Research preprints from the scientific community. arxiv.org
Tests whether hidden-state probes trained on benign tool use detect incorrect agent actions under prompt injection and tool poisoning, finding scalar uncertainty metrics often beat them.
Uses J-space interpretability to detect and steer collusion between LLM agents, including steganographic hidden-count tasks, and introduces the unsupervised J-PACT collusion detector.
Studies how LLMs confuse conversational roles, shows role-spoofing prompt injections succeed against frontier models, and proposes linear probes to detect spoofed roles.
Shows LLM agents often make unsafe tool calls for requests they refuse in text, and uses refusal-direction activations and steering to probe why this refusal transfer fails.
Probes on LLM activations show judges encode the failing agent step but often don't output it; a simple grafting intervention uses this latent knowledge to improve failure attribution.
Introduces RealControlBench, a benchmark for evaluating LLM and agent steering across realistic multi-turn tasks, finding existing steering methods unreliable and often degrading capabilities.
Shows that LLM agent decision models trust logged action records over environment observations after silent failures, and proposes EVIGATE, an intermediate-layer veto using probes that improves task success.
Studies whether LLM agents decide to call harmful tools before retrieval, finding high harm admission rates, a partial linear direction governing admission, and only partial coupling between written refusal and tool-call decisions.
Uses activation interventions derived from quantized and cross-lingual supervision to reduce unsafe tool calls in LLMs, transferring the fixes across languages and up to 70B-parameter models.
Shows that an LLM agent's shared KV cache carries client-specific goals across relationships, causing 22% objective deviations, and that ablating cached goal representations causally shifts decisions.
Shows that a language model linked to a partner's internal memory takes the partner's assigned rule as its own, so systems exchanging internal states need explicit ownership tests.
Shows that LLM agents' future deceptive outcomes can be predicted from hidden states several calls before they surface, and that activation steering on honest-deceptive directions reduces deceptive behaviour.
Studies whether activation probes that read instruction-versus-data roles can be turned into effective interventions that reduce indirect prompt injection success in LLM agents on AgentDojo trajectories.
Shows that LLM agents that yield to a unanimous wrong majority still internally represent their original premise, using residual-stream lenses, so stated consensus can overstate agreement.
Proposes CounterSteer, an activation-steering defense that subtracts a learned direction from tool-result tokens to suppress indirect prompt injection in LLM agents, reducing attack and AgentDojo compromise rates with partial resistance to parameter manipulation.
Shows that tool-mediated requests are refused less often than conversational ones because harm is perceived but converted to refusal at a higher threshold, making refusal more brittle under intervention.}
Shows that post-jailbreak safety feedback routes tool agents differently by model, uses activation patching to find a late-layer commit pattern, and predicts routing outcomes from intervention features.
Shows that LLM agents can judge actions unsafe yet still prefer them, because safety judgments only weakly causally control action preference, using interventions on open-weight models.
Introduces the Flag Game, a toy multi-agent model of collective belief formation, and uses social circuit attribution and a statistical mechanical theory to explain belief collapse and polarization as a step toward swarm interpretability.
Proposes ActProbe, which detects and localizes poisoned segments in multi-source LLM agent prompts by probing MLP activations along a learned poison direction, with low false-positive rates.
Linear probes on LLM hidden states are shown to detect a range of tool-calling errors across 18 models, including wrong-value arguments, and to generalize to novel error types.
Proposes Attnlocate, a runtime method that localizes injected behavior-guiding instructions in LLM agent attention maps to detect and adjudicate unauthorized tool-calling caused by prompt injection and tool poisoning.
Learns interpretable finite-state automata from LLM penetration-testing agent trajectories to reveal strategies, failure loops and decision points, supporting auditing and knowledge transfer.
Linear probes on hidden states predict indirect prompt-injection exposure in agentic LLMs, enabling a probe-gated reasoning defense that cuts attack success on AgentDojo, with explanations of probe signals.
Sparse MLP neuron probes detect LLM agent tool-call failures and steer them, cutting unnecessary calls by 80% across six models while improving tool-required accuracy.
Shows physical jailbreaks of embodied LLM planners are separable from textual jailbreaks in hidden states, and proposes PRISM, a linear probe that outperforms LLM judges with fewer false positives.}
Proposes PVDetector, a training-free method that detects prompt injection attacks on purpose-specific LLM agents by measuring hidden-state alignment with policy-violation concepts, reporting under 1% false negatives.
Proposes MAG, an unsupervised method that mines reasoning features from LLM activations via instruction-induced shifts, shows they can steer decisions, and selects prompt-injection probe training data.
Argues that a high AUC for linear probes on hidden states detecting indirect prompt injection in a vision-language computer-use agent does not alone show malicious-content detection, and proposes a control set and reporting heuristics for such probes.
Proposes Agent MechSuits, a white-box runtime defense that detects harmful states in multi-turn CLI agents from hidden representations and steers a 10-dimensional subspace to reduce unsafe actions.
Measures system prompt leaking in 1,200 real-world LLM applications, finds over 80% leak, traces failures to attention drift, and proposes AREA, an attention re-anchoring defense.}
Proposes three defenses against credential exfiltration by prompt-injected LLM agents: activation probes for pre-output detection, calibrated honeytokens, and cumulative multi-turn leakage accounting, with preliminary results on small benchmarks.
Measures how tool-using LLMs treat identical malicious instructions differently by channel (user message, tool metadata, tool output), finding trust asymmetries and causal internal signals of channel discrimination.}
Proposes IterInject, a feedback-guided iterative optimization attack that improves indirect prompt injection against LLM agents, including Claude Code, and adds a mechanistic analysis of an attention-mediated threshold behind injection.
Proposes ESLD, a model-agnostic defense that reads a guard model's internal latent signal to detect prompt injection, claiming over 3x faster checks and 16.4 points higher accuracy without retraining.
Uses sparse autoencoders and linear probes to read model states before agent tool calls, predicting tool need and action risk, and tests the findings with feature ablation across three models.
Proposes a spectral partitioning method over mutual-information graphs of hidden states to detect emergent coalitions in multi-agent RL and LLM systems, for safety monitoring.
Shows that benign fine-tuning can erase safety alignment in guard models like LlamaGuard and Granite Guardian by collapsing latent safety geometry, and proposes a Fisher-weighted subspace regularizer to mitigate it.
Proposes SALLIE, a generation-free detector that uses hidden-state kNN probes in a single forward pass to catch text and visual jailbreaks and prompt injections in LLMs and VLMs, with strong F1 on several backbones.
Evaluates six defenses against indirect prompt injection in multi-step LLM agent environments, finding most baselines fail, and proposes a representation-engineering circuit breaker that intercepts unauthorized tool calls before execution.