Ranked but Not Stopped: Detecting Prompt-Injection Hijacks from Typed Decision Models' Output Probabilities

Summary

Researchers tested whether a language model's own top-label confidence can flag prompt-injection hijacks in classifiers, using AG News topic classification across five systems, three served through a provider's API. Low confidence ranked hijacked answers above clean ones with AUROC 0.86-0.90 on four systems, but a threshold allowing at most 5% clean alarms missed most hijacks. On the API systems, the monitor missed 51-70% of plain-note hijacks and 99-100% when the injection claimed certainty, though ranking still reached AUROC 0.70-0.79.

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog