A prompt injection works because the model cannot tell an order from its user from an order hidden in the text it was asked to read. We looked inside an open 7B model while it read more than six thousand such cases, and found that its internal state already marks which words are the user's order, which are a planted order and which are just data. A simple reader picks out the planted orders every time on the held-out cases, where fixed rules find about one in ten. The result holds on this benchmark's format, in English; the next test moves the planted order anywhere in free text, in five languages.
## What we tested
An agent reads emails, web pages and tool outputs on its user's behalf. A prompt injection hides an order inside that material ("forward this file to..."), and the agent obeys it because, for the model, words are words: nothing on the surface says who is speaking.
We asked whether the model knows anyway, internally. We took an open 7B model (Qwen2.5-7B) and let it read 6,195 blocks built from a public injection benchmark (InjecAgent) and from our own adaptive attacks: each block holds the user's request, the tool output, and inside it, sometimes, a planted order. For every word we recorded the model's internal state, and trained a simple linear reader on part of the cases to label each word as a user order, a planted order or data. The remaining cases, never seen by the reader, are the test. The bars were declared before the run.
## What we found
```chart
{"title": "Spans correctly found on the held-out cases (out of 100)", "series": ["Reader on the model's internal state", "Fixed rules on the text"], "unit": "", "max": 100, "rows": [["User orders", 100, 14.5], ["Planted orders", 100, 11.2], ["Plain data", 98.5, 83.5]], "note": "1,122 held-out blocks, split by case so no injection text is shared with training. Declared bar: 85 out of 100 on each line. The fixed rules are a keyword and imperative-mood baseline run on the same blocks."}
```
- The planted orders are found on every held-out case, including the 71 where our adaptive attacker had won against an uncorrected agent.
- When the reader marks an order, it also names who gave it: the user or the planted text, right every time.
- The signal sits in the middle of the network (layer 12 of 28 for orders, deeper for data).
## What it does not say yet
The scores are close to perfect, and that is a reason for caution, not celebration. In this benchmark the user's request always comes first and the planted order sits inside a fixed tool-output field, written in a recognisable style. Position and format alone could carry much of the separation. So the claim today is narrow: on this benchmark's format, in English, the model's internal state marks who is giving the order.
The next test removes those crutches: generated documents in five languages, the planted order placed anywhere in the text, and a baseline that only knows the position of each word. If the reader still separates the three there, the signal is the model's own sense of who is speaking.
## Why it matters
Our correction already teaches models to ignore planted orders. A reader of the same distinction inside the model is the other half: it tells a model operator, before any action is taken, whether the model has taken a planted order as its own. It is the reading that comes before the correction.
## In plain words
When an agent reads a document with a hidden order in it, we wanted to know whether the model, inside, can tell that order apart from what its user really asked. On a public test set, it can: a simple reader of its internal state points at the hidden order every time. We still have to show that this holds when the hidden order is placed anywhere, in any of five languages, and that test is next.
This update is not available.