Prompt-injection detectors are not robust to adaptive attackers - a universal optimised suffix fools all layer-wise detectors at once

An injection detector works in evaluation and fails in the wild, and the failure mode is worse than an occasional miss: the attacker optimises against the detector specifically and defeats every layer simultaneously while keeping the injection fully effective.

The paper targets detectors built on activation shifts from the LLM's hidden layers - a popular design because it needs no second model. It shows these are not robust to adaptive adversaries: a multi-probe evasion attack appends an adversarially optimised suffix to poisoned inputs, jointly optimising a UNIVERSAL suffix that simultaneously fools all layer-wise drift detectors while preserving the effectiveness of the underlying injection, using a modified Greedy Coordinate Gradient search. The implication is structural: a detector whose input is the representation the attacker can influence is not a control, because the attacker optimises against exactly that representation.

Do not deploy a representation-drift detector as your primary injection control. If you run one, assume the attacker knows about it and measure against an adaptive attack, not a static one. Prefer controls that do not depend on the model's internal state at all - capability scoping and index-time filtering have no gradient to optimise against.

SCHEME RECLASSIFIED (2026-10-04): was 'framework'. This is the honest limit on the whole detector family, and it is why the architectural records are the ones to act on. 'Universal' is the load-bearing word: the suffix transfers, so the cost of attacking is amortised across all poisoned inputs rather than paid per input.