{"data":{"id":"3006cd28-805d-4d35-96ef-9410d6636e57","title":"Ranked but Not Stopped: Detecting Prompt-Injection Hijacks from Typed Decision Models' Output Probabilities","summary":"Researchers tested whether a language model's own top-label confidence can flag prompt-injection hijacks in classifiers, using AG News topic classification across five systems, three served through a provider's API. Low confidence ranked hijacked answers above clean ones with AUROC 0.86-0.90 on four systems, but a threshold allowing at most 5% clean alarms missed most hijacks. On the API systems, the monitor missed 51-70% of plain-note hijacks and 99-100% when the injection claimed certainty, though ranking still reached AUROC 0.70-0.79.","solution":"N/A -- no mitigation discussed in source.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2611.02522v1","publishedAt":"2026-11-02T04:49:25.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["prompt_injection","jailbreak"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-02T04:49:25.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","safety"],"aiComponentTargeted":"model","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":"preprint","atlasIds":["AML.T0051","AML.T0054"]}}