Radar 2026-09-24

06 / AI SECURITY / USENIX SECURITY 2026

prompt-injection on-policy-distillation USENIX Security 26

SecOPD: Mitigating Adaptive Prompt Injections by On-Policy Distillation

(Research team) — 35th USENIX Security Symposium 2026 (peer-reviewed)

SecOPD two-step loop: on-policy sampling generates completions under current injection pressure; token-level distillation closes the adaptive loop without manual attack enumeration. Outperforms static fine-tuning defences in utility-under-attack metrics.

SecOPD frames prompt injection defence as on-policy distillation: the current defender model generates completions for a live distribution of injection prompts, and a teacher provides token-level reward signals, closing the adaptive loop without requiring manual attack corpus construction. This approach sharply reduces attack success rates against adaptive adversaries who iteratively update payloads to defeat defences, and outperforms static fine-tuning baselines in utility-under-attack metrics across multiple task settings; published at USENIX Security 26, the strongest security venue represented this cycle.

09 / APPLIED MECH INTERP / PREPRINT

steering-vectors SAE applied-interp

Disentangling Steering Vectors

Takeru Hiramatsu, Kyohei Atarashi, Koh Takeuchi, Hisashi Kashima — arXiv preprint, September 2026

Composite DiffMeans steering vector decomposed via Steering Vector Dissection (SAE on per-token activation deltas) into semantically distinct single-concept components. Targeted interventions using individual components reduce side-effect co-activation versus the composite direction.

8 entries removed on 2026-09-29 as repeats of earlier reports: 2508.06601 (first covered 2026-09-02), 2609.20412 (first covered 2026-09-18), 2607.26654 (first covered 2026-09-01), 2609.03887 (first covered 2026-09-08), 2609.15886 (first covered 2026-09-17), 2608.27504 (first covered 2026-09-01), 2609.04022 (first covered 2026-09-08), 2609.04721 (first covered 2026-09-08).

Difference-in-means steering vectors conflate multiple semantic and stylistic concepts, causing unpredictable side effects; Steering Vector Dissection trains a Sparse Autoencoder on per-token steering vectors derived from paired activation datasets, then uses decoder columns as candidate concept directions, filtered by interpretability and steering experiments. The framework decomposes composite DiffMeans vectors into semantically clean single-concept components that transfer more reliably across prompts and reduce unwanted concept co-activation — a practical applied-interp tool for controlled, auditable model steering.