Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure

2026-08-01

AI Summary

This study addresses the unclear internal response mechanisms of large language model agents under indirect prompt injection (IPI) attacks, which hinder effective defense. The work reveals, for the first time, detectable IPI exposure signals in the models’ hidden states and identifies a semantic gap between threat recognition and action execution. To bridge this gap, the authors propose a linear probe-based exposure detection method, an on-demand anti-injection reasoning mechanism termed AGRI, and an analysis framework linked to natural language explanations. Experiments demonstrate that the probe achieves over 90% AUROC on unseen attacks and tasks, while AGRI reduces the attack success rate on AgentDojo from 34.6% to 0% for Qwen3.5-27B without compromising performance on normal tasks.

Abstract

Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.g., malicious side-tasks hidden in external tool results. While many efforts have sought to address the threats, little is known about the internals of agentic LLMs when they are exposed to IPI attacks, a condition which we call IPI exposure. In this paper, we study this problem in depth from three aspects. (1) Probing: Across six models, including the giant 753B-parameter GLM-5.2, simple linear probes trained on pre-generation hidden states can predict LLMs' IPI exposure. These probes achieve 90%+ AUROC on unseen attacks, agent instructions, and task suites; they exhibit high robustness under adaptive attacks and in cross-lingual settings. (2) Defense: Our CoT measurement reveals a recognition--action gap: though models encode such signals, they often fail to translate them into safe actions. We then introduce AGRI, a probe-gated reasoning-based defense that prepends anti-injection reasoning on demand. On difficult AgentDojo settings, AGRI substantially reduces attack success rate, e.g., from 34.6% to 0% on Qwen3.5-27B, while largely maintaining clean-task utility. (3) Explanation: We introduce an analysis framework that identifies natural-language explanations most strongly correlated with probe-captured signals. The resulting profiles differ across models: latent signals can align with either direct IPI-exposure claims or indirect operational cues. Code is available: https://github.com/jianshuod/IPI-exposure-signal.

Problem

• Indirect Prompt Injection
• Agentic LLMs
• Latent Signals
• Prompt Injection Exposure
• Model Internals

Innovation

• indirect prompt injection
• latent signal probing
• agentic LLMs
• probe-gated defense
• interpretability