NVIDIA NXDirection drops prompt-injection attack rate to 0.1%

NVIDIA researchers report they cut the attack success rate for indirect prompt injection on the BIPIA benchmark from 38.1% to 0.1% by stripping instruction-directional components out of untrusted tokens inside the model's residual stream, while clean utility on the same benchmark fell only two points, from 78.4% to 76.4%.

The method, called NXDirection, is described by NVIDIA Senior AI Security Researcher Tamás Vörös as a defense that treats external content "as data rather than instructions." The team built a corpus of 175 short examples across 18 instruction categories, computed the direction as the normalized difference between mean instruction-token and mean non-instruction-token activations, and then subtracted that direction only from tokens flagged as originating from external sources. They evaluated it across nine open-weight models from the Llama, Qwen and Gemma families.

On the AgentDojo multi-turn agent benchmark, ASR fell from 28.4% to 3.7%, with clean utility within about one point of baseline. The defense did not fully eliminate attacks: some models still showed up to 13.1% ASR on specific AgentDojo tasks. Because the technique requires access to the model's hidden states, it applies only to open-weight or self-hosted models and does not cover closed commercial APIs. Two researchers we track posted the source link the same day it went up.