Quirin Schlegel

Work Writing Vault Six-Pagers Newsletter Contact

AI Engineer · Quirin SchlegelBerlin · 2026.10

Loading

© 2026 Quirin Schlegel · Built in public

Writing Vault Six-Pagers Newsletter RSS Conformity Privacy

GitHub LinkedIn X Email

It already knows — the injection signal your API does not return

The detection signal for indirect prompt injection already exists inside the model, published and reproducible; the clause that binds an EU deployer today is not AI Act Article 15 but the state-of-the-art ratchet in GDPR Article 32(1) and NIS2 Article 21(1).

7 August 20267 verified claims6 sources

Your agent already knows it has been injected. It carries out the attack anyway.

That is the finding in a paper posted to arXiv on 1 August.

The setup is the real one: indirect prompt injection — a malicious side-task hidden in a tool result, not in the user's message. Researchers trained simple linear probes on the model's hidden states, read before it generates anything. Across six models, including a 753B-parameter one, those probes predict injection exposure at 90%+ AUROC — on attacks and task suites the probe had never seen, and holding under adaptive attacks.

So the signal is there. Cheap, linear, pre-generation.

Then the part that should change your architecture, not your compliance slide. The authors call it a recognition–action gap: the model encodes that it is under attack and completes the injected task regardless. Knowing and refusing are different circuits. Their fix gates an anti-injection reasoning step on the probe firing — attack success on one model on hard AgentDojo settings drops from 34.6% to 0%.

Now the European part — not the article you expect.

Everyone reaches for AI Act Article 15(5) — resilience against "inputs designed to cause the AI model to make a mistake". The Digital Omnibus deferred stand-alone high-risk obligations to December 2027. Article 15 is not your problem this month.

What is: GDPR Article 32(1) and NIS2 Article 21(1). Both require measures "taking into account the state of the art". That phrase is a ratchet. It has no fixed content — it means whatever is currently published and reproducible.

A public paper showing 90%+ detection from a linear probe is exactly what moves it.

What I'd do Monday:

1. Log provenance per tool result — which retrieved document carried which instruction, per call. Without it, "we saw nothing" is not evidence.

2. If you self-host, a probe on hidden states is a weekend, not a roadmap. You already have the activations. Closed APIs do not hand them to you.

3. Ask your model vendor, in writing, whether they expose any injection-exposure signal. The answer, or the silence, is your documentation either way.

4. Stop treating "the model refused" as the control. Recognition and refusal came apart in the measurements.

The uncomfortable version: after 1 August it is harder to argue this class of attack was undetectable.

What would you be able to show, three months later?

#AgenticAI #PromptInjection #NIS2 #EUAIAct #AIEngineering

AI disclosure: the narration voice and the cover art in this video are AI-generated. The script, the claims and the source checks are mine.

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

Simple linear probes trained on pre-generation hidden states predict an agentic LLM's indirect-prompt-injection exposure, achieving 90%+ AUROC on unseen attacks, agent instructions and task suites across six models including the 753B-parameter GLM-5.2.
Why it mattersA linear probe on hidden states is cheap to train and cheap to run. If you serve your own weights the detector is already reachable; if you call a closed API the same signal exists and is not returned to you. That asymmetry decides which teams can build this control at all.
arxiv2026your
The same work reports a recognition–action gap: models encode the injection-exposure signal yet often fail to translate it into safe actions.
Why it mattersIt removes 'the model will refuse' as a design assumption. Recognition and refusal are separable, so a guardrail that relies on the model noticing is relying on the half of the behaviour that was measured to hold, not the half that acts.
arxiv2026your
AGRI, a probe-gated reasoning defence that prepends anti-injection reasoning on demand, reduces attack success rate from 34.6% to 0% on Qwen3.5-27B on difficult AgentDojo settings while largely maintaining clean-task utility.
Why it mattersIt shows the gap is closable with an ordinary engineering move — gate an extra reasoning pass on a detector — rather than a new model. That makes it a reasonable thing for a regulator or an auditor to expect of a deployer.
arxiv2026your
GDPR Article 32(1) requires the controller and processor to implement appropriate technical and organisational measures 'taking into account the state of the art', making the required security baseline a moving standard rather than a fixed one.
Why it mattersThe GDPR security baseline is indexed to published practice, not to a fixed checklist. Every reproducible detection result narrows what an organisation can call unforeseeable after the fact.
intersoftco2026security
NIS2 Article 21(1) requires essential and important entities to take appropriate and proportionate measures taking into account 'the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation'.
Why it mattersThe same ratchet reaches entities that hold no personal data at all, and it reaches them through a different authority. A team that has scoped its obligations only under the GDPR will miss it.
nisdirectiv2022cybersecu
AI Act Article 15(5) requires high-risk AI systems to be resilient against attempts by unauthorised third parties to alter their use, outputs or performance, and names 'inputs designed to cause the AI model to make a mistake (adversarial examples)' among the attacks to be prevented and detected.
Why it mattersIt is the article most teams reach for and, for stand-alone high-risk systems, the one that does not bind yet. Knowing which clause is live this month is the difference between a control you must build now and one you may schedule.
euaiactexpl2026accuracy · eurlex2026regulatio
A second injection-defence paper, AgentAntibody, was submitted to arXiv on 4 August 2026, three days after the probing work, proposing a persistent library of learned defences that evolves across encounters.
Why it mattersOne paper is a result; two independent defences inside a week is the state of the art visibly moving. That movement, not either paper, is what the legal standard tracks.
arxiv2026agentanti

Sources

EU AI Act Explorersecondary
Accuracy, robustness and cybersecurity (Article 15)
Original Archived PDFretrieved 10 October 2026 · published 1 January 2026
EUR-Lexprimary source
Regulation (EU) 2026-1744 (Digital Omnibus on AI)
Original Archived PDFretrieved 13 October 2026 · published 27 July 2026
Intersoft Consultingsecondary
Security of processing — Art. 32 GDPR
Original Archived PDFretrieved 6 September 2026 · published 25 May 2026
NIS-2-Directive.comsecondary
NIS-2-Directive.com - Cybersecurity risk-management measures — NIS 2 Directive Article 21
Original Archived PDFretrieved 7 August 2026 · published 27 December 2022
arXivprimary source
arXiv - AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection
Original Archived PDFretrieved 7 August 2026 · published 4 August 2026
arXivprimary source
arXiv - Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure
Original Archived PDFretrieved 7 August 2026 · published 1 August 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

Author affiliations for arXiv 2608.02657 are not printed on the arXiv abstract page, and the HTML render at arxiv.org/html/2608.02657v1 returned HTTP 429 on every attempt during this run. No institution is attributed anywhere in this edition; the post says "researchers". Every figure quoted comes from the paper's own abstract.

The state-of-the-art wording in GDPR Article 32(1) and NIS2 Article 21(1) is quoted from third-party reproductions of the instruments, not from the Official Journal. An attempt to confirm NIS2 Article 21(1) against EUR-Lex CELEX:32022L2555 reached only the recitals before the extraction limit. Both claims are flagged secondary-sourced in the claims index.

The 34.6% to 0% figure is the paper's own worked example on one model (Qwen3.5-27B) on difficult AgentDojo settings. It is not a mean across the benchmark and is not presented as one.