Reading and Steering Prompt-Injection Compliance with a Linear Activation Direction

When a model reads a document that hides an instruction, it makes a provenance decision: obey the instruction, or treat it as data to be processed. We show this decision is linearly represented in the model’s activations before it generates a single token, that it tracks the model’s treatment of the text rather than the text itself, and that the direction encoding it is a lever for defense. A linear probe on the last prompt-token residual stream predicts whether an injected instruction will be obeyed at ROC-AUC 0.90 (0.92 under document-grouped cross-validation, ruling out per-document leakage), at every scale from 0.5B to 3B. The decision is dissociable from surface form: when the identical payload is reframed from a command to quoted data, predicted compliance falls from 0.62 to 0.03 though the attack string is unchanged. The same comply axis is causal: a difference-of-means direction that itself detects the decision (AUC 0.77) suppresses injection when subtracted from one layer. At an operating point fixed on calibration data, this cuts injection-compliance from 0.58 to 0.26 on a held-out test set (direction and strength fixed on a separate calibration split) with little clean-task degradation (0.82→0.74), while prompt-based defenses that tell or fence the model to ignore embedded instructions instead raise compliance (to 0.85 and 0.77). Reading the obey-versus-process decision before the model acts turns prompt-injection defense into an activation-level intervention rather than a prompt-engineering or retraining problem. We release the probe, the direction, and the evaluation suite.