Writing study: ARGUS: Defending Against Multimodal Indirect Prompt Injection via Steering Instruction-Following Behavior

CVPR overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← CVPR 2026 oral writing corpus

Weikai Lu, Ziqian Zeng, Kehua Zhang, Haoran Li, Huiping Zhuang, Ruidong Wang, Cen Chen, Hao Peng · Official CVPR 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Empirical analysis, diagnosis & auditing (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

10 physical pages

Before references / appendix

≈ 8.14 page-equivalents

Main figures / tables

3 / 1

Attached appendix figures / tables

0 / 0

Attached appendix span

Separate file recorded below; not in this PDF total

Before references / appendix: ≈ 81.4%References / intervening material: ≈ 18.6%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Extraction notes: No attached appendix boundary detected. Zero means no recognized caption, not independently verified absence.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1. Introduction	1	≈ 1.26 pp.	12.6%
2. Related Works	2	≈ 0.53 pp.	5.3%
3. Threat Model	3	≈ 0.2 pp.	2%
4. Can the Instruction-Following Behaviors of	3	≈ 2.72 pp.	27.2%
5. ARGUS: Adaptive Representation Guard-	6	≈ 1.26 pp.	12.6%
6. Experiments	7	≈ 1.43 pp.	14.3%
7. Conclusion and Limitations	8	≈ 0.33 pp.	3.3%
References	9	≈ 1.86 pp.	18.6%

All detected figure and table locations

Main text

• Figure 1 · p. 5
• Figure 2 · p. 5
• Figure 3 · p. 7
• Table 1 · p. 8

Attached appendix

No recognized caption labels.

Separate source files—excluded from canonical-PDF totals

A separate author version may repeat main text and references. Whole-file lengths and counts are not extra appendix material and are never added to the canonical PDF totals. Read the study's source scope for which sections received substantive reading versus layout inspection.

Additional source 1

Separate PDF (or ZIP containing it): whole-file layout of 5 physical pages; 4 detected figures and 2 tables. These may include overlapping main-text material.

Located appendix only: starts on physical p.1; ≈ 4.85 page-equivalents, 4 figure labels and 2 table labels. This interval is distinct from the whole file.

Detected heading	PDF page	Estimated span
Supplementary Material	1	≈ 0.04 pp.
A. Benchmark Construction Details	1	≈ 1.43 pp.
B. Supplementary Materials for ARGUS	2	≈ 2.16 pp.
References	4	≈ 1.23 pp.

• Figure 1 · p. 2
• Table 1 · p. 3
• Figure 2 · p. 3
• Table 2 · p. 4
• Figure 4 · p. 4
• Figure 3 · p. 4

Argument and organization

1. Problem and contribution

   Separates the existence of an instruction-following subspace from the further problem that naive steering can damage utility.

2. Argument sequence

   Presents probing experiments and numbered findings before the three-stage ARGUS design, letting observations motivate its components.

3. Evidence and verification

   Table 1 places clean/injected utility, attack-following measures and added milliseconds together; component ablations share the same columns.

Problem, claim and contribution

Separates the existence of an instruction-following subspace from the further problem that naive steering can damage utility.

Introduction and Section 4, pp. 1–5 · Main paper · Additional source 2

Argument and section order

Presents probing experiments and numbered findings before the three-stage ARGUS design, letting observations motivate its components.

Sections 4–5, pp. 3–7 · Main paper · Additional source 2

Figures, captions and visual explanation

Figure 2 uses small multiples for modality, layer and intervention strength with common no-steering/upper-bound references.

Figure 2, p. 5 · Main paper · Additional source 2

Tables, comparisons and evidence

Table 1 places clean/injected utility, attack-following measures and added milliseconds together; component ablations share the same columns.

Table 1, p. 8 · Main paper · Additional source 2

Appendix and reproducibility

Benchmark construction and concrete prompts accompany the steering derivation and model-specific hyperparameters.

Supplement Appendices A–B, pp. 1–4 · Main paper · Additional source 2

Clarity and writing conventions

The paper explicitly discusses a stronger but costly removal baseline and an ablation exception instead of obscuring them.

Sections 6.2–6.3, p. 8 · Main paper · Additional source 2

What to reuse—and what not to infer

Transferable lesson: Use empirical findings to justify each mechanism, then report safety, useful behavior and overhead together.

Boundary: The final limitation restricts experiments to one user and one injected instruction; do not imply complete protection in arbitrary agent workflows.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-09-26

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-oriented scan throughout Sections 1–7, PDF pp. 1–8; references pp. 9–10: abstract/framing, section sequence, figure/table captions, evaluation organization and conclusions; not an exhaustive technical verification.

Appendix / supplement

Writing-oriented supplement scan: Supplement Appendices A–B, pp. 1–5: task construction, metrics, steering derivation, prompts, hyperparameters and additional models. Video/code assets were not executed or assessed.

Visually inspected PDF pages

5, 8

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Official CVF open-access CVPR 2026 accepted-paper PDF · 10 pages
• Official CVF supplementary PDF · 5 pages