A language model perceives everything as tokens. While the serving stack knows the provenance of each span—user input, tool output, instructions—the model itself must keep track of span identity, which it can lose or confuse. Prompt injection exploits this by scrambling the model's understanding of spans, causing unwanted or dangerous behavior. To mitigate such attacks, we introduce a non‑textual input channel called Semantic Overlays: small learned adapters inserted at chosen prefill positions in a frozen model's residual stream, creating an out‑of‑band annotation channel that tokens cannot replicate. Unlike steering vectors, Semantic Overlays are trained, adaptable, and can be applied selectively. An overlay can encode rich semantics that reshape how the model perceives a marked span; for instance, when an overlay asserts that a code snippet is written in a different programming language, the model faithfully rewrites the snippet into the asserted language. Overlays are composable, allow transparent reading of the underlying content, and can carry imperative payloads—e.g., marking a span as “non‑executable” defends against broad classes of prompt injections that inject instructions in untrusted contexts. Empirical results on several prompt‑injection benchmarks show strong improvements: SEP separation rises from 24.3% to 96.5% with utility unchanged, TensorTrust attack success drops from 34.8% to 6.6%, all four PIArena attack families achieve 0% compliance, and marked spans remain highly readable with a 92.5% exact‑copy rate.
Blogger's Review: Semantic Overlays open a novel, model‑internal avenue for defending against prompt injection, preserving the model's original capabilities while leveraging out‑of‑band annotations to robustly suppress attacks. This approach merits further investigation and real‑world deployment.