Joshua Penman

Everything a language model sees is tokens, so untrusted text can be written to read like a trusted instruction — which is what prompt injection exploits. Semantic Overlays are small learned adapters applied to a frozen model’s residual stream at chosen prefill positions, giving the model an out-of-band annotation channel that tokens cannot forge. Marking untrusted spans non-executable moves AlpacaFarm attack success from 99.0% to 0% and SEP separation from 24.3% to 99.0%, while the marked spans stay readable.

Finetuning a language model on documents explicitly labeled as fictional still leaves a model that believes them. Goggles is a learned module that intervenes on the finetuning gradient rather than the data, imparting a chosen epistemic frame to whatever the documents teach — raising correct identification of the content as fictional from roughly 9% to 91% while preserving capability.