The authors trained linear probes on hidden states of six open text models from four families, using the BTPool-1 dataset of multi-turn agent tasks with injected attacks.
Linear probes for prompt injection often detect conversation position, not attacks
By training with matched negatives—clean twins and look-alikes—the authors cut false alarms from 41–80% to 4–27% on injection-free conversations across six models.
Academic
Kaan Kale · Sriram Vishwanath
Georgia Institute of Technology
Research Digest··3 min read
Linear probes on hidden states are used as fast filters for indirect prompt injection in LLM agents.
Why this paper
From Georgia Institute of Technology
In one line
Prompt-injection probes trained on standard examples learn conversation position and text length, not injection content; adding matched negatives cuts false alarms while catching most attacks.
What we could check
- ·No code link found
- ·No weights link found
- ·No dataset link found
- ·No compute details found
- ✓Limitations stated by the authors
- ·No benchmark numbers found
Observed from the paper text and links we have. Absence here means we did not find it, not that it does not exist.
§