@inproceedings{narendra-chatterjee-2026-prompt,
title = "Why Prompt-Injection Detectors Fail on {XPIA}: A Latent-Space Explanation",
author = "Narendra, Yash and
Chatterjee, Niladri",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1103/",
doi = "10.18653/2026.findings-emnlp.1103",
pages = "23326--23344",
ISBN = "979-8-89176-462-0",
abstract = "Prompt-injection detectors often fail on **cross-prompt-injection attacks (XPIA)**, where the adversarial instruction is hidden inside a document, email, webpage, or tool output. This paper argues that the failure is not only a **distribution-shift problem**, but also a **representation-level problem**. Inside the hidden states of frozen detector backbones, user prompt-injection attacks (UPIA) and XPIA are encoded along **distinct, weakly aligned directions**. A detector whose readout is primarily aligned with the UPIA direction can therefore miss the XPIA signal, even though both signals are present in the same model{'}s representation. A **two-axis linear-discriminant probe** recovers this missing signal: UPIA attacks fire the UPIA axis in **99.9{\%}** of caught cases, while XPIA attacks fire the XPIA axis in **97.3{\%}** of caught cases. Axis ablations and activation-level steering suggest that these directions are not only predictive but may also be behaviorally relevant under controlled perturbations. The geometry persists across model families, training stages, scales, and external prompt-injection benchmarks, suggesting that **XPIA should be treated as a distinct threat axis rather than as a harder version of UPIA**."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="narendra-chatterjee-2026-prompt">
<titleInfo>
<title>Why Prompt-Injection Detectors Fail on XPIA: A Latent-Space Explanation</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yash</namePart>
<namePart type="family">Narendra</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Niladri</namePart>
<namePart type="family">Chatterjee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Prompt-injection detectors often fail on **cross-prompt-injection attacks (XPIA)**, where the adversarial instruction is hidden inside a document, email, webpage, or tool output. This paper argues that the failure is not only a **distribution-shift problem**, but also a **representation-level problem**. Inside the hidden states of frozen detector backbones, user prompt-injection attacks (UPIA) and XPIA are encoded along **distinct, weakly aligned directions**. A detector whose readout is primarily aligned with the UPIA direction can therefore miss the XPIA signal, even though both signals are present in the same model’s representation. A **two-axis linear-discriminant probe** recovers this missing signal: UPIA attacks fire the UPIA axis in **99.9%** of caught cases, while XPIA attacks fire the XPIA axis in **97.3%** of caught cases. Axis ablations and activation-level steering suggest that these directions are not only predictive but may also be behaviorally relevant under controlled perturbations. The geometry persists across model families, training stages, scales, and external prompt-injection benchmarks, suggesting that **XPIA should be treated as a distinct threat axis rather than as a harder version of UPIA**.</abstract>
<identifier type="citekey">narendra-chatterjee-2026-prompt</identifier>
<identifier type="doi">10.18653/2026.findings-emnlp.1103</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1103/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>23326</start>
<end>23344</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Why Prompt-Injection Detectors Fail on XPIA: A Latent-Space Explanation
%A Narendra, Yash
%A Chatterjee, Niladri
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F narendra-chatterjee-2026-prompt
%X Prompt-injection detectors often fail on **cross-prompt-injection attacks (XPIA)**, where the adversarial instruction is hidden inside a document, email, webpage, or tool output. This paper argues that the failure is not only a **distribution-shift problem**, but also a **representation-level problem**. Inside the hidden states of frozen detector backbones, user prompt-injection attacks (UPIA) and XPIA are encoded along **distinct, weakly aligned directions**. A detector whose readout is primarily aligned with the UPIA direction can therefore miss the XPIA signal, even though both signals are present in the same model’s representation. A **two-axis linear-discriminant probe** recovers this missing signal: UPIA attacks fire the UPIA axis in **99.9%** of caught cases, while XPIA attacks fire the XPIA axis in **97.3%** of caught cases. Axis ablations and activation-level steering suggest that these directions are not only predictive but may also be behaviorally relevant under controlled perturbations. The geometry persists across model families, training stages, scales, and external prompt-injection benchmarks, suggesting that **XPIA should be treated as a distinct threat axis rather than as a harder version of UPIA**.
%R 10.18653/2026.findings-emnlp.1103
%U https://aclanthology.org/2026.findings-emnlp.1103/
%U https://doi.org/10.18653/2026.findings-emnlp.1103
%P 23326-23344
Markdown (Informal)
[Why Prompt-Injection Detectors Fail on XPIA: A Latent-Space Explanation](https://aclanthology.org/2026.findings-emnlp.1103/) (Narendra & Chatterjee, Findings 2026)
ACL