Players who were attacked with prompt injections reused those exact attacks against other people within a week, and 23 percent of successful hijacks in the data traced back to text the target had already seen
AspireAI community · arXiv
Every security team that shows a company the prompt injection that broke them is also handing that company a reusable weapon, because an injection is just text. A new working paper measures how much that matters in the wild, using all 563,349 attack records from Tensor Trust, an online game where players defend LLM-guarded accounts and can read every attack they receive.
Reuse followed success, not visibility. Within a week, targets fired back with 10.0% of the attacks that had broken their defence, against 0.03% for matched attacks that had circulated among similar players but never reached them. Near-misses that looked like a win were reused no more often than flat failures, which says reuse tracked whether an attack paid off rather than how its reply read. Defence changes also worked: after a breach, same-family attacks became 24.5 percentage points less successful against that target. And previously received texts accounted for 23.2% of the successful hijacks in the analysis.
The authors draw a design conclusion rather than a policy: describe the technique without reproducing the full text. The caveat is that this is one game with its own incentives, and the paper is explicitly a working paper whose disclosure recommendations are framed as testable hypotheses.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.