Elamur Research⌕
☰
home / papers / 2026 / RAP-ID: Mechanistic Prompt Injection Detection via Impostor Behavior Analysis

RAP-ID: Mechanistic Prompt Injection Detection via Impostor Behavior Analysis

Paper · 2026 · Yuchen Yang, Lei Peng, Yujie He et al.

Summary

Prompt injection lets adversarial user text override an LLM's system instructions. Typical defenses either run a separate guardrail model, which adds inference cost, or rely on internal heuristics such as perplexity or attention, which often misfire on complex benign requests. The authors argue that any successful injection must act as an "impostor": it imitates the authority of the system prompt and pulls the model's attention away from it. RAP-ID turns this idea into a training-free detector. It inspects internal states during the single pre-fill pass and needs no text generation. It combines three probes:

  • Directive Likeness: how close user-token Key vectors are to a system-prompt centroid.
  • Counterfactual Gain: the ratio of attention paid to user tokens versus system tokens.
  • Policy Conflict: surges in the predicted probability of risk-vocabulary tokens.

The authors evaluate it on BIPIA, InjecAgent and other benchmarks, mainly with Qwen models. They report competitive F1, low false-positive rates and clear gains over heuristic detectors, at small latency cost. This makes it attractive for real-time and agentic systems where a second guardrail model is too expensive.

Key points

  • Directive Likeness anchor: the "System Anchor" is the centroid of Key vectors from 50 diverse system prompts. It is taken from middle-to-late layers, e.g. layers 12 and 24 for Qwen3-8B, with a margin δ of 0.04 for 8B models and 0.08 for 1.5B models.
  • Policy Conflict vocabulary: it uses about 2,000 risk tokens, partly drawn from Hurtlex and aligned with standard safety taxonomies. The score weights the probability surge 4:1 over absolute probability.
  • Cross-lingual robustness: across 14 languages, attacks raised the probability of the English token "bomb" more than its native translation (German: Δ 6.06 vs 3.60). This lets the English-only vocabulary also catch multilingual and Leetspeak attacks.
  • Cross-architecture transfer: on the deepset benchmark, AUROC was 0.876 for Qwen3-8B, 0.757 for Llama-3.2-3B, 0.738 for Gemma-3-4b and 0.709 for Phi-4-mini. Latency was 71–125 ms. Only the anchors were re-extracted, which takes about 2 minutes per model, and fusion weights were reused.
  • Limitations: the detector may flag benign academic discussion of sensitive topics. Robustness to adaptive white-box attacks has only been checked in a preliminary way.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 1Research subjects and languages the work is about.Interpretability · 149 works

Cite

Cite as Yuchen Yang, Lei Peng, Yujie He, Yang yu, Zhongxin Wu and Yanlei Shi. 2026. RAP-ID: Mechanistic Prompt Injection Detection via Impostor Behavior Analysis. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.738

@inproceedings{yang2026rap,
  title = {{RAP-ID: Mechanistic Prompt Injection Detection via Impostor Behavior Analysis}},
  author = {Yuchen Yang, Lei Peng, Yujie He, Yang yu, Zhongxin Wu and Yanlei Shi},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.738},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.738}
}

References

25 references, 11 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Elisa Bassignana, Valerio Basile, and Viviana Patti. 2018. Hurtlex: A multilingual lexicon of words to hurt. In Proceedings of the Fifth Italian Conference on Computational Linguistics (CLiC-it 2018), pages 52–57, Turin, Italy. CEUR Workshop Proceedings.
  2. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. Agentpoison: Red-teaming LLM agents via poisoning memory or knowledge bases. arXiv preprint arXiv:2407.12784. — [arXiv:2407.12784](https://arxiv.org/abs/2407.12784) find
  3. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Masterkey: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715. — [arXiv:2307.08715](https://arxiv.org/abs/2307.08715) find
  4. Yann Dubois, Balázs Galambosi, Percy Liang, and Tatsunori B. Hashimoto. 2024. Length-controlled alpacaeval: A simple way to debias automatic evaluators. arXiv preprint arXiv:2404.04475. find
  5. Kuo-Han Hung, Ching-Yun Ko, Ambrish Rawat, I-Hsin Chung, Winston H. Hsu, and Pin-Yu Chen. 2024. Attention tracker: Detecting prompt injection attacks in LLMs. arXiv preprint arXiv:2411.00348. find
  6. Huseyin Inan and 1 others. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674.
  7. Andreas Köpf, Yannic Kilcher, Dimitri von Rütte, Sotiris Anagnostidis, Zhi-Rui Tam, Keith Stevens, Abdullah Barhoum, Nguyen Minh Duc, Oliver Stanley, Richárd Nagyfi, Shahul ES, Sameer Suri, David Glushkov, Arnav Dantuluri, Andrew Maguire, Christoph Schuhmann, Huu Nguyen, and Alexander Mattick. 2023.… — OpenAssistant Conversations — Democratizing Large Language Model Alignment
  8. Xian Li and 1 others. 2025. Melon: Indirect prompt injection defense via masked re-execution and tool comparison. arXiv preprint arXiv:2502.05174. — [arXiv:2502.05174](https://arxiv.org/abs/2502.05174) find
  9. Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu. 2023. Prompt injection attack against LLM-integrated applications. arXiv preprint arXiv:2306.05499.
  10. Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu. 2024. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24).
  11. Yue Liu, Yanjie Zhao, Yunbo Lyu, Ting Zhang, Haoyu Wang, and David Lo. 2025. “your AI, my shell”: Demystifying prompt injection attacks on agentic AI coding editors. arXiv preprint arXiv:2509.22040. — [arXiv:2509.22040](https://arxiv.org/abs/2509.22040) find
  12. National Institute of Standards and Technology. 2023. Artificial intelligence risk management framework (ai rmf 1.0). Technical Report NIST AI 100-1, National Institute of Standards and Technology. find
  13. OpenAI. 2026. Moderation (openai api documentation). Online documentation. Accessed 2026-01-06. find
  14. Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. 2023. Identifying the risks of LM agents with an LM-emulated sandbox. arXiv preprint arXiv:2309.15817.
  15. Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin. 2024. Do-not-answer: Evaluating safeguards in LLMs. In Findings of the Association for Computational Linguistics: EACL 2024, pages 896–911.
  16. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does LLM safety training fail? arXiv preprint arXiv:2307.02483.
  17. Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, and 1 others. 2022. Taxonomy of risks posed by language models. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparenc… find
  18. An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, and 43 others. 2024. Qwen2 technical report. arXiv preprint arXi… find
  19. An Yang and 1 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  20. Zheng Yi, Yao Li, Anlin Qiu, Zecheng Hu, Junfeng Yao, Hongsong Zhu, Chao Zhang, and Tao Wang. 2025. BIPIA: Benchmarking and defending against indirect prompt injection attacks for LLM-integrated applications. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KD… find
  21. Xiaohan Yuan, Jinfeng Li, Dongxia Wang, Yuefeng Chen, Xiaofeng Mao, Longtao Huang, Hui Xue, Wenhai Wang, Kui Ren, and Jingyi Wang. 2024. S-eval: Automatic and adaptive test generation for benchmarking safety evaluation of large language models. arXiv preprint arXiv:2405.14191. — [arXiv:2405.14191](https://arxiv.org/abs/2405.14191) find
  22. Xiaojun Zhan, Yizhou Chi, Zhenhao Liu, Shaohan Huang, Zhao Xu, Shiqi Wang, Yu Wang, Ruiyi Zhang, Zhipei Wu, Xu Chen, and Liang Zhao. 2024. Injecagent: Benchmarking indirect prompt injections for tool-integrated large language model agents. In Findings of the Association for Computational Linguistics… find
  23. Haiquan Zhao and 1 others. 2025. Qwen3guard technical report. arXiv preprint arXiv:2510.14276.
  24. Haonan Zhou, Yutian Lin, and 1 others. 2024. UniBias: Unveiling and mitigating LLM bias through internal attention and FFN manipulation. In Advances in Neural Information Processing Systems (NeurIPS). find
  25. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/yang-2026-rap-id-mechanistic-prompt-injection/