Large language models (LLMs) are increasingly used in interactive and retrieval-augmented systems, but they remain vulnerable to task drift; deviations from a user's intended instruction due to injected secondary prompts. Recent work has shown that linear probes trained on activation deltas of LLMs' hidden layers can effectively detect such drift. In this paper, we evaluate the robustness of these detectors against adversarially optimised suffixes. We generate universal suffixes that cause poisoned inputs to evade detection across multiple probes simultaneously. Our experiments on Phi-3 3.8B and Llama-3 8B show that a single suffix can achieve high attack success rates; up to 93.91% and 99.63%, respectively, when all probes must be fooled, and nearly perfect success (>90%) under majority vote setting. These results demonstrate that activation delta-based task drift detectors are highly vulnerable to adversarial suffixes, highlighting the need for stronger defences against adaptive attacks. We also propose a defence technique where we generate multiple suffixes and randomly append one of them to the prompts while making forward passes of the LLM and train logistic regression models with these activations. We found this approach to be highly effective against such attacks.

翻译：大型语言模型（LLMs）在交互式和检索增强系统中日益普及，但它们仍然容易受到任务漂移的影响；即由于注入的次要提示导致偏离用户预期指令。近期研究表明，基于LLMs隐藏层激活增量的线性探针可以有效检测此类漂移。本文评估了这些检测器对抗对抗性优化后缀的鲁棒性。我们生成了通用后缀，使中毒输入能够同时规避多个探针的检测。我们在Phi-3 3.8B和Llama-3 8B上的实验表明，单个后缀即可实现高攻击成功率：当需要欺骗所有探针时，分别达到93.91%和99.63%；在多数投票机制下成功率接近完美（>90%）。这些结果表明，基于激活增量的任务漂移检测器极易受到对抗性后缀的攻击，凸显了针对自适应攻击需要更强防御机制的必要性。我们还提出一种防御技术：通过生成多个后缀并随机附加其中之一到提示中，同时进行LLM的前向传播，并利用这些激活训练逻辑回归模型。我们发现该方法对此类攻击具有高度有效性。