Skip to content
Log in
#machine learning #natural language processing #small language model Preprint

Semantic Overlays: Mitigating Prompt Injection with Annotations Beyond Tokens and Steering Vectors

Joshua Penman
Aug 2026 · 0 citations · 20 references
Computer Science

TL;DR

This work introduces a general steering technique called Semantic Overlays: small learned adapters applied at chosen prefill positions to a frozen model's residual stream that defends against the broad class of prompt injections that add instructions in untrusted context.

Abstract

Everything a language model sees is tokens. The serving stack knows what each span is -- user input, tool output, instructions -- but the model must keep track of that itself, and it can lose track or be confused: text can be written to read like anything. Prompt injection is a natural exploit of this phenomenon. By scrambling the model's understanding of span identity, an attacker can induce unwanted and potentially dangerous actions. Adding a non-textual channel to the model's input -- a way to communicate span identity beyond text -- mitigates this class of attack. We thus introduce a general steering technique called Semantic Overlays: small learned adapters applied at chosen prefill positions to a frozen model's residual stream. Laying an overlay over a span creates an out-of-band annotation channel that cannot be replicated by tokens. Unlike steering vectors, Semantic Overlays are trained, adaptable, and selectively applied. An overlay can encode complex semantics that reshape how the model perceives the marked span: asked to copy a code snippet under an overlay asserting that it is in a different programming language than it is, the model rewrites the snippet, faithfully, in the asserted language. Overlays are also composable, allow for transparent reading of underlying content, and can carry complex payloads -- including imperatives that the model will follow. An overlay which marks a span as"non-executable"defends against the broad class of prompt injections that add instructions in untrusted context. We report strong results on prompt injection benchmarks: SEP separation rises from 24.3% to 96.5% with utility unchanged (our scoring rule; we also correct a defect in the published grader), TensorTrust attack success rate falls from 34.8% to 6.6%, and all four PIArena attack families drop to 0% compliance, all while marked spans stay readable (92.5% exact copy rate).

DOI arXiv Semantic Scholar
View source

Similar papers

#machine learning Open access Oct 2020

Physics-Informed and Hybrid Machine Learning in Additive Manufacturing: Application to Fused Filament Fabrication

This article investigates several physics-informed and hybrid machine learning strategies that incorporate physics knowledge in experimental data-driven deep-learning models for predicting the bond quality and porosity of fused filament fabrication (FFF) parts. Three types of strategies are explored to incorporate physics constraints and multi-physics FFF simulation results into a deep neural network (DNN), thus ensuring consistency with physical laws: (1) incorporate physics constraints within the loss function of the DNN, (2) use physics model outputs as additional inputs to the DNN model, and (3) pre-train a DNN model with physics model input-output and then update it with experimental data. These strategies help to enforce a physically consistent relationship between bond quality and tensile strength, thus making porosity predictions physically meaningful. Eight different combinations of the above strategies are investigated. The results show how the combination of multiple strategies produces accurate machine learning models even with limited experimental data.

B. Kapusuzoglu, S. Mahadevan · 79 citations · ⚡2
#machine learning Jan 2024

Spikformer V2: Join the High Accuracy Club on ImageNet with an SNN Ticket

This work introduces a pioneering exploration of Self-Supervised Learning (SSL) within the SNN, and proposes a novel Spiking Self-Attention (SSA) and Spiking Transformer (Spikformer) that achieves 80+% accuracy on ImageNet.

Zhaokun Zhou, Kaiwei Che, Wei Fang et al. · 69 citations · ⚡10
#machine learning Open access May 2021

Information fusion and machine learning for sensitivity analysis using physics knowledge and experimental data

This paper considers global sensitivity analysis (GSA) for situations where both a physics-based model and experimental observations are available, and investigates physics-informed machine learning strategies to effectively combine the two sources of information in order to maximize the accuracy of the sensitivity estimate.

B. Kapusuzoglu, S. Mahadevan · 45 citations
#machine learning Conference Open access Feb 2023

EquiPocket: an E(3)-Equivariant Geometric Graph Neural Network for Ligand Binding Site Prediction

EquiPocket is proposed, an E(3)-equivariant Graph Neural Network for binding site prediction, which comprises three modules: the first one to extract local geometric information for each surface atom, the second one to model both the chemical and spatial structure of protein and the last one to capture the geometry of the surface via equivariant message passing over the surface atoms.

Yang Zhang, Wenbing Huang, Zhewei Wei et al. · 43 citations · ⚡4
#artificial intelligence Open access Oct 2022

Adaptive surrogate modeling for high-dimensional spatio-temporal output

An adaptive surrogate modeling method for problems with very high-dimensional spatio-temporal outputs is developed that combines exploration and exploitation to improve the surrogate model accuracy with the fewest possible runs of the expensive physics-based model.

B. Kapusuzoglu, S. Mahadevan, Shunsaku Matsumoto et al. · 17 citations
#machine learning Open access Nov 2022

Doubly robust nearest neighbors in factor models

An improved variant of nearest neighbors (NN) for estimation with missing data in latent factor models that provides a (near-)quadratic improvement in the non-asymptotic error and admits a significantly narrower asymptotic confidence interval when compared to both unit-unit or time-time NN.

Raaz Dwivedi, Katherine Tian, Sabina Tomkins et al. · 11 citations

Related blog posts

MIT News · Artificial Intelligence Aug 27, 2026

Looking beyond natural sequences

A new machine-learning framework aims to improve the success rate of computational protein design while moving away from results that reproduce sequences found in nature.