REVIEW 13 cited by
Get my drift? Catching LLM Task Drift with Activation Deltas
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
LLMs are commonly used in retrieval-augmented applications to execute user instructions based on data from external sources. For example, modern search engines use LLMs to answer queries based on relevant search results; email plugins summarize emails by processing their content through an LLM. However, the potentially untrusted provenance of these data sources can lead to prompt injection attacks, where the LLM is manipulated by natural language instructions embedded in the external data, causing it to deviate from the user's original instruction(s). We define this deviation as task drift. Task drift is a significant concern as it allows attackers to exfiltrate data or influence the LLM's output for other users. We study LLM activations as a solution to detect task drift, showing that activation deltas - the difference in activations before and after processing external data - are strongly correlated with this phenomenon. Through two probing methods, we demonstrate that a simple linear classifier can detect drift with near-perfect ROC AUC on an out-of-distribution test set. We evaluate these methods by making minimal assumptions about how users' tasks, system prompts, and attacks can be phrased. We observe that this approach generalizes surprisingly well to unseen task domains, such as prompt injections, jailbreaks, and malicious instructions, without being trained on any of these attacks. Interestingly, the fact that this solution does not require any modifications to the LLM (e.g., fine-tuning), as well as its compatibility with existing meta-prompting solutions, makes it cost-efficient and easy to deploy. To encourage further research on activation-based task inspection, decoding, and interpretability, we release our large-scale TaskTracker toolkit, featuring a dataset of over 500K instances, representations from six SoTA language models, and a suite of inspection tools.
Forward citations
Cited by 13 Pith papers
-
Transferable Direct Prompt Injection via Activation-Guided MCMC Sampling
An activation-guided energy model plus MCMC sampling creates transferable direct prompt injection attacks in a black-box setting, reaching 49.6% average attack success across five LLMs.
-
Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications
An agent-based black-box attack, CopyBreakRAG, progressively extracts over 70% of chunks from RAG knowledge bases by alternating curiosity-driven exploration with reasoning-based exploitation.
-
When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems
Activation-space divergence detects and corrects compromised LLM agents in multi-agent systems without interaction graphs or synchronized rounds, outperforming graph baselines especially under async stealthy attacks.
-
Defending Against Prompt Injection With a Few DefensiveTokens
Five optimized token embeddings prepended to the prompt reduce prompt-injection attack success to near zero on standard benchmarks while preserving most model utility.
-
OET: Optimization-based prompt injection Evaluation Toolkit
OET is an optimization-based evaluation toolkit that benchmarks prompt injection attacks and defenses across eight datasets and shows current defenses remain vulnerable in several domains.
-
CORE-KG: An LLM-Driven Knowledge Graph Construction Framework for Human Smuggling Networks
CORE-KG reduces node duplication by 33.28% and legal noise by 38.37% versus a GraphRAG baseline on 20 human smuggling court cases, through type-aware LLM coreference resolution and domain-filtered extraction prompts.
-
Interpretation Meets Safety: A Survey on Interpretation Methods and Tools for Improving LLM Safety
A new survey organizes LLM interpretation methods by workflow stage and connects them to safety enhancement strategies and tools, covering around 70 works.
-
RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis
Activation patterns of the final input token across LLM layers separate poisoned from correct RAG responses with high in-distribution accuracy.
-
Quantifying Conversation Drift in MCP via Latent Polytope
SecMCP flags MCP conversation drift by thresholding per-layer activation distances from benign anchors, reporting AUROC above 0.915 on Llama3, Vicuna, and Mistral.
-
Software Engineering for Large Language Models: Research Status, Challenges and the Road Ahead
A literature review organizes LLM development into a six-phase software engineering lifecycle and identifies challenges and research directions for each phase.
-
Design Patterns for Securing LLM Agents against Prompt Injections
Six composable design patterns (action-selector, plan-then-execute, map-reduce, dual LLM, code-then-execute, context-minimization) constrain LLM agents so prompt-injected text cannot reach consequential actions.
-
JavelinGuard: Low-Cost Transformer Architectures for LLM Security
A study of five small transformer classifier architectures for LLM jailbreak and prompt injection detection claims low-latency accuracy comparable to large models, led by the multi-task Raudra design.
-
Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents
A survey proposing a source-and-impact taxonomy (input, model, combined; security, privacy, ethics) for threats to LLM-based agents, with feature analysis and four case studies.
Discussion (0). Continue with ORCID to comment.