Adapter blocks four families of injection attacks by tagging text

A new paper marks untrusted text in a prompt before the model ever reads it, and that alone drops four families of prompt-injection attacks to zero. Most current defenses instead train the model to spot malicious instructions inside text an attacker already controls. This result undercuts that assumption.

The method, called Semantic Overlays, adds small learned adapters at chosen positions in a frozen model's residual stream during prefill, an annotation channel that sits outside the token stream itself. Attacker text can rewrite words. It can't rewrite that channel.

Marking a span "non-executable" pushed separation between instructions and data from 24.3% to 96.5% on the SEP benchmark, with no measured drop in normal task performance. Attack success on the TensorTrust benchmark dropped to 6.6%, down from 34.8%. On PIArena, a benchmark built from four distinct attack families, marked spans blocked every one of them down to zero. The model still read the tagged content back with 92.5% exact-copy accuracy, so marking a span untrusted didn't strip its meaning.

None of this proves the model reasons better about what counts as trustworthy. It gained a signal attacker text can't overwrite, and that alone accounts for the drop in attacks. TensorTrust attacks still get through 6.6% of the time, and the paper doesn't say whether that gap is adapter noise or a crack the fix hasn't closed.