A preprint's main comparison found a large increase in SEP separation, a measure of whether marked content is kept apart from instructions, with little change in utility, the model's task-performance score. Across all 9,160 SEP items under the corrected rule, separation was 24.3% for the frozen model, with its base parameters left unchanged, and 99.0% with the overlay; utility was 92.3% and 92.6%, respectively.
On TensorTrust, attack-success rate, or ASR, the share of tested cases in which the attack worked, was 34.8% for hijacking in the frozen model and 6.2% with the overlay; extraction ASR was 38.1% and 5.4%. The evaluation included all 776 hijacking rows and 570 extraction rows, with Defense Validity screening limited to rows the frozen model could answer.
On PIArena's direct-attack HotpotQA and NQ comparison, the no-defense row reported 49.5% attack and 82.5% utility, while the Semantic Overlays row reported 0.5% attack and 95.1% utility. The 0.5% figure was marked as a quoted value rather than a compliance measure.
On PIArena SQuAD v2 direct attack, attack success was 97.5% for frozen Qwen3.5-9B and 0% with the overlay.
Two further comparisons were reported. Across 208 AlpacaFarm input-bearing items, attack success was 99.0% for the frozen model and 0.0% with the overlay. Across 14,441 verified Quadrat-IPI documents, compliance was 6.3% and 0.1%, respectively.
How the marking works
Semantic overlays are small learned adapters applied at chosen prefill positions, as the model initially processes an input, to the residual stream of a frozen model. The adapters are trained with cross-entropy against intended completions and no-op completions, and evaluation uses new source items.
The method was also tested as a channel for simple visual qualities. On the easy visual-mark round, an embedding-conditioned shared adapter read out 99.5% of present qualities exactly and correctly refused all absent qualities, for a 100% refusal rate.
In a separate language experiment, overlay-determined questions were answered at 100% for naming the language and listing snippets in the asserted language. Copies carrying an overlay were rewritten in that language in 97% of cases and implemented the task in 91%, while unoverlaid snippets were reproduced verbatim in 96%.
The result varied by the requested transformation. On a held-out set with roughly 35 examples per overlay, compliance ranged from 100% for refusal to 18% for haiku.
The trade-off is in exact copying
Exact copying was lower with the overlay. Among 500 held-out passages, character-exact copying was 86.6% with the overlay versus 98.4% without it. Even so, every returned span exceeded 95% character similarity, and the worst case was 98.0%.
The injection-defense adapter had 50 million parameters and was evaluated on five prompt-injection benchmarks. In one defense-aware red-team engagement, 222 adaptive black-box probes produced no successful direct authority attack. Optimization-based attacks were not tested.
A second model, with caveats
The approach was also evaluated on a frozen Llama model, but the run used an earlier data mix and was not a matched comparison. SEP separation was 31.0% for the frozen model and 96.2% with the overlay; TensorTrust hijacking ASR was 68.9% and 4.4%, and extraction ASR was 74.2% and 7.7%. All four PIArena families reached 0% attack success with the overlay.
The reproducibility statement says released code and data cover the corpus, training, serving, and three injection-defense evaluations on both base models.
Taken together, the reported comparisons show a recurring trade-off: much higher separation and lower attack success alongside less character-exact copying. The evidence does not settle how an overlay would fare against optimization-based attacks, which were not tested.
Paper data and sources
Original title: Semantic Overlays: Mitigating Prompt Injection with Annotations Beyond Tokens and Steering Vectors
Authors: Joshua Penman
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-24
DOI: Not available
Original paper · Full text