Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
Semantic Overlays tag spans outside the token stream, cutting TensorTrust attack success from 34.8% to 6.6% while keeping copied text 92.5% accurate.
Why now: The paper posted in August 2026 is one of the first to test tagging untrusted spans, instead of training the model to recognize them, against PIArena's four attack families.
A new paper marks untrusted text in a prompt before the model ever reads it, and that alone drops four families of prompt-injection attacks to zero. Most current defenses instead train the model to spot malicious instructions inside text an attacker already controls. This result undercuts that assumption.
The method, called Semantic Overlays, adds small learned adapters at chosen positions in a frozen model's residual stream during prefill, an annotation channel that sits outside the token stream itself. Attacker text can rewrite words. It can't rewrite that channel.
Marking a span "non-executable" pushed separation between instructions and data from 24.3% to 96.5% on the SEP benchmark, with no measured drop in normal task performance. Attack success on the TensorTrust benchmark dropped to 6.6%, down from 34.8%. On PIArena, a benchmark built from four distinct attack families, marked spans blocked every one of them down to zero. The model still read the tagged content back with 92.5% exact-copy accuracy, so marking a span untrusted didn't strip its meaning.
None of this proves the model reasons better about what counts as trustworthy. It gained a signal attacker text can't overwrite, and that alone accounts for the drop in attacks. TensorTrust attacks still get through 6.6% of the time, and the paper doesn't say whether that gap is adapter noise or a crack the fix hasn't closed.
Each link below shares sources, entities, or timing with this story.
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (attack, channel, model); pushes against this story (but).
Same source domain / Shared topic
Reported by the same outlet (arxiv.org); overlapping topics (attack, attacker, control, model).
Reported by the same outlet (arxiv.org); overlapping topics (cannot, cleanly, model, token).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (model, token); pushes against this story (but).
Reported by the same outlet (arxiv.org); overlapping topics (model, token); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (control, model); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (chosen, token); pushes against this story (but).
Reported by the same outlet (arxiv.org); overlapping topics (attacker, channel); pushes against this story (against).