NVIDIA NXDirection Cuts Indirect Prompt Injection Success to 0.1%

What NVIDIA reported

NVIDIA's AI security researchers say they have found a way to make open-weight language models much less likely to follow instructions hidden in untrusted content. The technique, called NXDirection, cut the attack success rate (ASR) for indirect prompt injection on the BIPIA benchmark from 38.1% to 0.1%. Clean utility on the same benchmark dropped only slightly, from 78.4% to 76.4%.1

The method doesn't filter text before it reaches the model. Instead, it works inside the model's residual stream. The team assembled 175 short examples covering 18 categories of instructions. From those, they computed an "instruction direction": the normalized difference between the average activations of instruction tokens and non-instruction tokens. That direction is then subtracted only from tokens marked as coming from external sources.1 Senior AI Security Researcher Tamás Vörös describes the goal as making the model treat outside content as data, not as commands.1 The team tested the method on nine open-weight models from the Llama, Qwen and Gemma families.1

The second benchmark is less impressive but probably more important. On AgentDojo, a multi-turn agent benchmark, ASR fell from 28.4% to 3.7%, and clean utility stayed within about a point of baseline.1 Some models still allowed up to 13.1% ASR on specific AgentDojo tasks.1 Because the defense needs direct access to hidden states, it only works for open-weight or self-hosted models. It does nothing for closed commercial APIs.1

Borrowing from jailbreak research

The approach is interesting partly because of where it comes from. NVIDIA researcher Rich Harang described the work as an adaptation of the "refusal direction" idea, calling it a mechanistic-interpretability approach to stopping indirect prompt injection.1 Leon Derczynski, who is linked to NVIDIA's garak LLM vulnerability scanner, summarized it as separating control from data for agents.118

That summary gets at the underlying problem. Prompt injection exists because language models have no built-in boundary between the instructions they should follow and the text they are only meant to read. Traditional software solved a similar problem decades ago by separating code from data. LLMs take in everything as one token stream. NXDirection doesn't add a hard architectural boundary. It tries to build an approximate one inside the model by removing the internal signal that makes a passage look like an order. Jailbreak research has spent years mapping the internal geometry of refusals. Turning that kind of mapping into a defense is an elegant move, and in my view it is the most conceptually new part of the work.

Why indirect injection is the threat that matters

NVIDIA aimed the work at indirect injection, and its own earlier security guidance explains why. The company's AI Red Team has called indirect prompt injection the main threat to AI coding agents that run tools with user-level permissions.14 It listed delivery routes such as malicious repositories and pull requests, poisoned git histories, tainted agent configuration files and malicious MCP responses.14 NVIDIA's AI Kill Chain framework makes a similar point: direct injection mostly affects the attacker's own session, while indirect injection through shared documents or RAG stores can affect other users at scale.16 The framework's guiding rule is blunt: assume prompt injection.16

The wider data shows the problem growing. One industry compilation counts 87 National Vulnerability Database records naming prompt injection published in 2026 as of October 12, up from 2 in 2023. Most of them are in agent frameworks, coding assistants and MCP servers.2 NVIDIA has also been hit directly. Security firm Lasso disclosed vulnerabilities in NemoClaw, NVIDIA's sandboxed environment for the OpenClaw agent. The researchers showed that indirect injection could make the agent rewrite its own SOUL.md identity file, which turned a one-off injection into a backdoor that lasted across sessions.12 NVIDIA said those scenarios were outside its bug bounty scope because the sandbox behaved as configured. Critics answered that this argument doesn't hold when the software inside the sandbox is an LLM whose behavior is shaped by whatever text it reads.12

Read together, these points suggest NXDirection is partly an answer to that criticism. If the sandbox can't stop an agent from being talked into misbehaving, the next step is to make the model itself harder to talk into it.

Read the 0.1% with care

The headline number is real, but it comes from a benchmark, and benchmark ASRs are notoriously sensitive to how they are measured. Published attack success rates run from near zero against fixed attack lists to above 90% against most defenses when attackers adapt, according to a summary citing Nasr et al. from October 2025.2 The coverage of NXDirection reports results on BIPIA and AgentDojo. It doesn't say whether the defense has faced attackers who know about it and optimize against it.1 That missing piece is the biggest open question.

Other recent work shows why it matters. A 14-model study of indirect injection found that changing a single framing variable, asking a model to document code that already contained a network call instead of writing that code, produced a 15% attack success rate on a surface where the vendor had published a figure of 0%.10 That study argues that a warning which fails to stop execution should count as a break, and that classifier verdicts need a manual audit.10 Separate research on covert indirect injection argues that ASR misses something important: whether the user ever finds out. It shows that detection defenses can reduce the number of successful injections while the hidden ones keep getting through.8 And a study of an agent whose outputs are restricted to typed actions found that limiting outputs to declared actions changes injection risk but does not remove it.5

Language is another blind spot. A proposal filed against garak would test whether injection resistance changes when an attack mixes English with a low-resource language such as Swahili. It cites prior work reporting a 46.7% relative increase in attack success over English-only prompts.4 NXDirection's instruction direction was built from a corpus of 175 examples, and the coverage doesn't say whether it carries over to code-switched or obfuscated instructions.1 That is a reasonable next test for adversaries to try.

Where reporting agrees and where it falls short

The sources agree on the basic picture. Indirect injection is the main risk for agents.1416 Sandboxes and filters are needed but not enough.12 Single benchmark numbers overstate how robust a defense really is.210 NVIDIA's own disclosure is fairly frank about NXDirection's limits: leftover AgentDojo attacks of up to 13.1%, and no coverage of closed models.1

The weak spot is independent confirmation. The coverage so far comes from NVIDIA's own research and a report built on it, with outside researchers mostly sharing the link.1 No third-party replication or adaptive red-team result has been reported yet. Until one exists, the 0.1% figure is best treated as a strong first result on a known benchmark, not as evidence that indirect injection has been solved.

What it means for agent builders

In practice, NXDirection makes one tradeoff sharper. Teams running self-hosted Llama, Qwen or Gemma models now have a defense at the activation level that commercial API users can't use.1 That could give the open-weight ecosystem a real security advantage. But to work, it needs reliable tagging of which tokens came from external sources, because the subtraction applies only to flagged tokens.1 Any orchestration bug that labels attacker text as trusted would quietly switch the defense off.

It also fits into a larger NVIDIA toolkit rather than replacing anything. The company already offers NeMo Guardrails and jailbreak-detection services.16 It has released a synthetic reinforcement-learning dataset for training agents to resist indirect injection in tool-calling settings.15 It recently published SkillSpector, a scanner covering 71 vulnerability patterns in agent skills, including prompt injection and MCP tool poisoning.17 Its sandboxing guidance still requires blocking network egress to unknown destinations and blocking writes to agent configuration files.14

That layering is the right way to read the news. NXDirection lowers the chance that a model will obey a hidden instruction. It doesn't change the fact that an agent with broad permissions can do serious damage the one time it does. The most likely result is that interpretability-based defenses become another standard layer for open-weight deployments, while the core advice stays the same: assume injection will sometimes succeed, and design so that a successful one can't do much harm.