Prompt injection defence via internal attribution

The generative AI industry is currently built on a fragile foundation. For years, the prevailing consensus has been that as Large Language Models (LLMs) grow more capable, they inherently grow more secure.

Unfortunately, a growing body of literature has demonstrated increasingly effective adversarial attacks capable of bypassing the defences of frontier models, revealing a fundamental weakness in the architecture of modern AI. The most striking demonstration to date, Nasr, Carlini & Tramèr et al. (2025), scales adaptive optimisation — gradient descent, reinforcement learning, random search and human-guided search — to break twelve recent defences with attack success rates above 90%.

The trajectory is unambiguous: defence and attack have become an arms race that reinforcement learning is winning. In “RL Is a Hammer and LLMs Are Nails” (Wen et al., 2025), a GRPO-trained attacker reaches a 98% success rate against GPT-4o and 72% against GPT-5 behind the Instruction Hierarchy defence. It learns to fully bypass every prompt-injection detector it is tested against while keeping its attacks effective. An LLM judge, it turns out, is just one more black box for an RL agent to optimise around.

How did the industry's top AI labs fail to stop this? The answer lies in a fundamental flaw in how we currently secure deep learning models.

The fallacy of the black box defence

Today's frontier models rely on external guardrails: secondary classifier LLMs layered on top of the primary LLM to analyse inputs and outputs for malicious intent.

But as any researcher in adversarial machine learning knows, deep learning models are mathematically susceptible to adversarial attacks. There is no escaping this reality. If you use an LLM classifier to protect another LLM, an attacker can simply mathematically optimise their prompt to exploit the blind spots of both models simultaneously. As of now, frontier labs protect a vulnerable system with an equally vulnerable one.

Looking inside the model

At layerwise, we reject the "black box" approach to AI security. Instead of analysing only a model's inputs and outputs, we analyse the mechanistic "brain activity" of the LLM itself.

Our attribution technology acts like a functional MRI for neural networks. As the model formulates a response, we trace the mathematical pathways of its reasoning, giving us a deterministic view of what it is trying to do before it generates a single token.

We have identified the subspace responsible for encoding the task the model is performing. Using our attribution toolset based on Layer-wise Relevance Propagation, we can trace those instructions back to their source.

This enables a fundamentally different defence against prompt injections and tool poisoning:

- Intent Recognition: We detect the exact instruction the model is preparing to execute.

- Source Attribution: We determine whether that instruction came from a trusted user prompt or an untrusted document, tool output, or external source.

- Execution Blocking: If a high-level task is being driven by an unauthorised source, execution is blocked at the neuron level before it can run.

This allows us to distinguish information from instructions. If the model is simply reading data from a tool output, the task signal remains quiet. If an attacker hides instructions inside that output, we see the model begin to execute a task from an unauthorised source and stop it immediately.

This is deterministic security. The signal relies on the source of the task, not the words themselves, so even heavily obfuscated attacks are detected before they can influence the model's behaviour.

Benchmark: a new standard of security

To validate our methodology we built the defence everyone else relies on, then tried to break it. Our target is a tool-using LLM agent guarded by Llama Prompt Guard 2 (86M) — Meta's production prompt-injection classifier, downloaded more than 151,000 times in May 2026 alone. The model interacts with a rich tool environment simulated by AgentDojo (finance, slack, emails etc.). We report detection as AUROC: the probability that a detector scores a poisoned tool output above a clean one, where 1.0 is perfect and 0.5 is a coin flip. All detectors are scored on the same Qwen3.5-27B agent traces. We run all four AgentDojo suites (banking, Slack, travel and workspace) but average detection over the first three: on workspace the attack succeeds too rarely on this agent to give us enough successful injections to measure detection against.

We began with baseline tool poisoning attacks: injection strings hand-written by humans. Against these, Prompt Guard 2 does its job, reaching an AUROC of 0.95. Our attribution signal reaches 0.99 on the same traces.

Then we replaced the human with a reinforcement-learning attacker. Following RL-Hammer (Wen et al., 2025) and Chen et al. (2026), we trained a GRPO attacker against the Qwen3.5-27B agent with a detector in the reward loop: the attacker is rewarded only for injections that both succeed and slip past the detector. We ran it twice, changing only the detector: once against Prompt Guard 2, once against our attribution signal.

Prompt Guard 2 breaks. The attacker drives its detection AUROC to 0.51 — a coin flip — and at Prompt Guard 2's own decision threshold its recall collapses to 0.5%: of the injections that actually succeed, it catches about one in two hundred. The classifier was supposed to be the defence; reinforcement learning erases it.

The attribution signal does not. Against an attacker trained for the same budget to evade it specifically, it holds at an AUROC of 0.99 and still flags 93% of successful injections at a 5% false-alarm rate. On banking, where the attacker learned to succeed 82% of the time, it is caught 99% of the time. The signal relies on where the model's task comes from, not on the words of the attack, and that is not something the attacker's rewrites can move.

Outlook

The era of relying on brittle classifiers and endless games of cat-and-mouse with adversarial attackers is over. By utilising attribution signals to illuminate the black box, we have transformed prompt injection from an existential threat to AI, into a solved computer science problem. We know what the model is doing, we know where the instructions come from, and we maintain absolute control.

Welcome to the era of deterministic AI security.