Comparative Analysis of Internal Signals for Prompt Injection Detection

This study evaluates five internal representation-reading methods—including residual-stream probes and attention scores—on Qwen3.6 and Gemma-4 models. The analysis identifies how different signals vary in their ability to distinguish injected prompts from benign controls in indirect injection scenarios.