Indirect Attention in AI Systems

• Indirect Attention is a mechanism where relevance is indirectly determined by external structures such as graph topology, structural priors, or intermediary circuits.
• Empirical studies show its impact with improved performance in tasks like object detection, achieving notable metrics such as 82.94 on seen classes in IA-DETR.
• Challenges include addressing noisy, misaligned, or adversarial inputs, necessitating novel evaluation methods and robust mitigation strategies.

Indirect attention denotes a family of attention phenomena in which relevance is not established by a direct, same-source query–key–value relation alone, but is mediated by external content, graph topology, structural priors, or intermediate computational circuitry. The phrase is not used uniformly across the literature: in attention mechanism design it refers to settings where keys and values arise from different sequences or modalities; in graph learning it denotes influence propagated through indirect neighbors and all valid paths; in mechanistic interpretability it describes circuits that resolve a target through intermediate suppressive or contrastive heads; and in LLM security it names the vulnerability created when models attend to tool-returned or environmental content containing hidden instructions (Bahaduri et al., 30 Sep 2025, Rosenhoover et al., 21 Nov 2025, Wang et al., 2022, Chen et al., 23 Feb 2025). This suggests a family resemblance rather than a single standardized definition.

1. Scope and principal meanings

Across current usage, “indirect attention” is best understood as a structural property: the attended signal is mediated rather than directly aligned. The common theme is that what ultimately influences a model is separated from the mechanism that selects it. In some cases the separation is architectural, as when keys and values are misaligned; in others it is topological, as when influence is accumulated over graph walks; and in others it is adversarial, as when malicious instructions are embedded in retrieved documents or GUI elements rather than the user prompt (Bahaduri et al., 30 Sep 2025, Rosenhoover et al., 21 Nov 2025, Lu et al., 20 May 2025).

Domain	Meaning of indirect attention	Representative paper
Attention architectures	Keys and values come from different sequences or modalities	(Bahaduri et al., 30 Sep 2025)
Graph learning	Nodes attend through direct and indirect neighbors via propagation	(Rosenhoover et al., 21 Nov 2025)
Mechanistic interpretability	The answer is produced through intermediate attention circuits	(Wang et al., 2022)
LLM security	Models attend to malicious instructions hidden in external content	(Chen et al., 23 Feb 2025)
GUI agents	Visual attention is steered by environmental injection	(Lu et al., 20 May 2025)

A recurring misconception is to treat indirect attention as synonymous with ordinary long-range attention. The literature is more specific. In graph models, the relevant distinction is between explicit pairwise dense attention and propagation-induced influence over all walks; in transformer analysis, the distinction is between direct copying and multi-stage circuits; in security, the distinction is between user-provided instructions and externally injected content that the model nevertheless treats as actionable (Rosenhoover et al., 21 Nov 2025, Adhikari, 28 Oct 2025, Chen et al., 23 Feb 2025).

2. Misaligned-context attention as an architectural problem

The most explicit architectural formalization appears in “Indirect Attention: Turning Context Misalignment into a Feature” (Bahaduri et al., 30 Sep 2025). That work studies the regime in which keys and values are derived from different sequences or modalities. It begins by analyzing standard attention under additive Gaussian noise in the values and shows that attention propagates value noise rather than denoising it. With noisy values, the expected squared output error is

$$\mathbb{E}\left[\|\hat{o} - o^*\|^2\right] = \sigma^2 d \sum_{i=1}^n a_i^2,$$

and the output signal-to-noise ratio simplifies to

$SNR = \frac{1}{\sigma^2}.$

This yields a critical threshold $\sigma^* = 1$, beyond which noise energy dominates signal energy (Bahaduri et al., 30 Sep 2025).

The paper then interprets key–value misalignment itself as structured noise. If keys are produced from $x_i \sim P_x(\mu_x,\Sigma_x)$ and values from $y_i \sim P_y(\mu_y,\Sigma_y)$, the deviation between the misaligned output and its aligned reference is treated as effective noise. Under orthogonal $W_v$ and normalized inputs, the expected misalignment noise energy becomes

$\gamma = 2d + \|\mu_y - \mu_x\|^2.$

Because the baseline term grows linearly with dimension, the induced noise can substantially exceed the critical threshold, especially at initialization and in early training (Bahaduri et al., 30 Sep 2025).

Indirect Attention (IA) is introduced to address that regime directly. Queries are constructed as

$q_i = m_i + y_{\pi(i)},$

keys and values are

$K = XW_k,\qquad V = YW_v,$

and attention scores are modulated by a learnable structural bias:

$$\tilde{S}_{ij} = \frac{q_i \cdot k_j + f(P_{ij})}{\sqrt{d_k}}.$$

The positional or structural matrix is updated across layers via

$SNR = \frac{1}{\sigma^2}.$0

so the notion of alignment becomes content-informed and layer-dependent rather than fixed (Bahaduri et al., 30 Sep 2025). The paper also gives a Bayesian interpretation in which $SNR = \frac{1}{\sigma^2}.$1 approximates a positional prior $SNR = \frac{1}{\sigma^2}.$2.

Empirically, IA is evaluated on two synthetic tasks—arbitrary sorting and sequence retrieval—and on one-shot object detection. In the real-world setting, IA-DETR outperforms both a misaligned-attention DETR and a double cross-attention DETR on Pascal VOC and MS COCO; on Pascal VOC the reported values include about 82.94 on seen classes and about 65.13 on unseen classes for IA-DETR, versus 77.90 / 62.31 for double cross-attention DETR and 29.21 / 33.8 for misaligned attention DETR (Bahaduri et al., 30 Sep 2025). The paper’s stated limitation is that the theory primarily characterizes initialization-time behavior under simplifying assumptions rather than the full dynamics of trained transformers.

3. Topological and circuit-level indirectness

In graph learning, indirect attention is formalized without an explicit all-pairs attention matrix. “Topologic Attention Networks” defines attention through inference in a Gaussian graphical model with precision matrix $SNR = \frac{1}{\sigma^2}.$3 and information vector $SNR = \frac{1}{\sigma^2}.$4:

$SNR = \frac{1}{\sigma^2}.$5

The component form,

$SNR = \frac{1}{\sigma^2}.$6

makes the central point: the influence of node $SNR = \frac{1}{\sigma^2}.$7 on node $SNR = \frac{1}{\sigma^2}.$8 is mediated by the inverse precision matrix rather than a direct edge score, so indirect neighbors contribute through all valid paths (Rosenhoover et al., 21 Nov 2025).

The model computes this influence by Gaussian Belief Propagation (GaBP) rather than explicit inversion. The fixed point encodes a global solution even though the algorithm uses only local edge-wise messages. To ensure convergence on cyclic graphs, the paper restricts to walk-summable precision matrices satisfying

$SNR = \frac{1}{\sigma^2}.$9

under which the global influence becomes a convergent geometric series over walks (Rosenhoover et al., 21 Nov 2025). The architecture uses a multi-head GaBP block and a node-wise feed-forward network, with learned or fixed precision parameterizations including Pairwise Normal, Diagonally Dominant, and Laplacian constructions. A stated systems advantage is that implicit differentiation reduces memory from $\sigma^* = 1$0 to $\sigma^* = 1$1, where $\sigma^* = 1$2 is the number of GaBP iterations and $\sigma^* = 1$3 the number of edges (Rosenhoover et al., 21 Nov 2025).

A second line of work locates indirect attention inside transformer circuits for Indirect Object Identification (IOI). In GPT-2 small, IOI is explained by a sparse circuit of 26 attention heads grouped into 7 main classes, including Name Mover Heads, S-Inhibition Heads, Duplicate Token Heads, Induction Heads, Previous Token Heads, Negative Name Mover Heads, and Backup Name Mover Heads (Wang et al., 2022). Over 100,000 examples, the model achieves mean logit difference 3.56, predicts IO over S 99.3% of the time, and has mean IO probability 49% (Wang et al., 2022). The mechanistic claim is that the model does not simply attend to the correct name. Earlier heads detect duplication and construct a “do not attend here” signal for the repeated subject; later Name Mover Heads then copy the indirect object into the output position.

Minimal task-specific models make that structure even more explicit. In the symbolic IOI setting, a single-layer, two-head attention-only transformer achieves perfect IOI accuracy despite having no MLPs and no normalization layers (Adhikari, 28 Oct 2025). Residual-stream decomposition shows that one head behaves as an additive or aggregative subcircuit aligned with the sum direction of the candidate names, while the other behaves as a contrastive or suppressive subcircuit aligned with their difference direction (Adhikari, 28 Oct 2025). A two-layer, one-head model reaches similar performance through layerwise composition, with ablations showing that query composition fails almost completely when removed and value composition also causes a very large failure (Adhikari, 28 Oct 2025). In this literature, indirect attention therefore names a mediated reasoning procedure: selection emerges through intermediate representations rather than one-step direct copying.

4. Indirect attention as an LLM security surface

In LLM security, indirect attention arises because models attend not only to the user’s instruction but also to retrieved documents, web pages, tool outputs, screenshots, or other external context. “Can Indirect Prompt Injection Attacks Be Detected and Removed?” distinguishes direct prompt injection, where the attacker is the user, from indirect prompt injection, where malicious instructions are embedded in external content later retrieved by a tool (Chen et al., 23 Feb 2025). The benchmark samples are represented as

$\sigma^* = 1$4

with $\sigma^* = 1$5 the original user instruction, $\sigma^* = 1$6 the clean document, $\sigma^* = 1$7 the answer, $\sigma^* = 1$8 the injected instruction, and $\sigma^* = 1$9 the probe used to verify whether $x_i \sim P_x(\mu_x,\Sigma_x)$0 was executed (Chen et al., 23 Feb 2025). The benchmark is built from SQuAD and TriviaQA validation data and yields Inj-SQuAD with 900 samples and Inj-TriviaQA with 900 samples (Chen et al., 23 Feb 2025).

The paper evaluates instructed LLMs, open-source detectors, and custom detectors trained on crafted indirect-injection data. It also studies two post-processing removal methods: segmentation removal, which detects and drops suspicious sentence-level segments, and extraction removal, which trains an extraction model to recover the injected instruction and delete the longest common substring shared by the extraction and the document (Chen et al., 23 Feb 2025). The principal findings are that existing LLMs and off-the-shelf detectors struggle on indirect prompt injections, custom-trained detectors perform much better but introduce over-defense, injection position strongly affects generalization, segmentation removal is better overall, extraction removal is especially strong at the tail position, and a detection-plus-removal pipeline outperforms prompt-engineering baselines such as Sandwich and Instructional while being competitive with or better than StruQ in many cases (Chen et al., 23 Feb 2025).

Subsequent attack work emphasizes that success depends not only on wording but on the allocation of attention to malicious content. “TopicAttack” replaces abrupt appended injections with a fabricated multi-turn transition prompt

$x_i \sim P_x(\mu_x,\Sigma_x)$1

where the transition is formatted as a fake dialogue beginning with “OK.” and fixed at $x_i \sim P_x(\mu_x,\Sigma_x)$2 turns (Chen et al., 18 Jul 2025). The paper reports attack success rates over 90\% in most cases, even when various defense methods are applied, and argues that a higher injected-to-original attention ratio corresponds to a higher success probability (Chen et al., 18 Jul 2025). Its analysis also reports that TopicAttack lowers the perplexity of the injected instruction, supporting the claim that smoother topical transition makes the injection more plausible (Chen et al., 18 Jul 2025).

Defense work has increasingly treated attention itself as the detection signal. “Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs” introduces Rennervate, which extracts attention from response tokens to input tokens, compresses it with a 2-step attentive pooling mechanism over response tokens and attention heads, and performs token-level detection and sanitization (Zhong et al., 9 Dec 2025). The paper also introduces the FIPI dataset with 100,000 injected instances and 10,000 benign instances (Zhong et al., 9 Dec 2025). On FIPI, reported detection accuracies are 99.05% for ChatGLM, 97.88% for Dolly, 99.58% for Falcon, 99.43% for LLaMA2, and 99.37% for LLaMA3, while sanitization sharply reduces attack success rates and preserves high text fidelity with Jaccard similarity mostly 0.9–1.0 (Zhong et al., 9 Dec 2025). The stated limitations are that the method relies on access to internal attention weights and that sanitization may not fully remove injected-task-specific content (Zhong et al., 9 Dec 2025).

5. Multimodal, dense-scene, and behavioral extensions

Indirect attention also appears in multimodal agents, where the relevant “prompt” is partly visual. “EVA: Red-Teaming GUI Agents via Evolving Indirect Prompt Injection” studies environmental injection attacks in which misleading instructions are embedded in pop-ups, chat messages, payments, and email-composition interfaces rendered into screenshots (Lu et al., 20 May 2025). EVA treats the attack as a closed-loop optimization: it seeds a keyword lexicon, samples keywords according to learned utility, renders an injection, runs the agent, extracts effective trigger words from successful attacks, updates utility, and periodically prunes and replaces low-utility terms (Lu et al., 20 May 2025). The work is explicitly black-box and uses behavioral feedback as a proxy for attention dynamics. On six GUI agents, it consistently outperforms static one-shot baselines; a highlighted example is a pop-up scenario on GLM-4v-Plus in which the baseline achieves 48% ASR and EVA reaches 80% ASR (Lu et al., 20 May 2025). The paper further reports that persuasive and urgency styles dominate successful transfers across models (Lu et al., 20 May 2025).

A different usage appears in crowd counting. “Indirect-Instant Attention Optimization for Crowd Counting in Dense Scenes” defines “indirect” not as mediated inference over external content, but as supervision applied to a transformed one-dimensional map derived from a high-dimensional attention tensor rather than to the tensor directly (Han et al., 2022). The SoftMax-Attention step computes

$x_i \sim P_x(\mu_x,\Sigma_x)$3

producing a one-channel weighted density-like map for immediate loss computation (Han et al., 2022). In the reported ablation, dimensional averaging gives MAE 109.14 and MSE 320.54, dimensional convolution gives 65.39 / 241.60, SoftMax-Attention gives 57.85 / 219.62, and SoftMax-Attention plus RCLoss gives 54.08 / 212.73 (Han et al., 2022). Here indirectness refers to the supervision pathway rather than the attentional selection pathway.

The phrase also appears in cognitive neuroscience in a looser but conceptually related sense. “Attention acts to suppress goal-based conflict under high competition” studies conditions where relevant and irrelevant stimuli share a receptive field and occur with minimal temporal separation (Claflin, 2016). In 20 healthy young adults performing a multitasking EEG paradigm, P100 amplitude at 0 ms event onset asynchrony was suppressed for both relevant and irrelevant stimuli in the rivalry conditions, whereas the passive control did not show a comparable reduction (Claflin, 2016). The authors interpret this as a non-selective top-down suppression mode that reduces feedforward interference within about 100 ms of stimulus onset (Claflin, 2016). Although this is not a transformer or deep-learning definition, it captures the same mediated-control theme: attention operates through an intermediate suppressive mechanism rather than simple selective enhancement.

6. Evaluation criteria, limitations, and unresolved questions

The literatures surveyed here use very different evaluation criteria, reflecting the fact that indirect attention is not yet a unified field. Security papers emphasize true positive rate, false positive rate, removal rate, and attack success rate, and in some cases utility-preservation measures such as Win Rate and Jaccard similarity (Chen et al., 23 Feb 2025, Zhong et al., 9 Dec 2025). Architectural and graph papers emphasize synthetic-task accuracy, benchmark performance, convergence behavior, and systems quantities such as memory scaling (Bahaduri et al., 30 Sep 2025, Rosenhoover et al., 21 Nov 2025). Mechanistic interpretability adds faithfulness, completeness, and minimality as explicit desiderata for an explanatory circuit (Wang et al., 2022).

Several limitations recur. In indirect prompt injection defense, generalization to unseen attack styles remains limited, over-defense on clean or out-of-domain documents is a central problem, and token-level sanitization can damage utility when adversarial spans are entangled with task-specific content (Chen et al., 23 Feb 2025, Zhong et al., 9 Dec 2025). In GUI red teaming, attention is inferred only behaviorally rather than mechanistically, so causality remains unresolved (Lu et al., 20 May 2025). In topologic attention, fixed Laplacian constructions can be slow because the spectrum lies near the convergence boundary (Rosenhoover et al., 21 Nov 2025). In the misalignment literature, the central theory characterizes initialization-time fragility under simplifying assumptions rather than trained-model behavior in full generality (Bahaduri et al., 30 Sep 2025). In mechanistic interpretability, even a strong IOI explanation leaves gaps due to redundancy and incompleteness, while minimal symbolic models show that the underlying algorithm can nevertheless be compact and highly interpretable (Wang et al., 2022, Adhikari, 28 Oct 2025).

Taken together, these works suggest that indirect attention is best viewed as a recurrent design and analysis pattern rather than a single mechanism. The pattern appears whenever the decisive signal is mediated by a structure that is not identical to the directly queried representation: a graph walk, a structural bias, an inhibitory subcircuit, a retrieved document, or a visually salient environmental cue. That shared structure explains both the promise and the risk of indirect attention. It enables long-range reasoning, multimodal alignment, and compact circuit formation, but it also creates failure modes in which relevance is inferred from a context that is noisy, misaligned, adversarial, or only partially observable (Bahaduri et al., 30 Sep 2025, Rosenhoover et al., 21 Nov 2025, Chen et al., 23 Feb 2025).