}$ is a set of suggested prompts (Tang et al., 25 Jun 2025). In context extraction for safer LLM inference, the core relation is

$$[c, r_g] = g_\theta(p), \quad [p_d, r_d] = d_\phi(p', c),$$

with a context generator $g_\theta$ producing a context snippet $c$ from prompt $p$, and a decoder $q$0 using a corrupted prompt $q$1 plus $q$2 for reconstruction and response generation (Kim et al., 12 Dec 2025). In context-aware prompt injection testing, the basic unit is a composite prompt

$q$3

where $q$4 is framework context, $q$5 is a separator, and $q$6 is a disruptor (Kholkar et al., 18 May 2025).

These formulations differ in task and modality, but they share the same structural claim: prompt behavior is conditioned by information that is broader than a single input string. In some systems, that context is explicit natural language, such as subreddit rules and prior comments in moderation (He et al., 2023). In others, it is an internal representation, such as mean-pooled hidden states injected as a single capsule vector at each layer (Liu et al., 19 Oct 2025). A plausible implication is that CASP is less a single algorithm than a design principle: represent context, compose it with task semantics, and inject the resulting signal at a decision-critical point.

A recurring distinction in this literature is between static prompt design and context-dependent prompting. Static prompts encode task-level guidance, but recent work argues that they are inherently limited when instance-aware information is absent (Liu et al., 19 Oct 2025). The same concern appears in security work, where evaluation on static jailbreak benchmarks fails to capture attacks embedded in realistic application context (Kholkar et al., 18 May 2025). CASP, in this sense, names the shift from prompt templates as fixed instructions to prompts as context-conditioned semantic interfaces.

2. Mechanisms for representing and injecting context

One major CASP mechanism is explicit natural-language templating. CPL-NoViD reformulates norm violation detection as a prompt-based language modeling problem using hard templates that include subreddit identity, full rule text, and a labeled conversation history, ending with a masked yes/no decision (He et al., 2023). AUMENA uses context-aware prompt-tuning for method naming by concatenating method body, signature, class attributes, and sibling methods with indicator words so that CodeT5 can generate a method name or classify name consistency (Zhu et al., 2023). DialogPrompt makes the prompt itself context-dependent by generating continuous prompt states from dialogue context hidden states before running a frozen GPT-2 to produce the response (Gu et al., 2021).

A second mechanism is compact instance-conditioned prompt embedding. Capsule Prompt-Tuning replaces long soft-prompt sequences with a single capsule vector per layer. Its central recurrence is

$q$7

so that each layer’s prompt fuses a trainable task-aware vector $q$8 with an instance-aware summary of the current representation (Liu et al., 19 Oct 2025). The paper reports an “attention anchor” phenomenon: the capsule prompt receives strong attention from input tokens and attends to structurally important tokens, which the authors contrast with conventional soft prompts that mostly attend to each other (Liu et al., 19 Oct 2025). This suggests that CASP is not only about what context is represented, but also about whether that representation actually enters the model’s attention graph as a computational hub.

A third mechanism is pre-processing or extraction before response generation. CONTEXTLENS trains a reinforcement-learning-based context generator that outputs structured fields such as user intent, ambiguity, possible risks, action decision, and safe response plan, then appends this context to the original prompt for downstream inference (Kim et al., 12 Dec 2025). C.A.P. uses semantic expansion $q$9, time-weighted retrieval over dialogue history, and an alignment score

$c$0

to decide whether to continue normally or initiate clarification (Wei, 17 Mar 2026). In both cases, the prompt passed to the LLM is a derived object, not a verbatim user turn.

A fourth mechanism is context-aware reduction rather than expansion. CPC compresses long prompts at the sentence level by training a context-aware sentence encoder and selecting the top-ranked sentences under a token budget, using cosine similarity between question embeddings and context-aware sentence embeddings (Liskavets et al., 2024). The paper reports that this sentence-level method is up to $c$1 faster at inference than the best token-level compression method while outperforming prior prompt compression approaches on benchmark datasets (Liskavets et al., 2024). In CASP terms, compression is still prompt construction: context is filtered so that only the most relevant semantic units survive.

3. Security, alignment, and prompt-aware defenses

Security-oriented CASP work treats context as both the source of attack surface and the basis for defense. CAPTURE constructs context-aware prompt-injection examples by embedding separators and disruptors inside realistic domain-specific frameworks across Shopping, Covid QA, Movies, Stock trading, Travel, and Python code (Kholkar et al., 18 May 2025). It introduces MALICIOUS-GEN for context-aware adversarial prompts and SAFE-GEN for benign prompts that contain suspicious trigger words or separators, then evaluates both false negative rate and false positive rate. The reported findings show that several guardrails have severe failure modes under context-aware evaluation: Fmops has 100% false negative rate across all six domains, PromptGuard can achieve 0% false negative rate while producing 100% false positive rate across many domains, and ProtectAIv2 still exhibits false positive rates of roughly 43% to 82% depending on domain (Kholkar et al., 18 May 2025). CaptureGuard, a DeBERTaV3-base classifier trained on CAPTURE data and InjecGuard datasets, reduces CAPTURE test-set false negative rates to 0.15% in Stocks and 0.00% in Movies and Python, with false positive rates of 0.00% in Stocks and 2.05% in Movies and Python (Kholkar et al., 18 May 2025).

ARGUS extends this security perspective from single-prompt settings to agentic systems with tool use, memory, skills, and inter-agent communication. AgentLure covers four domains, eight attack vectors, and six attack surfaces, with 320 samples constructed as context-dependent tasks with context-aware attacks (Weng et al., 5 May 2026). ARGUS builds an influence-provenance graph, assigns source-dependent trust scores, segments content into benign and anomalous spans, grounds arguments to supporting spans, checks task invariants, and verifies whether a state-changing action is entailed by benign evidence rather than anomalous content (Weng et al., 5 May 2026). On AgentLure, ARGUS reduces attack success rate to 3.8% while preserving 87.5% utility on clean tasks, yielding the highest Effective Defense Score among the compared defenses; under adaptive white-box attacks, attack success rate rises only to 5.9% (Weng et al., 5 May 2026).

CONTEXTLENS addresses a related alignment problem from the opposite direction: instead of auditing external context, it extracts latent contextual signals from the user prompt itself. The paper reports an average 5.6% reduction in harmful responses on SafetyInstruct across multiple foundation models and a 6.2% improvement in the harmonic mean of attack success rate and compliance on XSTest and WildJailbreak (Kim et al., 12 Dec 2025). C.A.P. makes a similar argument for long-term dialogue: abrupt topic shifts, omitted premises, and compressed references can produce contextual misalignment, so a pre-processor should expand semantics, retrieve recent history with temporal decay, and branch into clarification when alignment is low (Wei, 17 Mar 2026). Taken together, these systems show that CASP in safety is not just prompt hardening; it is semantic modeling of provenance, intent, and trust.

4. Domain-specific prompting systems and applications

A substantial part of the literature treats CASP as a way to specialize LLM behavior for concrete application domains. CPL-NoViD is a canonical example in online moderation. Using the NORMVIO dataset of 52K Reddit conversation threads, it injects community context, rule context, and conversational context directly into natural-language prompts and maps labels to “Yes” and “No” verbalizers (He et al., 2023). On in-domain evaluation, it achieves 78.2 ± 0.4 macro-F1, setting a new state of the art over T5-LSTM’s 77.8 ± 1.0, and it also improves cross-rule-type, cross-community, and few-shot performance, including 53.9 ± 3.0 macro-F1 with only 10 examples per rule type versus 42.0 ± 18.2 for T5-LSTM (He et al., 2023).

AUMENA applies context-aware prompt-tuning to source code understanding. Instead of training task-specific models from scratch, it first learns contextualized representations of programming language and natural language through a pre-trained model and then uses prompt-tuning to recommend method names and detect inconsistent names (Zhu et al., 2023). On four method-name recommendation datasets, it reports F1 scores of 68.6%, 72.0%, 73.6%, and 84.7%, surpassing the state-of-the-art baseline by 8.5%, 18.4%, 11.0%, and 12.0%, respectively; for method name consistency checking, it reaches 80.8% accuracy, a 5.5% improvement (Zhu et al., 2023). This is a clear case where application context is code structure rather than dialogue or retrieved documents, but the prompt remains the interface through which that context is made semantically legible to the model.

DialogPrompt does something analogous for response generation. It keeps GPT-2 frozen, derives prompt states from dialogue context with a dynamic prompt encoder, and uses those states as a left prefix for generation (Gu et al., 2021). On DailyDialog, DialogPrompt improves over fine-tuning and generic prompt-learning baselines, reaching BLEU 13.94, NIST 19.07, METEOR 7.61, and ROUGE-L 8.51; on MultiWOZ, it reaches BLEU 20.96, NIST 52.94, METEOR 17.62, and ROUGE-L 18.22 (Gu et al., 2021). The human evaluation also prefers DialogPrompt over fine-tuning, P-Tuning, and Prefix-Tuning on coherence, informativeness, and fluency (Gu et al., 2021).

Dynamic context-aware prompt recommendation extends the same logic to enterprise copilots. Its architecture combines a contextual query processor, retrieval-augmented knowledge grounding, hierarchical plugin→skill organization, telemetry-informed ranking, and prompt synthesis with templates and few-shot examples (Tang et al., 25 Jun 2025). On 784 sessions, 2,967 chats, and 12,432 suggestions, the reported automated scores are high across all configurations, with GPT-4o Full achieving novelty 0.933, usefulness 0.884, and relevance 0.863, while Markov+GPT-4o attains grounding 0.804 and clarity 0.897 (Tang et al., 25 Jun 2025). Manual expert evaluation shows more than 96% useful suggestions for all three configurations, with 75.0% of GPT-4o Full outputs rated extremely useful (Tang et al., 25 Jun 2025). Here the CASP object is literally a recommended next prompt, grounded in context and executable skills.

5. Multimodal and vision-language variants

In multimodal work, CASP often appears as prompt-conditioned representation learning. CPKP enriches label prompts for vision-LLMs by querying ontological knowledge graphs, pruning graph-tier confounders through a Granger-style criterion, decorrelating feature dimensions with a maximum-entropy-inspired loss, and combining semantic graph embeddings with learnable context vectors before sending them into a frozen CLIP text encoder (Li et al., 2022). With two shots, it outperforms manual prompting by 4.64% and learnable prompting by 1.09% on average, and it also improves domain generalization relative to benchmark approaches (Li et al., 2022). The central point is that prompt quality depends on semantic information attached to labels, not merely on template wording.

FedCSAP, CAP-IQA, and Context-Adaptive Multi-Prompt Embedding push this further by conditioning prompts on visual or style context. FedCSAP generates prompt tokens from CLIP text embeddings, multi-scale visual features, and client-specific style indicators in a federated setting, then regularizes prompt diversity with a context redundancy penalizing loss (Prasad et al., 17 Aug 2025). Averaged over nine datasets, it achieves the best new-class accuracy, 75.61, and the best harmonic mean, 76.06, among the reported federated prompt-learning baselines (Prasad et al., 17 Aug 2025). CAP-IQA combines a U-Net encoder, frozen PubMedBERT text priors, image-conditioned context tokens, and Dynamic Cross-Prompt Attention for CT image quality assessment; on the 2023 LDCTIQA challenge benchmark it reaches an overall correlation score of 2.8590, exceeding the top-ranked leaderboard team’s 2.7427 by 4.24%, and it also generalizes to an in-house pediatric dataset of 91,514 CT images (Rifa et al., 4 Jan 2026). Context-Adaptive Multi-Prompt Embedding replaces a single CLIP text embedding with $c$2 structured prompts, each carrying a distinct adaptive prompt token, and reports consistent gains on image-text and video-text retrieval; on Flickr30K, image-to-text R@1 rises from 54.7 at $c$3 to 66.0 at $c$4, and adding diversity plus negation-aware losses pushes it to 68.3 (Kim et al., 3 Aug 2025).

Other multimodal systems use prompts to decide what information should be preserved, transmitted, or emphasized. DSC-UAV conditions a ViT-based semantic encoder on CLIP text prompts through cross-attention and gated injection, then jointly optimizes compression and UAV relaying with TQC-based reinforcement learning (Joshi et al., 4 Jan 2026). The paper reports up to 22% improvement in semantic-structural similarity and a 14% reduction in Age of Information relative to digital and prior UAV-semantic communication baselines (Joshi et al., 4 Jan 2026). This suggests that, in multimodal CASP, the prompt is not only a linguistic steering device; it can function as a task definition for sensing, compression, and communication.

6. Evaluation criteria, limitations, and research directions

The evaluation of CASP systems is heterogeneous because the underlying tasks vary, but the literature consistently measures both task success and side effects. Security papers use false negative rate and false positive rate for guardrails, attack success rate and utility for agent defenses, and harmonic means that combine safety and helpfulness (Kholkar et al., 18 May 2025, Weng et al., 5 May 2026, Kim et al., 12 Dec 2025). Prompt recommendation systems score novelty, grounding, usefulness, clarity, and relevance (Tang et al., 25 Jun 2025). Moderation and code-understanding systems report macro-F1, micro-F1, exact match, and accuracy (He et al., 2023, Zhu et al., 2023). Multimodal and retrieval-oriented methods use R@1, domain-generalization accuracy, or perceptual correlation measures such as PLCC, SROCC, and KROCC (Li et al., 2022, Kim et al., 3 Aug 2025, Rifa et al., 4 Jan 2026). This suggests that CASP should not be evaluated solely as prompt quality; it must be evaluated as system behavior under context.

The limitations reported across the papers are also strikingly consistent. CAPTURE focuses on single-turn direct injections and does not cover multi-turn dialogues, tool use, or retrieval-augmented generation (Kholkar et al., 18 May 2025). CONTEXTLENS is centered on safety and does not yet provide richer user modeling or multi-turn personalization (Kim et al., 12 Dec 2025). CPL-NoViD uses only hard prompts and does not explore soft prompts or learned templates (He et al., 2023). CaPT notes that generalization to arbitrary architectures and complex multi-step reasoning still needs more empirical study (Liu et al., 19 Oct 2025). CAP-IQA is slice-level and relies on fixed prompt engineering, while DSC-UAV uses manually chosen prompts rather than automatic prompt selection (Rifa et al., 4 Jan 2026, Joshi et al., 4 Jan 2026). A plausible implication is that a mature CASP framework would need to unify prompt construction with dialogue history, tool schemas, document provenance, and task-specific constraints.

A second recurring theme is that context must be both semantically rich and selectively trusted. CAPTURE shows that keyword-sensitive defenses over-block benign prompts and miss contextual attacks (Kholkar et al., 18 May 2025). ARGUS shows that provenance alone is not enough without entailment and invariants, while CONTEXTLENS shows that safety improves when the model first extracts intent, ambiguity, and risk before answering (Weng et al., 5 May 2026, Kim et al., 12 Dec 2025). C.A.P. reaches the same conclusion for human-LLM dialogue from a different angle: the system should sometimes ask for clarification rather than overcommit to an under-specified interpretation (Wei, 17 Mar 2026). CASP therefore converges toward a broader architectural pattern: represent context, align it with task semantics, verify that it justifies the action, and only then generate or execute.

The literature does not yet define CASP as a settled field. This suggests that the term is best used as a unifying label for methods that move prompt design away from isolated strings and toward explicit semantic context modeling. In that broader sense, CASP links prompt engineering, parameter-efficient tuning, pre-processing, retrieval, auditing, and multimodal conditioning into a common research program: prompt behavior should depend on what the system knows about the current instance, the surrounding task, and the trustworthy context in which the request is embedded.