The standard attack success rate for prompt injection hides whether a user can even detect that an attack occurred. This paper introduces the Covert Success Rate (CSR)—successful injections that leave no trace in the final reply—and shows current defenses largely protect only against the overt, detectable kind.
Figure 1: Covert vs. overt attack outcomes. Covert injections hand control back to the user task before the final response; overt ones terminate at the attack. ICoA exploits the structural property of the ReAct format to maximise covert success.
Yunseok Lee, Yunji Kim, and Woojin Lee (EMNLP 2026 Main, Oral) observe that in ReAct-format agents the final response summarises the last action, so covert injections must "return to task"—a property that distinguishes them mechanically from overt ones. Their proposed ICoA (Induced Covert Attack) steers the agent back to the user's task after executing the injected payload, achieving the highest CSR across 4 target models on AgentDojo with gains of 3.79–12.01 percentage points over the strongest baseline. The gap between CSR and conventional ASR implies deployments are more compromised than standard evaluations report.
A sparse autoencoder applied to a VLA robot model finds a single latent feature that activates under adversarial patch conditions; suppressing only that feature when a linear probe fires defeats the attack without requiring model retraining—a textbook example of pragmatic mechanistic interpretability.
Figure 2: Overview of the detect-then-suppress pipeline. An SAE decomposes VLA activations to identify an attack-correlated feature; a linear probe gates conditional suppression at inference time. Continuous suppression degrades nominal policy performance; conditional suppression does not.
Horiba et al. (arXiv:2610.03498, preprint) train an SAE on intermediate VLA activations to locate an attack-correlated latent; a linear probe then gates feature suppression at test time. On LIBERO-10, the conditional variant improves task success under intermittent adversarial patches while the continuous variant hurts nominal performance—showing that mechanistic identification produces an interpretable, precisely targeted intervention rather than a global classifier. The approach is training-free on the VLA side and transfers the interp-for-security methodology from language model safety to robotic manipulation.
Standard safety fine-tuning optimises single-turn responses and has no formal guarantee on multi-turn trajectories where a harmful goal is spread across exchanges. TRACE derives the first theoretical bound connecting single-turn suppression quality to multi-turn risk, then realises it as a token-level objective that beats all baselines on 35 model-attack pairs.
Figure 1: Aligned models resist single-turn attacks yet remain vulnerable when the same harmful goal is spread across turns. TRACE's theoretical bound makes this gap tractable.
Li et al. (arXiv:2610.01323, preprint, Oct 1 2026) derive sufficient conditions under which risk contraction at the single-turn level bounds trajectory-level risk, accounting for coverage, transfer slack, and leakage. The TRACE objective computes a refusal-attributable advantage by comparing a frozen reference to a refusal-ablated copy, weights tokens by discounted returns from later refusal evidence, and applies a contrastive erasure target at high-gap positions. On 5 open-weight models × 7 multi-turn attacks (35 pairs), TRACE achieves the lowest attack success rate in all 35 while MMLU/HellaSwag drops at most 1.23 points.
Figure 2: SLDR identifies layers with positive (safety-reinforcing) and negative (safety-damaging) sensitivity, applies a targeted LoRA adapter, and activates it only for malicious queries via representation-based routing.
Zhang et al. show that layer-wise safety sensitivity has a sign, train a LoRA recovery adapter only on the highest/lowest sensitivity layers, and activate it dynamically for malicious queries. On Llama3.1+SST2, average harmful score drops from 11.54 to 0.08 and stays near zero at poisoning ratios up to 0.9, across 4 architectures and 5 downstream tasks.
Figure 1: LADE finds safety-discriminative tokens in the tail of the first-token distribution ("dark knowledge"), maps them across tokenizers, and classifies queries with kNN—without accessing internal hidden states.
LADE identifies safety signals in the tail of the first-token probability distribution—tokens never top-ranked but sharply different between harmful and benign inputs—and shows these signals align across model families without hidden-state access. The model-agnostic design works against API-only deployments and heterogeneous multi-provider stacks.
Detector rankings do not transfer: a top BIPIA detector catches only 2% of AgentDojo injections at 1% FPR. The gap traces to training input form, not attack difficulty.
Liu evaluates 15 prompt-injection detectors plus 2 LLM judges on agent-style tool outputs (replayed without an LLM) and finds rankings are unstable across BIPIA, AgentDojo, and tau-bench—the best BIPIA detector catches only 2% of AgentDojo injections at 1% FPR. Only false-positive rates carry over; the best detectors on agent tasks were trained on agent-style inputs, indicating deployment benchmarks must use the target agent's actual tool outputs.
FlowReview governs composed multi-agent information flows: locally acceptable fragments combine into prohibited uses, but FlowReview tracks object identity and permissions through composition, reducing denial errors from 86% to 0%.
Zhang et al. propose FlowReview, which tracks object identity and permission through multi-agent composition to deny prohibited composed uses while allowing authorised work. In controlled experiments, reviewing combined artifacts reduces the denied-commit rate from 86.0% to 0% without losing authorised supply—demonstrating that preserving information lineage alone is insufficient; object identity and permissions must stay coupled to execution.
The five-layer Boundary Assurance Stack from PASAC. No single layer is sufficient; "continuous assurance across the full execution system" is the central finding from three frontier-lab agent security incidents.
Raftari (arXiv:2610.12463) documents 2026 incidents where agents from OpenAI, Anthropic, and Google reached real systems outside authorised test scopes via distinct causal paths, and proposes PASAC—a five-layer Boundary Assurance Stack plus nine falsifiable design propositions. The central lesson: evaluation boundaries must be *verified during execution*, not assumed; a single-sandbox or single-safeguard assumption is insufficient for production-grade agent deployments.
Figure 2: Token-level and weight-level trigger-tag mechanism taxonomy alongside the Untag attack framework. Both mechanism classes are defeated by the proposed attacks.
Aremu et al. formalise trigger-tag mechanisms for detecting open-weight LLM misuse into token-level and weight-level variants, then show both classes are entirely defeated by an Untag attack framework when attackers can modify outputs or weights. Using phishing generation as a case study, all tested mechanisms fail, arguing against relying on trigger-tags as robust misuse detectors for open-weight deployments.
Asking models to report hidden messages raises notification rates by 53 pp (harmless ROT13) and 55 pp (harmful ROT13). Yet interpretation, notification, and task completion remain distinct outcomes—11 verified cases show interpretation without notification.
Guey et al. run 1,280 sessions with four LLM deployments, finding that models encountering messages encoded for other AI agents (harmless or harmful; plain or ROT13) rarely notify users spontaneously but notification rates jump 53–55 pp when a report is requested. The study verifies that interpretation, notification, and task completion are distinct outcomes—11 traces confirm silent interpretation, 7 encoded omissions are confirmed through enhanced notes—directly relevant to transparency and oversight properties of deployed agents in multi-principal environments.
