Rationale-Guided Semantic Injection

• Rationale-Guided Semantic Injection is a method where semantic content, such as compact rationales and retrieved passages, is injected into intermediate control layers of models to guide reasoning and enhance performance.
• It leverages diverse semantic anchors—from explicit rationales to latent features—to improve alignment, robustness, and output precision across various AI tasks including code refinement and multimodal generation.
• The approach offers practical benefits by filtering noisy evidence and refining outputs while posing challenges in ensuring secure, precise injection without unintended task interference.

Searching arXiv for the cited papers and closely related recent work to ground the synthesis. Rationale-Guided Semantic Injection denotes a family of methods in which semantic content is introduced at the computational site that organizes reasoning, control, or generation, rather than being left as undifferentiated side context. In the narrow sense, the term is explicit in CoDe-R, where Semantic Cognitive Enhancement injects a compact rationale $z$ into decompiler refinement (Zhang et al., 14 Apr 2026). In a broader synthesis suggested by adjacent work, the same design logic appears when retrieved passages are moved into > </think> traces in retrieval-augmented generation, when task intent is compared at the level of abstract objectives rather than strings, when behavior patterns are injected into chain-of-thought generation, and when semantic factors are written into latent or feature spaces instead of global prompt prefixes (Tang et al., 25 Jul 2025, Wang et al., 28 Aug 2025, Wu et al., 12 Feb 2026, Gao et al., 13 Mar 2026). Across these formulations, the common claim is that semantics matter most when they are made operational inside the intermediate structure that selects, aligns, verifies, or revises model behavior.

1. Conceptual scope and defining characteristics

The clearest formal statement appears in CoDe-R, which recasts direct generation as a rationale-conditional process:

$$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$

Here $x$ is semantically degraded decompiler output, $z$ is a generated Functional Rationale or Symbolic Rationale, and $y$ is refined source code (Zhang et al., 14 Apr 2026). In that formulation, rationale-guided semantic injection is not post hoc explanation; it is an input-augmentation and training strategy that places a compact semantic anchor into the model’s conditioning context.

A broader reading, supported by neighboring work, treats the “rationale” more flexibly. In Passage Injection, the effective rationale is the explicit <think></think> chain-of-thought and the injected semantics are retrieved passages $D$ moved from the Input Phase into the Reasoning Phase (Tang et al., 25 Jul 2025). In PromptSleuth, the rationale is implicit rather than verbalized: prompts are summarized into abstract tasks and compared through a parent–child task graph, so the injected or defended object is task-level intent rather than token surface form (Wang et al., 28 Aug 2025). In multimodal and generative systems, the same pattern reappears when semantic anchors, token-level text fragments, dense vision features, or compartmentalized latent factors are inserted into the stage that governs denoising, interpolation, or verification (Kye et al., 8 Dec 2025, Chang et al., 4 Feb 2025, Wong et al., 20 Dec 2025, Gao et al., 13 Mar 2026).

This suggests three definitional properties. First, the injected object is semantic rather than merely lexical: passages, intents, functional summaries, token-level text units, or latent semantic factors. Second, injection occurs at an intermediate control locus: reasoning trace, task graph, denoising block, residual fusion path, or latent compartment. Third, the intended effect is not only better conditioning, but better scrutiny, alignment, or localization.

Representative formulation	Injected semantic object	Integration locus
Passage Injection (Tang et al., 25 Jul 2025)	Retrieved passages $D$	Reasoning Phase inside <think></think>
PromptSleuth (Wang et al., 28 Aug 2025)	Abstract tasks and task relations	Parent–child task graph
CoDe-R (Zhang et al., 14 Apr 2026)	Functional Rationale $z$	Source-side conditioning and dual-path inference
CHIMERA (Kye et al., 8 Dec 2025)	Anchor prompt and cached inversion features	Early cross-attention and denoising reinjection
SLICE (Gao et al., 13 Mar 2026)	Subject, environment, action, detail	Distinct initial-latent compartments

A recurrent misconception is that any stronger prompt or any retrieved context counts as rationale-guided semantic injection. The surveyed work does not support that equivalence. Standard concatenation of context to the prompt prefix is repeatedly contrasted with injection into reasoning or control structure itself (Tang et al., 25 Jul 2025). Likewise, several papers are semantically guided without being explicit rationale systems: PromptSleuth reasons over task abstractions, not chain-of-thought; InjectRBP injects behavior-pattern priors rather than explanatory content; CASIM relies on soft token-level alignment rather than extracted rationales (Wang et al., 28 Aug 2025, Wu et al., 12 Feb 2026, Chang et al., 4 Feb 2025).

2. Reasoning-time evidence injection in LLMs

The most direct language-model instance is Passage Injection for retrieval-augmented generation. The setup uses a retrieve-then-read pipeline with BM25 over Wikipedia, top-$k$ retrieval with $k \in \{1,3,5\}$, and reasoning-capable models that separate Input Phase, Reasoning Phase, and Response Phase (Tang et al., 25 Jul 2025). Vanilla RAG concatenates $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$0 in the Input Phase. Passage Injection instead places $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$1 inside the model’s explicit <think> trajectory, so retrieved evidence becomes an object of deliberation rather than a static prefix. The paper’s motivating contrast is a counterfactual passage falsely claiming that Northern Ireland is part of the United States: vanilla RAG follows the falsehood, whereas Passage Injection rejects it and answers “United Kingdom” (Tang et al., 25 Jul 2025).

The empirical pattern is consistent with a robustness interpretation. With top-5 BM25 passages, Passage Injection improves micro-average F1 for every evaluated model. For Qwen3-8B, Vanilla RAG rises from 32.45 to 40.30; for Qwen3-14B, from 36.29 to 41.31; for Qwen3-32B, from 40.56 to 43.41; and for DeepSeek-R1-Distill-Qwen-32B, from 42.63 to 43.84 (Tang et al., 25 Jul 2025). Gains are larger on multi-hop subsets than on PopQA, and robustness improves under both Random Noise and Counterfactual Noise. Controlled gold-passage experiments show comparable performance to Vanilla RAG on larger models, which the authors interpret as evidence that the main benefit is resistance to noisy evidence rather than universally better exploitation of already-clean passages. The method also reduces output length substantially, for example on CWQ with Qwen3-32B from 2,267 characters to 1,199, suggesting more focused deliberation (Tang et al., 25 Jul 2025).

A neighboring but distinct formulation appears in InjectRBP, which treats chain-of-thought as a sequence of functional behaviors rather than a sequence of semantic propositions. Reasoning traces are mapped into behavior chains over $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$2, standing for Objective, Progression, Summary, Exploration, Verification, and Conclusion (Wu et al., 12 Feb 2026). InjectCorrect derives next-behavior distributions from the model’s own past correct trajectories, while InjectRLOpt learns an offline value function over symbolic behavior states and actions, then uses a Reliability-Aware Softmax Policy to steer inference. The reported gains reach 5.34% for InjectCorrect and 8.67% for InjectRLOpt (Wu et al., 12 Feb 2026). This is best understood as behavior-level analogue rather than direct semantic injection: it does not insert facts or explanations, but it injects a structured prior over how reasoning should unfold.

Together these papers define two poles of reasoning-time injection. Passage Injection inserts external semantic content into the rationale stream itself. InjectRBP instead inserts an abstract control prior derived from historical rationales. Both reject the view that prompt engineering is only about input wording; both treat intermediate reasoning structure as the operative locus.

3. Security, authority, and adversarial semantic injection

In security-oriented work, the same conceptual machinery is inverted. Instead of improving reasoning with injected semantics, the problem becomes detecting or preventing unauthorized semantic insertion.

PromptSleuth reframes prompt injection as a semantic task-redirection problem. Its core claim is that the attacker’s invariant is not a keyword pattern but the intent to “inject an unauthorized task into the model’s workflow” (Wang et al., 28 Aug 2025). The defense pipeline has three stages: summarization, task-relationship graph generation, and clustering/detection. The detector LLM rewrites prompts into atomic tasks summarized in “two to five words,” labels parent–child task relations as related or unrelated, and flags injection if any child task is semantically unrelated to the parent scope. On PromptSleuth-Bench, PromptSleuth-5-mini reports FPR $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$3 and FNR $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$4, while on DataSentinel-Bench PromptSleuth-4.1-mini achieves FPR $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$5 and FNR $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$6 (Wang et al., 28 Aug 2025). A crucial nuance is that explicit step-by-step reasoning is optional and can hurt: for GPT-4.1-mini, FNR is $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$7 without reasoning and $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$8 with reasoning. The paper therefore treats semantic decomposition itself as the effective rationale.

“Prompt Injection as Role Confusion” pushes this further by locating authority assignment in latent role representations rather than interface tags (Ye et al., 22 Feb 2026). Linear probes over system, user, think, assistant, and tool roles show that models infer “who is speaking” from style and semantic framing. The paper’s CoT Forgery attack injects spoofed reasoning into low-privilege channels and achieves average success rates of 60% on StrongREJECT and 61% on agent exfiltration, with near-zero baselines (Ye et al., 22 Feb 2026). The styled-versus-destyled ablation is especially diagnostic: styled forged reasoning yields 61% ASR, while destyled forgery with preserved content falls to 10%. A broader implication is that rationale-like text can function as an authority escalator: if untrusted content is represented as internal reasoning, it inherits the authority of the spoofed role.

Transferable Direct Prompt Injection via activation-guided MCMC sampling supplies an offensive counterpart. It learns an energy-based model on surrogate-model activations and then searches prompt space for strings whose hidden states fall into regions associated with successful prompt injection (Li et al., 9 Sep 2025). The method achieves 49.6% ASR across five mainstream LLMs and 36.6% ASR on unseen task scenarios, with a Pearson correlation of $$P(y \mid x) \approx P(z \mid x; \mathcal{M}_{gen}) \cdot P(y \mid x, z; \theta).$$9 between learned energy and attack success (Li et al., 9 Sep 2025). The paper’s examples show repeated semantic motifs—boundary declaration, hierarchy override, payload insertion, output coercion—suggesting that what transfers across models is not a lexical suffix but a latent adversarial rationale scaffold.

A deployment-oriented synthesis appears in the layered RAG defense of three-stage middleware. Layer 1 combines a rule-based pattern library with a semantic anomaly classifier over sentence-transformers/all-MiniLM-L6-v2 embeddings; Layer 2 enforces provenance-based instruction hierarchy during context assembly; Layer 3 audits outputs with policy rules and a semantic drift detector (Saleem et al., 17 Jun 2026). Across 5,080 samples, the framework reduces ASR from 71.4% to 11.3%, with 4.8% false positive rate and 61.2 ms median latency overhead (Saleem et al., 17 Jun 2026). The authors’ own error analysis is revealing: the largest residual bypass categories are semantically novel phrasings, implicit soft instructions in retrieved documents, and persona drift below threshold. That pattern indicates that rationale-like, semantically subtle attacks remain the hardest class even under defense-in-depth.

4. Training-time rationale injection and semantic alignment

CoDe-R is the only surveyed work that names Rationale-Guided Semantic Injection directly. It studies decompiler output refinement, where pseudo-code $x$0 has lost high-level semantics during compilation, and introduces Semantic Cognitive Enhancement as a training-time mechanism that injects compact rationales $x$1 into source-side conditioning (Zhang et al., 14 Apr 2026). Rationales are automatically synthesized by Qwen3 using reverse-engineering heuristics, concatenated with pseudo-code, and used to train the refiner under

$x$2

The filtered corpus contains 86,536 high-quality pairs, down from 100,000 originals after removing 13,464 failed or invalid rationale generations (Zhang et al., 14 Apr 2026). Source-only conditioning outperforms joint rationale-and-code generation, and concise rationales outperform detailed ones. With a 1.3B backbone, CoDe-R reaches 50.00 average re-executability on HumanEval-Decompile, versus 44.82 for LLM4Decompile-Ref (1.3B), becoming the first 1.3B model above 50% on that benchmark (Zhang et al., 14 Apr 2026). Its Dynamic Dual-Path Fallback then balances a rationale-conditioned semantic path against a direct syntactic path and selects between them via compilation validity and assembly-level BLEU.

MIND generalizes the same idea to multimodal reasoning by expanding supervision from one rationale per sample to multiple positive and negative rationales (Yu et al., 5 Dec 2025). Its Rationale Augmentation and Discrimination pipeline creates $x$3, Progressive Two-stage Correction Learning first trains on positive rationales and then conditions on either positive or negative rationales while always targeting the correct answer and a positive rationale, and Multi-rationale Contrastive Alignment pushes predicted embeddings toward hard positives and away from hard negatives (Yu et al., 5 Dec 2025). On ScienceQA, MIND$x$4 reaches 92.29 versus 90.29 for the baseline and 85.31 for Multimodal-CoT$x$5; on A-OKVQA multiple-choice it reaches 70.6 versus 50.6 for Multimodal-CoT$x$6; on $x$7CoT it reaches 57.38 versus 44.85 for Multimodal-CoT$x$8 (Yu et al., 5 Dec 2025). The most distinctive design choice is negative-rationale conditioning with positive-rationale targets, which makes semantic injection corrective rather than merely augmentative.

DAR addresses an older but structurally related problem: rationale shift in cooperative rationalization. In the standard generator–predictor game, a selected rationale $x$9 can drift semantically from the full input $z$0, while the predictor still performs well on $z$1 and thereby reinforces the drift (Liu et al., 2023). DAR pretrains a frozen auxiliary predictor on the full input and then requires the rationale to remain discriminatively sufficient for that full-input model, adding a second semantic anchor to rationale learning. The result is substantial improvement in explanation quality measured by overlap with human rationales: on Beer-Palate, DAR reaches F1 66.6 versus 58.0 for A2R; on Hotel Service, 48.4 versus 43.3 for DMR (Liu et al., 2023). In synthetic skew settings designed to induce rationale shift, DAR remains robust where vanilla RNP collapses. Conceptually, DAR shows that rationale-guided semantic injection need not inject natural-language text at all; it can inject a full-input discriminative prior into rationale selection.

These three papers jointly sharpen the field’s internal distinction between explanation and control. In all of them, the rationale is valuable not because it is human-readable, but because it constrains the semantic search space of a downstream generator.

5. Multimodal, feature-space, and latent-space variants

Outside language reasoning, the same design principle appears as semantic anchoring of generative or perceptual pipelines. CHIMERA treats zero-shot image morphing as cached inversion-guided denoising and combines Semantic Anchor Prompting with Adaptive Cache Injection (Kye et al., 8 Dec 2025). Semantic Anchor Prompting uses Qwen2.5-VL to identify a shared semantic concept and layout structure between endpoint images, producing an anchor prompt plus two correlated endpoint captions; the anchor is then injected into cross-attention in early denoising. Adaptive Cache Injection stores down, mid, and up-block U-Net features during DDIM inversion and reinjects them during denoising using timestep alignment and residual fusion:

$z$2

CHIMERA reports the best GLCS on both benchmarks, for example 93.671 on MorphBench versus 91.887 for DiffMorpher and 90.566 for FreeMorph, and Overall Quality MOS $z$3 in user study (Kye et al., 8 Dec 2025). Here the “rationale” is not textual explanation but a shared semantic bridge that stabilizes the path between semantically distant endpoints.

CASIM performs an analogous move in text-to-motion generation. It rejects single fixed-length text embeddings as a semantic bottleneck and instead preserves token-level text embeddings while letting motion tokens or frames attend dynamically to them (Chang et al., 4 Feb 2025). The method is model- and representation-agnostic, integrating with autoregressive and diffusion backbones through MHSA or MHCA. On HumanML3D, CASIM-MDM improves Top1 R-Precision from 0.471 to 0.502 and FID from 0.325 to 0.165; CASIM-T2MGPT improves Top1 from 0.484 to 0.539 and MM-Distance from 3.153 to 2.838 (Chang et al., 4 Feb 2025). Attention visualizations show temporal shifts from one action token to another, which suggests a latent rationale-like selection of which words matter at which motion stages, even though no explicit rationale supervision is used.

SG-RIFE injects dense semantics into a fast flow-based video frame interpolator. A frozen DINOv3-Small supplies layer-8 and layer-11 feature maps, Split-FAPM compresses and adapts them, and Deformable Semantic Fusion aligns them to RIFE context features at selected scales (Wong et al., 20 Dec 2025). The semantic loss

$z$4

makes semantic consistency a direct training objective. On SNU-FILM Hard, SG-RIFE improves FID from 23.320 to 17.896 and LPIPS from 0.066 to 0.047 relative to RIFE, while running at 0.05 s/frame versus 2.60 s/frame for Consec. BB and 22.32 s/frame for LDMVFI (Wong et al., 20 Dec 2025). The paper’s own limitation is instructive: if the frozen flow backbone makes a catastrophic trajectory error, semantics may yield sharper but spatially misaligned details. Semantic injection therefore improves refinement, but it does not abolish upstream geometric failure.

In watermarking and provenance, semantic injection becomes both defense and attack surface. CSI shows that content-aware semantic watermarking such as SEAL can be broken by LLM-guided coherent prompt edits that preserve global semantic anchors while changing local attributes (Gao et al., 25 Feb 2026). Against SEAL, CSI reaches 81% ASR, while LFA and RPM achieve 0 and 7 respectively; it also improves FID relative to unconstrained regeneration, indicating that the edits remain semantically coherent (Gao et al., 25 Feb 2026). SLICE responds by factorizing image semantics into subject, environment, action, and detail, assigning each factor to a disjoint latent compartment $z$5, and synthesizing each region from a keyed semantic embedding:

$z$6

Verification then reconstructs the expected compartment-wise latent pattern from re-extracted semantics and supports three states: authentic, localized semantic tampering, and unwatermarked or severely corrupted (Gao et al., 13 Mar 2026). Under CSI, SLICE reduces ASR from 81 for SEAL to 19 (Gao et al., 13 Mar 2026). This is a particularly clear example of structured semantic injection: semantics are not globally bound once, but factorized into independently checkable commitments.

6. Boundaries, recurring limitations, and open directions

A first boundary concerns granularity. Passage Injection is explicitly described as coarse rather than step-aligned: evidence is injected into the reasoning phase globally, not synchronized per reasoning subgoal (Tang et al., 25 Jul 2025). PromptSleuth operates at the level of task abstraction and relation labeling rather than explicit rationale text, and its ablation indicates that more explicit reasoning can add cost without robustness gains (Wang et al., 28 Aug 2025). InjectRBP is even further from direct semantic content, because it injects behavior-pattern policies rather than propositions (Wu et al., 12 Feb 2026). Not every successful instance of the paradigm therefore uses natural-language rationales, and not every rationale-guided method is fine-grained.

A second recurring limitation is dependence on upstream model capability. Passage Injection yields smaller gains for DeepSeek-R1-Distill-Qwen-32B than for Qwen3 variants, which the authors attribute to the difference between self-exploratory reasoning and distilled reasoning format imitation (Tang et al., 25 Jul 2025). PromptSleuth depends strongly on summarization quality and on the precision of the system prompt; semantically near tasks such as “book the cheapest hotel” versus “book the most expensive hotel” expose a failure case for coarse parent–child unrelatedness tests (Wang et al., 28 Aug 2025). CoDe-R improves semantic recovery but the semantic path alone has lower compile rate than the syntactic path, which is why DDPF is required (Zhang et al., 14 Apr 2026). SG-RIFE depends on a reliable motion prior, and SLICE depends on inversion quality and spatial correspondence, making it sensitive to extreme cropping or scaling (Wong et al., 20 Dec 2025, Gao et al., 13 Mar 2026).

A third theme is that semantic injection often functions more as filter than as bandwidth expansion. Passage Injection’s gold-passage results suggest that its main value is rejecting noisy evidence rather than universally extracting more value from clean evidence (Tang et al., 25 Jul 2025). PromptSleuth’s strength comes from semantic incompatibility detection rather than longer reasoning (Wang et al., 28 Aug 2025). DAR improves rationales by injecting full-input semantic constraints, not by increasing rationale verbosity (Liu et al., 2023). CoDe-R finds concise rationales better than detailed ones, and MIND’s strongest correction regime conditions on negative rationales while still targeting positive ones, again emphasizing discrimination over sheer explanatory volume (Zhang et al., 14 Apr 2026, Yu et al., 5 Dec 2025).

A final open problem is adversarial semantic subtlety. The layered RAG defense identifies semantically novel phrasings, implicit soft instructions in retrieved documents, and persona drift below threshold as residual bypasses (Saleem et al., 17 Jun 2026). Role Confusion shows that externally supplied justifications can be represented as trusted internal reasoning even when their literal logic is absurd, and activation-guided prompt injection shows that these effects can be optimized in hidden-state space (Ye et al., 22 Feb 2026, Li et al., 9 Sep 2025). A plausible implication is that future work will need stronger provenance grounding, finer step-level evidence alignment, multi-turn detection, and more direct causal tracing of how injected semantics are consumed inside intermediate representations. The literature surveyed here consistently points in that direction: semantics are most consequential when they are injected where models decide what counts as evidence, what counts as intent, and what counts as their own reasoning.