PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis

arXiv:2607.12624 · cs.CR · Submitted 2026-07-14 · Read on arXiv

Junhui Wang, Hangtao Zhang, Zhirun Zheng, Li Zeng, Jiejun Xiao, Xi Luo, Lihua Yin, Saiqin Long

cs.CR

Submitted: 2026-07-14

Comments: Accepted to ACM MM 2026. Code: https://github.com/Claresigle/PVDetector

Code: https://github.com/Claresigle/PVDetector

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Alignment — 11× in this paper · explained in 1 episode
• Generalization — 5× in this paper · explained in 13 episodes
• Transferability — 5× in this paper · explained in 4 episodes
• False Negative Rate — 4× in this paper
• Robustness — 4× in this paper · explained in 5 episodes
• Training-Free Framework — 4× in this paper · explained in 2 episodes
• Adversarial Examples — 3× in this paper · explained in 2 episodes
• Attention Mechanism — 3× in this paper · explained in 3 episodes
• Interpretability — 3× in this paper · explained in 15 episodes
• Large Language Models (LLMs) — 3× in this paper · explained in 6 episodes
• Latent Representation — 3× in this paper · explained in 2 episodes
• Vision-language models — 3× in this paper · explained in 2 episodes
• Adam — 2× in this paper · explained in 2 episodes
• Adversarial Attacks — 2× in this paper · explained in 1 episode
• Benchmarking — 2× in this paper · explained in 4 episodes
• Consistency — 2× in this paper · explained in 3 episodes
• Contrastive Learning — 2× in this paper · explained in 5 episodes
• Core — 2× in this paper · explained in 2 episodes
• Entanglement — 2× in this paper · explained in 4 episodes
• Greedy Coordinate Gradient — 2× in this paper
• Steering — 2× in this paper · explained in 2 episodes
• Trace — 2× in this paper · explained in 2 episodes
• AI Agents — 1× in this paper · explained in 2 episodes
• Activation Addition — 1× in this paper · explained in 1 episode
• Adaptation — 1× in this paper · explained in 1 episode
• Adversarial Training — 1× in this paper · explained in 1 episode
• Benchmark — 1× in this paper · explained in 2 episodes
• Distillation — 1× in this paper · explained in 2 episodes
• Elias — 1× in this paper · explained in 2 episodes
• False Positive Rate — 1× in this paper
• Fine-Tuning — 1× in this paper · explained in 5 episodes
• Foundation Model — 1× in this paper · explained in 3 episodes
• Foundation Models — 1× in this paper · explained in 7 episodes
• Latent Space — 1× in this paper · explained in 7 episodes
• Loss Function — 1× in this paper · explained in 2 episodes
• National Institute of Standards and Technology — 1× in this paper
• Open Web Application Security Project — 1× in this paper
• Optimal Transport — 1× in this paper · explained in 5 episodes
• Perplexity — 1× in this paper · explained in 3 episodes
• Quantum Physics — 1× in this paper · explained in 11 episodes
• Reinforcement Learning — 1× in this paper · explained in 4 episodes
• Representation Engineering — 1× in this paper · explained in 2 episodes
• Score Function — 1× in this paper · explained in 4 episodes
• Semantic Gap — 1× in this paper · explained in 2 episodes
• Transformer — 1× in this paper · explained in 2 episodes
• Verification — 1× in this paper · explained in 2 episodes
• World Model — 1× in this paper · explained in 7 episodes

Sources

• Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone
• Detecting Language Model Attacks with Perplexity
• Defending Against Prompt Injection With a Few DefensiveTokens
• Securing AI Agents with Information-Flow Control
• Defeating Prompt Injections by Design
• Empirical Analysis of Large Vision-Language Models against Goal Hijacking via Visual Prompt Injection
• The Llama 3 Herd of Models
• A Critical Evaluation of Defenses against Prompt Injection Attacks
• Prompt Injection attack against LLM-integrated Applications
• Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignment
• Progent: Securing AI Agents with Privilege Control
• The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
• Robot Collapse: Supply Chain Backdoor Attacks Against VLM-based Robotic Manipulation
• Meta Prompting for AI Systems
• Representation Engineering: A Top-Down Approach to AI Transparency
• Universal and Transferable Adversarial Attacks on Aligned Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs