Latent-Signal Probing and Probe-Gated Defense for Indirect Prompt Injection in Agentic LLMs

Technical Analysis

The underlying threat model is standard indirect prompt injection (IPI), where malicious instructions embedded in tool outputs or external content hijack an agentic LLM's task execution, crossing from the tool/data layer into the model's planning and action layer. The paper's novel contribution is diagnostic and defensive: it shows that linear probes on pre-generation hidden states can predict IPI exposure with 90%+ AUROC across six models, revealing a 'recognition-action gap' where models internally encode injection signals but fail to act safely on them. The proposed AGRI defense uses these probes to gate insertion of anti-injection chain-of-thought reasoning, reducing attack success rate from 34.6% to 0% on Qwen3.5-27B in AgentDojo evaluations. No new attack technique, exploit payload, or vulnerable software artifact is disclosed; the work is a white-hat interpretability/defense study evaluated on existing benchmarks (AgentDojo) and models (including GLM-5.2, Qwen3.5-27B).

Affected Systems

AgentDojo

Detection Signatures

• N/A - this is a defensive research technique, not an attack signature. Relevant indicators for IPI in general include: unexpected imperative instructions embedded within tool/API/document outputs, tool results containing role-play or system-like phrasing (e.g., 'ignore previous instructions', 'as the assistant you must now...'), anomalous divergence between an agent's reasoning trace and its subsequent tool calls, and elevated activation patterns in intermediate hidden states correlating with injected-content processing.

Remediation Steps

1. 1

   Adopt probe-based exposure detection

   Evaluate integrating lightweight linear probes on hidden states to flag likely IPI exposure before action generation, as demonstrated in this research.

2. 2

   Deploy probe-gated reasoning defenses

   Consider reasoning-based mitigations (e.g., AGRI-style anti-injection CoT prompts) triggered conditionally when exposure signals are detected, to close the recognition-action gap.

3. 3

   Benchmark agents against IPI suites

   Regularly test agentic deployments against AgentDojo and similar indirect prompt injection benchmarks to measure baseline attack success rates.

4. 4

   Maintain standard IPI hardening

   Continue enforcing tool-output sanitization, privilege separation between planning and execution, and human-in-the-loop confirmation for high-risk actions regardless of model-internal defenses.