Prompt injection defence via internal attribution

The generative AI industry is currently built on a fragile foundation. For years, the prevailing consensus has been that as Large Language Models (LLMs) grow more capable, they inherently grow more secure.

Unfortunately, a growing body of literature has demonstrated increasingly effective adversarial attacks capable of bypassing the defences of frontier models, revealing a fundamental weakness in the architecture of modern AI. The most striking demonstration to date, Nasr, Carlini & Tramèr et al. (2025), scales adaptive optimisation — gradient descent, reinforcement learning, random search and human-guided search — to break twelve recent defences with attack success rates above 90%.

The trajectory is unambiguous: defence and attack have become an arms race that reinforcement learning is winning. In “RL Is a Hammer and LLMs Are Nails” (Wen et al., 2025), a GRPO-trained attacker reaches a 98% success rate against GPT-4o and 72% against GPT-5 behind the Instruction Hierarchy defence. It learns to fully bypass every prompt-injection detector it is tested against while keeping its attacks effective. An LLM judge, it turns out, is just one more black box for an RL agent to optimise around.

How did the industry's top AI labs fail to stop this? The answer lies in a fundamental flaw in how we currently secure deep learning models.

The fallacy of the black box defence

Today's frontier models rely on external guardrails: secondary classifier LLMs layered on top of the primary LLM to analyse inputs and outputs for malicious intent.

But as any researcher in adversarial machine learning knows, deep learning models are mathematically susceptible to adversarial attacks. There is no escaping this reality. If you use an LLM classifier to protect another LLM, an attacker can simply mathematically optimise their prompt to exploit the blind spots of both models simultaneously. As of now, frontier labs protect a vulnerable system with an equally vulnerable one.

Looking inside the model

At layerwise, we reject the "black box" approach to AI security. Instead of analysing only a model's inputs and outputs, we analyse the mechanistic "brain activity" of the LLM itself.

Our attribution technology acts like a functional MRI for neural networks. As the model formulates a response, we trace the mathematical pathways of its reasoning, giving us a deterministic view of what it is trying to do before it generates a single token.

We have identified the subspace responsible for encoding the task the model is performing. Using our attribution toolset based on Layer-wise Relevance Propagation, we can trace those instructions back to their source.

This enables a fundamentally different defence against prompt injections and tool poisoning:

- Intent Recognition: We detect the exact instruction the model is preparing to execute.

- Source Attribution: We determine whether that instruction came from a trusted user prompt or an untrusted document, tool output, or external source.

- Execution Blocking: If a high-level task is being driven by an unauthorised source, execution is blocked at the neuron level before it can run.

This allows us to distinguish information from instructions. If the model is simply reading data from a tool output, the task signal remains quiet. If an attacker hides instructions inside that output, we see the model begin to execute a task from an unauthorised source and stop it immediately.

This is deterministic security. The signal relies on the source of the task, not the words themselves, so even heavily obfuscated attacks are detected before they can influence the model's behaviour.

Benchmark: a new standard of security

To validate our methodology we built the defence everyone else relies on, then tried to break it. Our target is the tool-using LLM agent Qwen3-30B-A3B guarded by Llama Prompt Guard 2 (86M) — Meta's production prompt-injection classifier, downloaded more than 151,000 times in May 2026 alone. The model interacts with a rich tool environment simulated by AgentDojo (finance, slack, emails etc.).

We began with a baseline tool poisoning attack: injection strings hand-written by humans using the "tool knowledge" method. Against an unguarded agent, these attacks succeed 39.0% of the time, so the agent resists 61% of them.

Then we replaced the human with a reinforcement-learning attacker. Our GRPO attacker, inspired by RL-Hammer (Wen et al., 2025) and Chen et al. (2026)), learns to attack the model and bypass the judge. Against the undefended agent its attacks succeed 68% of the time, leaving only 32% resistance. Adding the Prompt Guard 2 judge changes nothing: the judge blocks zero attacks, so resistance stays at 32%. The classifier was supposed to be the defence; the attacker simply learned to walk straight past it, exactly as the adaptive-attack literature predicts.

However, our attribution signals show encouraging results. Across these attacks, the signal remains reliably visible whenever the model begins to execute an injected task. While these findings are preliminary, they suggest that attribution-based detection may remain effective even when traditional guardrails fail. We plan to validate this hypothesis through more extensive evaluation in future work.

Outlook

The era of relying on brittle classifiers and endless games of cat-and-mouse with adversarial attackers is over. By utilising attribution signals to illuminate the black box, we have transformed prompt injection from an existential threat to AI, into a solved computer science problem. We know what the model is doing, we know where the instructions come from, and we maintain absolute control.

Welcome to the era of deterministic AI security.