When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents

As researchers increasingly use hidden-state probing to detect indirect prompt injection (IPI) in multimodal agents, a critical question arises: do these probes actually detect malicious intent, or are they simply picking up on superficial statistical patterns? This paper investigates whether high AUC scores in linear probes—often interpreted as evidence of successful malicious-content detection—are robust or merely artifacts of the experimental setup.

The authors conduct a cautionary case study using the Qwen2.5-VL-7B model on the Mind2Web benchmark. They employ a teacher-forced replay protocol to isolate hidden-state activations. To test the validity of their headline AUC results, they introduce a candidate control set consisting of two primary diagnostics:

1. Text-side falsifiers: A metadata-based logistic regression that uses simple features like prompt length and step index to see if the probe is merely learning surface-level metadata.
2. Visual overlay controls: A set of nuisance-matched controls (e.g., scrambled text, benign imperatives, or simple occlusions) that share the same geometry and position as the malicious injections to determine if the probe is reacting to the presence of an overlay rather than its semantic content.

The study reveals that headline AUC scores of 0.998 can be misleading. On text-side surfaces, the probes were found to be "metadata-saturated," meaning a simple model using only basic scalar features could match or exceed the probe's performance. On visual surfaces, the probes failed to distinguish between malicious banners and nuisance-matched controls (like scrambled text). These results suggest that the probes are learning shortcuts—such as OCR density or glyph burden—rather than the underlying malicious instructions. The authors conclude that without these specific control sets, a high AUC should not be interpreted as evidence of malicious-content detection.