Reliable multi-bit watermarking is essential for tracing the provenance of large language model (LLM) outputs. However, existing high-capacity schemes typically synchronize pseudo-random functions through discrete token n-gram matching, which makes them vulnerable to desynchronization under semantics-preserving paraphrasing attacks. To address this issue, we propose HSPMark, a hierarchical semantic projection marking mechanism for context-aware multi-bit watermarking, which shifts watermark synchronization from brittle token histories to continuous semantic anchors. HSPMark extracts stable contextual features using a pre-trained sentence-level encoder and a lightweight Robust Semantic MLP, then projects these features into context-conditioned pseudo-orthogonal bias matrices for multi-bit payload injection. To balance payload capacity and generation quality, HSPMark introduces an entropy-adaptive embedding mechanism that modulates logit bias according to predictive uncertainty. Extensive evaluations demonstrate that HSPMark improves robustness against paraphrase-induced desynchronization and local perturbations while maintaining a competitive trade-off among bit accuracy, payload capacity, and text quality compared with existing high-capacity baselines.

Direct Prompt Injection (DPI) attacks pose a critical security threat to Large Language Models (LLMs) due to their low barrier of execution and high potential damage. To address the impracticality of existing white-box/gray-box methods and the poor transferability of black-box methods, we propose an activations-guided prompt injection attack framework. We first construct an Energy-based Model (EBM) using activations from a surrogate model to evaluate the quality of adversarial prompts. Guided by the trained EBM, we employ the token-level Markov Chain Monte Carlo (MCMC) sampling to adaptively optimize adversarial prompts, thereby enabling gradient-free black-box attacks. Experimental results demonstrate our superior cross-model transferability, achieving 49.6% attack success rate (ASR) across five mainstream LLMs and 34.6% improvement over human-crafted prompts, and maintaining 36.6% ASR on unseen task scenarios. Interpretability analysis reveals a correlation between activations and attack effectiveness, highlighting the critical role of semantic patterns in transferable vulnerability exploitation.