Cloud-hosted vision-language models (VLMs) may be silently fine-tuned, poisoned, compressed, or replaced after deployment, motivating black-box fingerprint verification. RESF tests response distributions but requires estimating the service temperature, making its reliability sensitive to estimation error. We propose Latent Visual Sensitive Fingerprinting (LVSF), based on a local Pearson-sensitivity decomposition of the conditional top-k distribution of the first generated token. This decomposition separates observable output shifts from input-dependent exposure to parameter changes. Modeling tampering-induced relative top-k logit shifts as isotropic, we show that a uniform top-k anchor maximizes average sensitivity. Accordingly, LVSF equalizes recorded top-k logits, maintains a margin from out-of-support tokens, and maximizes full-parameter Fisher sensitivity, yielding a reference distribution invariant to positive temperature scaling. These principles apply to both LLMs and VLMs. For VLMs, LVSF fixes a natural-language query and optimizes an image in a pretrained VAE latent space to produce natural-looking fingerprints. Repeated API queries detect excess out-of-support first tokens or shifts in conditional in-support frequencies. Across four VLMs and multiple tampering types, LVSF achieves consistently high detection rates with no observed false positives and substantially higher detection rates than evaluated baselines on Qwen2.5-VL-7B-Instruct.

Large language models (LLMs) deployed in real-world applications process heterogeneous inputs, including system prompts, user requests, and external content, exposing them to prompt injection attacks. Existing defenses, including prompt-level safeguards, external filters, and source-aware instruction handling, remain brittle against diverse direct and indirect prompt injection attacks. We propose **CBC** (*Consistency Before Complying*), a task-consistency alignment framework to defend against task-redirection prompt-injection attacks. **CBC** characterizes task consistency through semantic conflicts along action, constraint, and domain dimensions, then uses structured reasoning to determine whether newly introduced instructions are consistent with the original task before acting on them. Using targeted synthetic supervision, we train **CBC** to reason about task consistency and further strengthen this capability through dual-objective online alignment while preserving task utility. Across three model families and a diverse set of direct and indirect prompt-injection benchmarks, **CBC** improves defense success rates by up to 13.2 percentage points over the strongest baseline while better preserving task utility under attack. Our code and models can be found at: https://github.com/XOTaichi/CBC-PI.git