Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure
Original title:Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure
AI Summary
This paper studies internal representations of agentic LLMs exposed to indirect prompt injection (IPI), such as malicious side tasks embedded in tool outputs. Across six models, linear probes over pre-generation hidden states reportedly detect IPI exposure with over 90% AUROC on unseen attacks, instructions, and task suites, including cross-lingual and adaptive settings. The authors introduce AGRI, a probe-gated reasoning defense that activates anti-injection reasoning when needed. On difficult AgentDojo evaluations, AGRI reduces Qwen3.5-27B's attack success rate from 34.6% to 0% while largely preserving clean-task utility. They also analyze model-specific natural-language explanations associated with the latent signals.
Why it's worth reading
IPI defense is moving beyond external filtering toward internal-state detection; this preprint provides measurable probe results and a concrete gated-reasoning defense for agent benchmarks.
Deep Read
What happened
Original facts: The paper studies the internal states of agentic LLMs under indirect prompt-injection (IPI) exposure, covering probing, defense, and explanation. The authors also release code.
Core technology
Original facts: The authors train simple linear probes on pre-generation hidden states to detect IPI exposure. They then introduce AGRI, which adds anti-injection reasoning on demand when the probe indicates risk. The work also examines natural-language explanations most correlated with the captured signals.
Key evidence and numbers
Original facts: The evaluation covers six models, including the 753-billion-parameter GLM-5.2. The abstract reports over 90% AUROC on unseen attacks, agent instructions, and task suites, with robustness under adaptive attacks and cross-lingual conditions. In a difficult AgentDojo setting, Qwen3.5-27B's attack success rate reportedly falls from 34.6% to 0%.
Why it matters
Analysis: The findings suggest that models may encode latent cues indicating IPI exposure without reliably converting those cues into safe actions. If reproduced, hidden-state probing could become a runtime safety interface for tool-using agents.
Practical impact
Analysis: Tool-using agents could add a low-cost risk gate that triggers extra reasoning, tool-output isolation, or human confirmation. Probes may also support offline audits of risk awareness across attack types and languages.
Limitations and uncertainty
Original facts: The abstract does not provide the full list of six models, per-task sample sizes, probe-training details, additional reasoning costs, or complete utility curves. Analysis: High linear-probe AUROC does not establish that the probe causally reads an internal concept of injection awareness; the signal could instead reflect formatting, task difficulty, or tool-output distributions. Unverified inference: Whether AGRI can resist probe-evasion attacks in real, continuously changing tool environments remains to be independently tested.