Readable Before Actionable: Causal Tracing of Indirect Prompt Injection
cs.AI
Submitted: 2026-10-04
Updated: 2026-10-04
Comments: 25 pages, 9 figures, including appendices
Code: https://github.com/neelnanda-io/TransformerLens
License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
Terminology
Sources
- Get my drift? Catching LLM Task Drift with Activation Deltas
- Interpretability without actionability: mechanistic methods cannot correct language model errors despite near-perfect internal representations
- StruQ: Defending Against Prompt Injection with Structured Queries
- SecAlign: Defending Against Prompt Injection with Preference Optimization
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
- Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States
- NNsight and NDIF: Democratizing Access to Open-Weight Foundation Model Internals
- Gemma 2: Improving Open Language Models at a Practical Size
- Bypassing Prompt Injection Detectors through Evasive Injections
- The Llama 3 Herd of Models
- ARGUS: Defending Against Multimodal Indirect Prompt Injection via Steering Instruction-Following Behavior
- Qwen2.5 Technical Report
- PromptArmor: Simple yet Effective Prompt Injection Defenses
- ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
- Knowing without Acting: The Disentangled Geometry of Safety Mechanisms in Large Language Models
- Prompt Injection as Role Confusion
Related papers
- MAVEN-T: Reinforced Heterogeneous Distillation for Real-Time Multi-Agent Trajectory Prediction
- Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models
- Agents' Last Exam
- The Clinician's Veto: Navigating Trust, Liability, and Uncertainty in Autonomous AI Prescribing
- MindHelper: Closed-Loop Embodied Mental-State Reasoning for Precision Intervention
- Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systems