The Agent Trust Stack Gets Measurable: Injection, Leakage and Watermarks

Stopping injected instructions without breaking the model

In a preprint, researchers proposed Heads of Security, an approach that implements instruction-data separation through learned attention gates, defending against prompt injection without the utility loss common in fine-tuning-based methods. The reported numbers are striking: the defense reduced attack success rates to 10% on GPT-OSS-20B under an attack called RL-Hammer, compared with 97% for the base model and 85% for SecAlign, a fine-tuning baseline. White-box attacks required three times more compute to reach the same attack success rate on protected models as on the base model or SecAlign, and the approach preserved base-model utility across standard benchmarks, whereas SecAlign and ASIDE degraded in few-shot settings. m:…3494

The architectural claim matters for agent builders because agents are exposed to untrusted content by design: web pages, documents, tool outputs and user pastes all arrive as data that a model might mistake for instructions. A defense that works at the attention layer rather than through additional fine-tuning is attractive because it avoids retraining costs and utility trade-offs, though the preprint results come from benchmark attacks rather than production adversaries, and builders should validate against their own threat models before relying on any single defense. m:…3494

Catching leakage across conversations, not single queries

In a preprint, researchers addressed a different attack surface: query-based system prompt leakage, in which an attacker extracts a system's hidden instructions over many turns rather than a single revealing question. Their framework, AdvGuard, models cross-query relationships using a bounded semantic interaction graph to detect coordinated extraction attempts, and it improved recall by up to 36% over the strongest baseline in mixed-query evaluations. In leave-one-attack-family-out tests, designed to simulate unseen attacks, the framework achieved 99.98% mean recall and 99.99% mean F1, which the authors present as evidence of generalization beyond known attack patterns. m:…1898

A related preprint tackles the auditing side of the same problem. PrivacyEvalClaw is a tool-augmented, deliberative agent for auditing privacy leakage in jailbreak responses, built on the observation that existing evaluator models disagree substantially in ambiguous privacy cases. By gathering evidence and reconciling conflicting signals, the agent achieved higher win rates against competing baselines in privacy leakage detection and produced explicit reasoning traces that improve the transparency and auditability of evaluations. For safety teams, the pair of papers points toward defense in depth: detect coordinated extraction while it happens, and audit what escaped with a traceable record afterward. m:…9361

Watermarking has a fairness gap

In a preprint, a fourth team examined AI content watermarking, which is increasingly treated as provenance infrastructure, and found that watermark signal strength, detectability and robustness depend on statistical properties of the content itself, which vary systematically across languages, cultural visual traditions and demographic groups. Current major watermarking benchmarks across modalities fail to report performance across languages, cultural content types or population groups, the authors found, which means a watermarking system can look reliable in aggregate while failing unevenly in deployment. The authors propose integrating watermarking into the pluralistic alignment pipeline and holding it to the same bias auditing requirements applied to generative AI models. m:…5940

The watermarking finding reframes provenance as a fairness question, not just a detection question. If a system authenticates some content reliably and other content poorly, the users whose content is least detectable bear the cost, whether through false flags or missed attribution. For founders building provenance features, the preprint argues for disaggregated reporting by language and content type before deployment, and for treating watermark evaluation with the same rigor as model evaluation. All four preprints are early-stage results, and their benchmark numbers should be confirmed in production settings, but together they give agent builders a measurable trust stack: block injected instructions, detect coordinated leakage, audit privacy escapes, and check that provenance works evenly. m:…5940 m:…3494