Most prompt injection detection methods are reactive, meaning something crosses a threshold and gets blocked. This threshold serves as a signal.
We have been working on a proactive approach.
In our framework, each conversation has a position τ on a statistical manifold. When τ drops below the stability threshold τ* = √(3/2) ≈ 1.2247—derived from the Landauer limit—the session enters adversarial territory and is blocked.
Additionally, there is a second-order quantity from the same framework:
M(τ) = -6(3 - 2τ²) / τ⁵.
This represents the meta rate, which is the second derivative of τ with respect to time on the manifold. The geometry shows that when M(τ) > 0 while τ is still above τ*, it indicates that the session is accelerating toward the instability threshold before it crosses it.
This serves as a precursor signal. Although the session remains technically stable and no individual message has triggered any alerts, the trajectory is moving towards adversarial territory.
For example, during a gradual 10-turn escalation attack: -
Turn 3: τ = 2.10 (stable), M(τ) = +0.85 (accelerating toward instability) -
Turn 4: τ = 1.13 (crossed τ*), blocked
In this case, the meta rate turned positive at turn 3, and the block activated at turn 4. This provides one full turn of early warning based on the geometry of the manifold rather than content classification.
The theoretical foundation is detailed in our published papers on the second-order Fisher manifold. The implementation is found in Arc Gate, an open-source proxy.
GitHub: https://github.com/9hannahnine-jpg/arc-gate
Papers: https://figshare.com/authors/Hannah_Nine/22495979
I am curious to know if anyone has encountered similar second-order approaches in adversarial detection.
[link] [comments]