AdvGuard caught multi-turn system prompt extraction at 97 to 99 percent F1 with 100 percent recall, and held exact-match leakage to 0.00 to 0.01
AspireAI community · arXiv
System prompts carry task directives, safety policies and access control, and black-box adversaries try to extract them through adaptive multi-turn conversations. AdvGuard models cross-query relationships in a bounded semantic interaction graph, filters candidate components statistically, and converts them into line graphs for graph convolutional network classification, so multi-hop similarity patterns can separate coordinated extraction from benign workflows; a lightweight prompt-level detector covers the early turns before enough history accumulates. It improves recall by up to 36 percent over the strongest baseline while keeping the false positive rate at most 3.4 percent, reaches 97.23 to 99.1 percent F1 with 100 percent recall in multi-turn workloads, and on leave-one-attack-family-out tests posts 99.98 percent mean recall and 99.99 percent mean F1 with no observed false positives; inside the PLeak and LeakAgent attack loops it holds exact-match leakage to 0.00 to 0.01 and substring-match leakage to 0.01 to 0.09. The limit: these are the authors' own evaluations against their own attack suite, and the held-out-family false-positive claim is reported as no observed false positives rather than as a bounded rate.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.