Description du poste
TL;DRBuilding on the method in Prompt Injection as Role Confusion, we prepend earlier label blocks, with empty contents, to the neutral-text block used to train the probe. We compare this prefix method with the original method (i.e., bare) for both probing and steering, across three models—GPT-OSS-20B, Qwen3.5-9B, and Gemma4-12B—and two datasets: the original work's PI dataset and an AgentDojo PI dataset. Prefix outperforms bare in a limited set of conditions: it reads out toolness better, and the resulting tool direction can steer PI to some extent. However, the results vary substantially across models and datasets. Overall, prefix does not show a simple common pattern or a general advantage over bare.
1. BackgroundThis work follows Prompt Injection as Role Confusion (extended blog post) and draws on two replication posts—Role confusion: sounding like the cause is indistinguishable from being it. and Steering Role Confusion—as well as CounterSteer. The original work does not provide steering results. The difference-of-means (DiM) steering in the replication posts and CounterSteer introduces other factors associated with successful and failed trajectories, so the effects cannot be attributed to role.
2. Several Steering AttemptsWe tried several steering methods. Those based on role declarations were (1) DiM steering, which mostly worked, and (2) DiM steering on templates with reversed success rates, which partly worked. Those based on labels were (3) label DiM steering, which failed, and (4) probe steering, which uses the coefficients of a probe trained on neutral text as steering directions. Its method and results are described below.
2.1 DiM from Contrasting Role DeclarationsUsing a similar approach to Steering Role Confusion and CounterSteer, we took six pairs of USER/TOOL declaration templates and applied DiM steering. It mostly worked. However, most USER-declared trajectories were successful, so the effect cannot be attributed to a role/label direction.
Figure