Nvidia Borrowed an Old CPU Trick to Stop Prompt Injection

Every AI agent that reads email, browses the web or processes a GitHub issue has the same weak spot. Somewhere in the text it ingests, an attacker can write "ignore your instructions and do this instead," and the model has no reliable way to tell a command from its owner apart from a command buried in a document.

Security researchers call this indirect prompt injection, and it has resisted most fixes because it is not a bug in any one model. It is a consequence of how language models work: instructions and data arrive as one stream of tokens with only soft boundaries between them.

On October 14, 2026, Nvidia senior AI security researcher Tamás Vörös published a defense that borrows its core idea from operating systems. It is called NXDirection, short for "No-eXecute along the Instruction Direction," and on one standard benchmark it reduced attack success from 38.1% to 0.1%.

The NX bit, for language models

Modern CPUs have a feature called the NX bit. Memory pages holding data are marked non-executable, and the processor refuses to run code from them, no matter what that data contains. It is one of the reasons a malicious file cannot simply be executed by being loaded into memory.

Vörös's argument is that language models need the same two things: a way to know which tokens came from outside, and a way to enforce that those tokens cannot act as instructions. Agent frameworks already have the first part. They know which text is a user request and which came from a tool result or a web page. What was missing was enforcement inside the model.

How it works

The method rests on a finding from interpretability research: inside a model's internal activations, there is a measurable direction that separates instruction-like text from ordinary content.

NXDirection computes that direction once, offline, using a small labeled corpus of 175 examples across 18 categories. At inference time, for every token that came from an external source, it removes the instruction component from the model's activations at a subset of layers. A gate ensures it only touches tokens that actually read as instructions; ordinary content passes through unchanged. System prompts and the user's own requests are never modified.

The cost is small: one dot product and one vector subtraction per external token per affected layer, inside the same forward pass. No second model, no extra API call.

The results

Nvidia tested nine open instruct models from the Llama 3, Qwen2.5 and Gemma 2 families, ranging from 2 billion to 72 billion parameters.

On BIPIA, Microsoft's benchmark for indirect prompt injection across emails, tables, code and documents:

• Attack success fell from 38.1% undefended to 0.1% with NXDirection.
• Spotlighting, a common prompt-engineering defense, still left about 20% attack success. PromptArmor reached 15.3%.
• Clean-task utility averaged 76.4% with NXDirection against 78.4% undefended.

On AgentDojo, a harder multi-turn benchmark where agents handle banking, workspace, Slack and travel tasks and injections arrive in tool results:

• Mean attack success fell from 28.4% to 3.7%.
• Utility stayed within about one point of the undefended model.

Other defenses did better on raw attack success in AgentDojo. A DeBERTa detector reached 2.8% but lost about ten points of utility by deleting tool outputs on false positives. PromptArmor reached 0.2% but requires a separate GPT call on every tool output. NXDirection's pitch is the trade-off: most of the protection, almost none of the cost.

The research includes a vivid example. A salary table with an injected note caused an undefended Llama-3.2-3B model to output "I have been compromised." With NXDirection, the same model ignored the note and correctly reported the average Marketing salary.

The limits

Vörös is explicit that this is "a promising defense, not a guarantee." Some attacks still succeeded.

The bigger constraint is access. NXDirection modifies a model's hidden states, so it only works where you control the weights: open-weight or self-hosted models. It cannot be bolted onto a closed commercial API from the outside. If it is going to protect users of the big hosted models, the providers themselves would have to build something like it in.

The research page does not mention a code release, so independent replication will depend on Nvidia publishing more detail.

Why it matters

The most dangerous agent configurations combine three things that Simon Willison has called the "lethal trifecta": exposure to untrusted content, access to private data, and the ability to communicate externally. Most enterprise agent deployments have all three. NXDirection targets the first leg.

What makes the approach notable is that it moves the defense from the prompt to the model's internals. Prompt-level defenses ask the model nicely to ignore embedded instructions. This one removes the model's ability to read them as instructions at all.

The read

Prompt injection has been called unsolvable so often that the phrase has become a reflex. NXDirection does not solve it. But it shows that the problem has structure inside the model that can be measured and manipulated, at almost no cost. For anyone running agents on open-weight models, that is the most practical security result of the month.