CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering

arXiv:2609.36570 · cs.CR, cs.AI · Submitted 2026-09-29 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-29

Updated: 2026-09-29

Terminology

• Steering — 51× in this paper · explained in 2 episodes
• Provenance — 28× in this paper · explained in 4 episodes
• Benchmark — 26× in this paper · explained in 2 episodes
• Fidelity — 15× in this paper · explained in 2 episodes
• Decode — 10× in this paper · explained in 2 episodes
• AUC — 8× in this paper · explained in 2 episodes
• Activation Steering — 6× in this paper · explained in 4 episodes
• Fine-Tuning — 6× in this paper · explained in 5 episodes
• Generalization — 6× in this paper · explained in 13 episodes
• Robustness — 6× in this paper · explained in 5 episodes
• Adaptation — 4× in this paper · explained in 1 episode
• Association for Computational Linguistics — 4× in this paper
• International Conference on Learning Representations — 4× in this paper
• Pruning — 4× in this paper · explained in 4 episodes
• Trace — 4× in this paper · explained in 2 episodes
• International Conference on Machine Learning — 3× in this paper
• LLM judge — 3× in this paper · explained in 2 episodes
• AI Agents — 2× in this paper · explained in 2 episodes
• AUROC — 2× in this paper · explained in 2 episodes
• Accuracy — 2× in this paper · explained in 1 episode
• Alignment — 2× in this paper · explained in 1 episode
• Consistency — 2× in this paper · explained in 3 episodes
• Data Provenance — 2× in this paper · explained in 2 episodes
• Embeddings — 2× in this paper · explained in 2 episodes
• Linear probe — 2× in this paper · explained in 2 episodes
• Representation Engineering — 2× in this paper · explained in 2 episodes
• Ablation — 1× in this paper · explained in 1 episode
• Activation Addition — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Agentic Evaluation — 1× in this paper · explained in 1 episode
• Conference on Secure and Trustworthy Machine Learning — 1× in this paper
• Core — 1× in this paper · explained in 2 episodes
• Interpretability — 1× in this paper · explained in 15 episodes
• Quantization — 1× in this paper · explained in 12 episodes
• Verifier — 1× in this paper · explained in 2 episodes

Sources

• Defending Against Indirect Prompt Injection Attacks With Spotlighting
• StruQ: Defending Against Prompt Injection with Structured Queries
• SecAlign: Defending Against Prompt Injection with Preference Optimization
• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection
• ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
• ARGUS: Defending Against Multimodal Indirect Prompt Injection via Steering Instruction-Following Behavior
• Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States
• CachePrune: Teaching LLMs What Not to Follow via KV-Cache Editing
• Steering Instruction Hierarchies at Inference Time
• Universal and Transferable Adversarial Attacks on Aligned Language Models
• LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge
• AutoDojo: A Generative Benchmark for Evaluating Prompt Injection Defenses in LLM Agents
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
• Steering Language Models With Activation Engineering
• Steering Llama 2 via Contrastive Activation Addition
• Refusal in Language Models Is Mediated by a Single Direction
• gpt-oss-120b & gpt-oss-20b Model Card
• Qwen3 Technical Report
• InjecGuard: Benchmarking and Mitigating Over-defense in Prompt Injection Guardrail Models
• AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs