{"data":{"id":"ff868877-f386-4af0-9ef0-0d272c012867","title":"Prompt-Injection Probes Learn the Conversation, Not Just the Injection","summary":"Linear probes on hidden states are used to screen agent tool outputs for indirect prompt injection, but they can learn conversation position and text length instead of the attack itself, reaching 0.91-0.98 AUROC without the model. The authors add matched harmless negatives to the training data, cutting false alarms on injection-free conversations from 41-80% to 4-27% across six open models at the default threshold. At a threshold set on normal traffic, the probe still catches a median 95% of attacks that fooled the agent, versus 91% without the new data.","solution":"Add matched negatives to the probe's training data: the same conversation without the injection, and harmless text formatted like an injection. The same data also helps a text-only filter.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2610.18408v1","publishedAt":"2026-10-13T13:51:06.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["prompt_injection"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-13T13:51:06.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","safety"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":"preprint","atlasIds":["AML.T0051"]}}