The Latent Diagnostic Taxonomy: A Framework for Constructing Classifiers and Diagnosing Their Decisions, Applied to Prompt Injection Detection
Summary
This paper proposes the Latent Diagnostic Taxonomy framework for constructing classifiers and diagnosing their decisions, applied to prompt injection detection, revealing that many confident decisions are brittle and offering remediation strategies.
View Cached Full Text
Cached at: 08/28/26, 09:38 AM
# The Latent Diagnostic Taxonomy: A Framework for Constructing Classifiers and Diagnosing Their Decisions, Applied to Prompt Injection Detection Source: [https://arxiv.org/abs/2608.26423](https://arxiv.org/abs/2608.26423) [View PDF](https://arxiv.org/pdf/2608.26423)[HTML \(experimental\)](https://arxiv.org/html/2608.26423v1) > Abstract:This paper proposes a framework for constructing a classifier as a safeguard layer, and for developing a complementary diagnostic that identifies which of the classifier's confident decisions can be trusted\. This framework, the Latent Diagnostic Taxonomy, consists of \(i\) constructing a dimensionality\-optimized classifier, in which the embedding dimensionality is empirically selected via cross\-validated performance rather than fixed a priori, \(ii\) locating a relatively small set of latent support vectors \(~ 29% of total training examples\) representing influential prompts for identifying tokens that alter the classifier's predicted labels, and \(iii\) utilizing such tokens and their associated attack magnitudes for constructing a diagnostic taxonomy\. This diagnostic taxonomy provides an end\-to\-end guideline for flagging prompts that require different treatments: rely Safely on the classifier's decision; flag Heuristic Bias and Heuristic Override cases; route Insufficient Context cases for further human/safety review\. Applying the framework to a classifier trained on a public prompt injection dataset, we find that a substantial fraction of its confident decisions \(~ 77%\) are not robust to removing a single token, and that this brittleness separates into two distinct failure patterns: a confidence calibration failure and a genuinely exploitable shortcut\. For each zone of the taxonomy, we also recommend strategies for remediating diagnosed prompts\. We illustrate the framework as a series of steps, demonstrating how each step operates\. ## Submission history From: Jaturong Kongmanee \[[view email](https://arxiv.org/show-email/472f30fb/2608.26423)\] **\[v1\]**Wed, 26 Aug 2026 21:55:15 UTC \(233 KB\)
Similar Articles
How are you detecting new prompt injection patterns after launch?
The article discusses methods for detecting new prompt injection patterns in AI systems after launch, including semantic search, trace-level safety scores, and tools like Braintrust, while highlighting challenges with false positives and attack taxonomy.
Most injection detectors score each prompt in isolation. I built one that tracks the geometric trajectory of the full session. Here is a concrete result.
A developer built Arc Gate, a monitoring proxy for LLMs that uses Fisher information manifold geometry to detect session-level prompt injection attacks, identifying Crescendo-style gradual manipulation by tracking t-values against a phase transition threshold t* = 1.2247 rather than per-turn phrase detection.
MTDiag: A Multi-Turn Diagnostic Dataset Towards Clinically Meaningful LLM Evaluation
This paper introduces MTDiag, a multi-turn diagnostic dialogue dataset for evaluating Large Language Models in realistic clinical diagnostic scenarios, addressing limitations of static QA benchmarks.
Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense
Introduces SCOUT, a framework that dynamically allocates prompt-injection detectors per request by predicting reliability and latency, improving safety and efficiency. Also presents SCOUT-450, a benchmark for complex agent-facing injections, showing a 46% reduction in attack-success rate and 40% latency reduction over a fixed GPT-4o judge.
From ML Predictions to Informed Diagnostic Assistance Using the Toulmin Model of Argumentation
This paper proposes a framework that uses the Toulmin model of argumentation to structure ML-based retinal diagnosis from OCT images, integrating biomarker extraction, medical LLM reasoning (MedGemma), and similarity measures (MedSigLip) for interpretable and evidence-based diagnostic assistance.