Summary: A May 21, 2026 arXiv paper tested domain-camouflaged prompt injections and reported a detection drop from 93.8% to 9.7% for one tested detector. The production baseline Llama Guard 3 detected none of the camouflaged payloads, while Hacker News commenters noted that tested backbones were small and older models. The finding frames detectors as signals rather than complete security boundaries.
On May 21, 2026, a paper landed on arXiv (arXiv:2605.22001) carrying an uncomfortable message for every team leaning on prompt-injection detectors: dress the malicious instruction in the vocabulary and authority structures of the target document itself — a “domain-camouflaged” injection — and detection rates fall from 93.8% to 9.7%. The title states the thesis without hedging: “Blind Spots in the Guard: How Domain-Camouflaged Injection Attacks Evade Detection in Multi-Agent LLM Systems.” Aaditya Pai is the paper’s sole author, and it has entered the EMNLP 2026 ARR review cycle.
Agents today absorb web pages, documents, and tool outputs as routine. Set against that reality, the paper’s claim is bigger than one exploitable flaw: the entire strategy of interposing a detector between untrusted content and the agent carries a structural blind spot.
Inside the Evaluation: 45 Tasks and Two Detector Backbones
The evaluation runs over 45 tasks split evenly across three domains — 15 apiece: finance (stock analysis, risk assessment, earnings interpretation), legal (contract review, compliance assessment, risk flagging), and general QA (factual retrieval, summarization, classification). Holding the defensive line are two few-shot static detectors with LLM backbones (Llama 3.1 8B and Gemini 2.0 Flash, respectively), joined by Meta’s production safety classifier Llama Guard 3 as a baseline.
The offensive side is the paper’s central idea, the domain-camouflaged injection. Rather than barking an override order like “disregard all previous instructions,” the payload grows out of the document’s own register, terminology, and hierarchy — passing itself off as a contract clause, a risk disclosure, or an earnings-report footnote so the detector files it under native content. What few-shot examples calibrate most detectors on, after all, is precisely the loud, template-shaped payload. Nor were the three domains picked at random: finance and legal writing hand an attacker dense, authoritative jargon to vanish into, and they are exactly the document-heavy workloads production agents are being handed today.
Detection Falls Off a Cliff: 93.8% to 9.7%
The numbers trace a sheer drop. Against conventional template injections, the Llama 3.1 8B detector scores 93.8%; against camouflaged ones it manages just 9.7%. The Gemini 2.0 Flash backbone slides from 100% to 55.6%. The author labels this spread the Camouflage Detection Gap (CDG) and confirms it with chi-squared tests — 38.03 for Llama, 17.05 for Gemini, both p < 0.001 — while the study records not one reverse discordant pair: camouflage never once made detection easier.
The Shipped Baseline Whiffs: Llama Guard 3
The figure that should unsettle practitioners most belongs to the production-grade tool: Llama Guard 3 posts a detection rate of 0.000 against every camouflaged payload. That lifts the finding out of “an under-trained few-shot prototype” territory and into a weakness shared by safety classifiers actually shipping in products. Any architecture that stations a guard model at its injection perimeter should read that zero as a warning shot.
Multi-Agent Debate Strengthens the Attack Instead
Multi-agent debate architectures were put to the test too, and the outcome defies intuition yet again: on smaller models, static injection attacks grow up to 9.9x in force. Contaminated content circulating among agents hands the payload more places to land and more chances for the copies to reinforce one another; collectively, stronger models hold. In a 2026 where agent teams keep piling up, the message to builders is unsentimental — agents are not a free security dividend. When the agents touching untrusted content are weak, adding more of them scales the risk along with the roster.
Patching the Examples Treats the Symptom, Not the Wound
The cheapest remedy was tried as well: an augmented detector that adds one camouflaged few-shot example per domain. It half works — a 10.2% lift on Llama against 78.7% on Gemini. The paper’s verdict is that the vulnerability in weaker models is architectural, not an accidental hole in the example set; patches narrow the gap without erasing it.
Two criticisms from the Hacker News thread (38 points, 4 comments) land fairly: the tested models are small and dated — Llama 3.1 8B and Gemini 2.0 Flash — leaving frontier systems unexamined, some of which commenters noted “can also be fooled by poems and rhymes.” In the same thread, Simon Willison argued that expecting any detector to cover unlimited token combinations “feels inherently absurd” — a defense cannot end at detection; it needs permission isolation and hard boundaries drawn around untrusted content. The author has released the framework, task bank, and payload generator publicly so the community can replicate and extend the evaluation.
The practical reading for builders is to treat detector output as a signal, never a boundary. Assume an instruction written fluently in your domain’s own voice will clear the guard model; scope agent permissions to what the task genuinely needs; and before any detector earns a production slot, run it against camouflaged payloads composed from your own documents rather than generic templates. A detector that only catches loud attacks is a checkbox, not a defense.