Ordinary typos can weaken a detector that reads a LLMA large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.Full definition →'s internal activity, even when the model still understands the message. In tests on Meta's Llama 3.1 8B, roughly three common typos per message reduced a single-position prompt-injection detector's true-positive rate by 12 percentage points at a fixed 1% false-positive rate. The study reports that appending a short fixed suffix and reading the internal state farther downstream reduced the remaining loss to 0.6 points. This identifies where the detector reads as a consequential design choice for robustness to typing variation.
Key takeaways · AI-distilled
The study finds that a typo can sharply alter the internal model signal used by a prompt-injection detector even when the model's visible answer barely changes. The disturbance fades within roughly ten tokenThe chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.Full definition → after the typo.
Stacking around 3 common typos in a message cuts a single-position prompt-injection probe's true-positive rate (at 1% false-positive rate) by 12 percentage points, a drop that simple recalibration cannot fix.
Reading the detector's signal across several token positions nearly removes the effect of localized typos. When disturbances are spread through the text, even this approach still loses about 3.8 percentage points of detection in the study.
For single-position probes, the authors' fix, a KV-cache fork appending a short suffix after the user message so the probe reads tokens downstream of a typo, closes 95% of the accuracy gap, far better than training the probe on typo examples.
The rotation-and-decay pattern in hidden states was confirmed across Llama-3.1-8B, Qwen3-8B, and Gemma-4-E4B, though the actual probe accuracy tests were run only on Llama-3.1-8B.
Terms in this piece · Glossary
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
articleBeyond Prompt Engineering: A Systematic Analysis of Prompt Lexical Sensitivity and Its Impacts on QualityQipeng Xie, Zi Liang, Jiafei Wu, Yufei Chen, Weizheng Wang, Wenao Ma, Zhong Ming, Haiqin Yang, Kaishun Wu
articleHow Do Prompt Variations Affect Energy Consumption in On-Device LLMs?Wei Hu, Xiaolong Tu, Dawei Chen, Yitao Chen, Kyungtae Han, Haoxin Wang
articleDo Influence Tactics Matter? Investigating Prompt Framing Effects in LLM Code GenerationAlex Deaconu, Anubhav Gupta, Manaal Basha, Nicholas Haydu, Gema Rodr\'iguez-P\'erez