A Better Newspaper

A growing body of work targets prompt injection attacks on LLM-based classifiers and agents, spanning defenses, formal enforcement, and adversarial evaluation of agentic safety. Label Disguise Defense (LDD) proposes relabeling classifier outputs (e.g., replacing "positive/negative" with "good/bad" or arbitrary tokens like "cat/dog") introduced via demonstrations, then mapping predictions back to original classes, tested on 200 IMDb sentiment reviews under injection attacks (arXiv:2511.21752, October 14). In a related but distinct direction, "Formal Policy Enforcement for Agentic Systems" proposes runtime monitoring where users specify security policies in Datalog, enforced via constructed event graphs to block disallowed agent actions before execution, addressing the coarse-grained, non-formal nature of prior agentic security mitigations (arXiv:2602.16708, October 14). A third study examines whether delayed, multi-turn prompt injection can induce a safety-critical agent to actively cause harm: using a NASA-derived BioSim lunar habitat simulation, researchers tested whether an AI operator tasked solely with keeping humans alive could be persuaded — via a delayed injection appended to otherwise truthful telemetry the operator must read — to abandon its life-support duties, with the attacker unable to falsify sensors or directly operate equipment and instead relying purely on persuasion (arXiv:2610.15153, October 14). **Key Entities/Methods:** - Label Disguise Defense (LDD) — classifier-level defense via output relabeling (arXiv:2511.21752) - Formal Policy Enforcement for Agentic Systems — Datalog-based runtime policy monitoring via event graphs (arXiv:2602.16708) - BioSim lunar habitat simulation — testbed for delayed multi-turn "derived-action trap" attacks on a keep-alive agent (arXiv:2610.15153) **Implications:** Collectively these papers show the field moving beyond single-turn jailbreak detection toward (1) lightweight classifier-level defenses, (2) formal, policy-based runtime enforcement, and (3) adversarial stress-testing of agents in simulated high-stakes/safety-critical environments — suggesting growing concern that agentic systems with real-world control authority (e.g., life support) may be manipulated through persuasion alone rather than direct system compromise. **Connections:** Related to broader narratives on LLM agent safety, AI alignment under adversarial pressure, and autonomous systems in critical infrastructure. **Section Relevance:** AI/Tech (high), Security, Research/Science