Tests of a learned annotation layer recorded a sharp separation between marked data and instructions, while the paper's utility score stayed nearly unchanged. Across 9,160 SEP items, a test probe surfaced in the data in 1.0% of overlay cases, compared with 71.8% for the frozen model. Utility, the paper's measure of task performance, was 92.6% with the overlay and 92.3% without it; SEP separation was 99.0% versus 24.3%.
A second channel for marked text
The work is a preprint built around a simple distinction: readable content can carry an annotation that is not itself part of the words. The method attaches a small adapter, or add-on module, to the input of each decoder layer in a frozen Qwen3.5-9B instruct model. For the security tests, that add-on carried a do-not-execute overlay over every token of retrieved or third-party content. The base model was left untouched, and the defense was evaluated on five prompt-injection benchmarks.
Lower rates across several attack tests
The lower rates appeared across several other benchmark measures. In TensorTrust, hijacking attack success was 6.2% with the overlay versus 34.8% for the frozen model, and extraction success was 5.4% versus 38.1%. TensorTrust's Defense Validity was 96.1% with the overlay and 100% without it. AlpacaFarm attack success was 0.0% versus 99.0%, while Quadrat-IPI compliance was 0.1% versus 6.3% across 14,441 documents.
On the PIArena SQuAD v2 direct-attack panel, the frozen Qwen model had a 97.5% attack rate. The overlay condition recorded 0%, matching the 0% no-injection control.
A copying cost, but high similarity
That performance came with a measurable copying tradeoff. In 500 held-out passages, character-exact copying was 86.6% with the overlay, against 98.4% without it. Yet every returned span exceeded 95% character similarity, and the worst case was 98.0%. In practical terms, the marked passages were not always reproduced letter for letter, but the returned text remained very close to the original under the study's similarity measure.
The overlay did more than block instructions
Prompt injection was only one of four capabilities tested. The paper also examined whether several marks could be read together, whether a marked span could be reinterpreted, and whether commands could be limited to one span. Training kept the base model frozen, optimized the adapters against synthetic targets, included no-op completions and evaluated on new source items. The visual-mark comparison used 24,000 examples and 12 overlays, with easy non-overlap tests and harder stacked marks that placed up to three marks on a token.
The visual channel was strong in the easiest round: it retrieved present qualities exactly 99.5% of the time and refused absent qualities 100% of the time. On the harder round, it led every question type but one, including a 30-point lead on the hardest question. A separate code test put five snippets from 16 languages in each prompt, with one to three marked. Language naming and listing were both 100%; copies in the asserted language scored 97% and implemented the requested task 91%, while unoverlaid copies were verbatim 96%.
Performance varied with the requested transformation
Not every transformation was equally reliable. On held-out sets of 30 to 38 examples per overlay, compliance was 100% for refusal and nested bullets, 89% for all caps, 81% for German, 74% for Spanish, 67% for the explain-like-five instruction, 29% for explain-like-ten and 18% for haiku. When a transform did work, it stayed within the marked span rather than spreading to sibling spans. The instruction-grid test showed a similar boundary: trained instructions reached 50% to 85% compliance, but unseen instructions had 0 compliant cases out of 120, while held-out pointer concepts scored 95%.
A promising result with a narrow reach
The injection result also appeared in a Llama replication. SEP separation was 96.2% with the overlay versus 31.0% for frozen Llama; TensorTrust hijacking was 4.4% versus 68.9%, and extraction was 7.7% versus 74.2%. All four PIArena families recorded 0% with the overlay.
Most of the headline numbers come from one frozen model, while the Llama check adds a second model for the injection results. The figures should therefore be read as benchmark evidence from the evaluated model states and attack protocols, not as a general security guarantee. The reproducibility statement says released code and data cover the injection corpus, training, serving and evaluations on both base models, and that trained overlay sets are released for the channel experiments.
Paper data and sources
Original title: Semantic Overlays: Mitigating Prompt Injection with Annotations Beyond Tokens and Steering Vectors
Authors: Joshua Penman
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-24
DOI: Not available
Original paper · Full text