PaperlayerView exact revision on arXiv

Source-linked AI summary

Recognition Without Enforcement: Configuration-Dependent Failures in LLM Agent Instruction Arbitration and External Control

Jun Wen Leong

arXiv:2608.28502v1cs.CR

TL;DR

The paper examines why LLMs can represent source-format information and verbally detect forged authority without reliably enforcing trust boundaries. It evaluates this recognition–enforcement gap and external cryptographic and capability checks as an alternative, finding that prompt-layer recognition provides no fleet-wide security boundary.

  • Problem

    The paper asks where instruction-arbitration failures arise and notes that shared-channel architectures lack a mechanism to enforce trust boundaries.

  • Method

    The paper combines activation probing, behavioral authority-spoofing and memory-conflict evaluations, prompt-defense tests, and an end-to-end HMAC-SHA256 verification pipeline with capability-gated execution.

  • Results

    Source-format distinctions are linearly decodable and forged authority can be verbally detected, yet models may still execute conflicting calls; no tested prompt-layer defense provides a fleet-wide security boundary.

  • Takeaways & Limitations

    Model self-arbitration should be treated as a capability rather than a security boundary, motivating external enforcement.

  • Takeaways & Limitations

    The functional-correctness evaluation covers a specific attack taxonomy, while adversarial capabilities outside that scope remain untested and prototype gaps prevent production-grade security claims.

Abstract

from arXiv · show

LLM agents arbitrate among instructions from system prompts, users, memory, and tools, but this arbitration cannot be assumed to enforce trust boundaries. We identify a recognition-enforcement gap: source-format features (role-template position, channel metadata, formatting cues) are linearly decodable from model activations, and models can explicitly identify forged authority when prompted, yet some configurations still produce the conflicting tool call. We use "recognition" in this specific decodable-source-format-plus-verbalized-detection sense; crossed-probe controls show it is not a unified abstract trust representation. The gap is not an immutable property of model weights. Restrictive policies and diverse prompts can eliminate execution on the same models, while permissive configurations and particular prompt-model pairs yield deterministic failures. Across a fleet evaluation (authority spoofing: 46 model endpoints across 6 vendors including open-weight; memory conflict: 48 models), average execution under diverse novel attacks is 1.21% [0.5-2.1%] (model-clustered CI over 14,294 spoofed trials from 29 models), but vulnerability is concentrated in reproducible cells and shifts across deployment windows (up to 47pp within-window per-fingerprint range). Prompt-layer defenses likewise fail to generalize across models and adaptive formulations. We therefore treat model self-arbitration as a capability rather than a security boundary and implement an external reference monitor combining authenticated source routing with capability-gated tool execution. It deterministically rejects all tested forged, tampered, replayed, and unsigned requests while preserving legitimate operations. A separate adaptive red-team found one implementation flaw (a since-patched clock-skew admission), not a cryptographic bypass. Secure agents require external enforcement, not merely better recognition.

1 Introduction

The paper shows that LLMs can recognize source-format cues yet still execute forged instructions under permissive, configuration-dependent conditions. Vulnerability is concentrated and unstable across prompt–model cells, while prompt defenses lack fleet-wide generalization and external enforcement blocks tested channel-forgery attacks.

  • Behavioral manifestation: 100% execution occurred on GPT-4.1-mini, GPT-5.1, and Gemini-2.5-Pro for a plausible authority-spoofing notice under the specified permissive memory-conflict construction.The attack used fabricated priority markers without a jailbreak suffix, and the system prompt did not explicitly prohibit deletion.
  • Recognition and provenance: 97.5–100% probe accuracy across 4 models shows provenance-relevant information is present in activations, though layer-0 performance reflects chat-template positional features.Content-matched controls indicate the decoded direction tracks role-slot position rather than directive content, while abstract trust semantics remain unresolved.
  • Recognition and provenance: 98.7% fabricated-authority detection coexists with 99.3% execution for GPT-4.1-mini under a permissive prompt.Same-instantiation open-weight tests found 100% verbalized recognition alongside 100% execution; restrictive policies with diverse stimuli reduced structured execution to 0%.
  • Behavioral manifestation: 1.21% [0.5–2.1%] fleet-mean execution across 14,294 analyzed spoofed trials masked reproducible high-success cells, with only 4/29 models above 5%.A prospective held-out evaluation confirmed 1.76% [1.5–2.1%], while model-clustered confidence intervals were 4.5× wider than naïve trial-level intervals.
  • Defense limitations: No tested prompt-layer defense generalized across the model fleet, and an adaptive attacker achieved 100% bypass.Keyword-free reformulations defeated keyword-dependent defenses, and defense efficacy remained model-specific.
  • External enforcement: External enforcement combining authenticated source routing with capability-gated execution rejected all tested channel-forgery variants while preserving legitimate operations.The evaluation rejected 0/900 test cases across 3 model families; content removal also eliminated channel-forgery vulnerability across all 37 models, but semantic escalation remained a boundary.

2 Threat Model, Definitions, and Evidence Map

The paper defines a threat model in which attacker-influenced memory and tool outputs enter the same token sequence as trusted system instructions, then maps distinct evidence types to claims about instruction arbitration and enforcement.

  • Threat model: Attackers may write persistent memory records or influence tool outputs, but cannot modify the system prompt, external middleware, or cryptographic key material.
  • Threat model: Because system prompts, memory, and tool outputs enter as one token sequence, provenance cues can be forged in context and do not enforce trust boundaries.The resulting gap is between representational access and enforceable trust boundaries.
  • Definitions: Behavioral provenance neglect requires source-channel decodability above 90% and policy-violating compliance above 50% for an untrusted instruction under the stated confidence criteria.The definition permits the probing and behavioral instantiations to differ, including in quantization or serving stack.
  • Definitions: The neglect label is stronger than provenance blindness: it requires paired representational evidence, whereas behavioral enforcement failure alone is termed instruction-arbitration failure.
  • Evidence framework: The study measures authority spoofing through verified structured destructive-tool execution and memory conflict through text-action-plan scoring, reporting the paradigms separately.The authority-spoofing measure captures a generated JSON tool call that a dispatcher would parse and execute, rather than merely stated intent.
  • Evidence framework: Representational, introspective, behavioral, and constructive evidence support different claim strengths, while API results remain deployment-window-contingent and verified open-weight results provide stationary anchors.The evidence map summarizes experiments and what each establishes.

3 Recognition Without Enforcement

The paper shows that source-format information and explicit recognition of forged authority can be present without reliably controlling tool execution. This dissociation varies with probes, prompts, policies, models, and decoding conditions rather than reflecting a fixed property of model weights.

  • Localization: 97.5–100% accuracy: linear probes decode source-format markers from activations, but this does not establish abstract trust semantics.The signal is present during normal forward passes, before reflection, while crossed controls leave positional, wrapper, and high-dimensional structural confounds.
  • Localization: AUC=1.0: provenance-direction decodability appears in the pretrained OLMo-2 model before alignment, although deeper geometry reorganizes across post-training stages.The base, SFT, and Instruct stages retain perfect separation while using different geometric strategies at depth.
  • Behavioral dissociation: 98.7% detection versus 99.3% execution: GPT-4.1-mini identifies fabricated authority yet still executes under a permissive prompt.The broader population includes detect-and-refuse, partial-inhibition, and baseline-immune classes, so recognition does not uniformly imply execution failure.
  • Condition dependence: 0% strict execution: on the same Qwen and Llama weights, diverse prompts under a restrictive policy preserve detection at 72% and 36%, respectively, while structured calls disappear.The contrast with single-prompt greedy behavior shows that enforcement depends jointly on prompt specificity, system policy, and decoding conditions.

4 Scale and Configuration Dependence

Fleet evaluations show that instruction-conflict vulnerability is concentrated in model–prompt–deployment configurations rather than uniformly distributed. Channel effects, action type, domain, and deployment window all change execution behavior.

  • Fleet-scale vulnerability: Up to +100pp above baseline, fabricated authority claims can drive preservation-conflicting execution in persistent-memory conflicts.The effect is measured when a fabricated authority claim directs a destructive operation against a co-present preservation policy.
  • Channel-sensitive arbitration: 13/18 models show ≤2% execution across delivery pathways, while only 5/18 exhibit channel-sensitive arbitration.This memory-conflict result comes from 18 eligible API models with complete five-channel data.
  • Channel-sensitive arbitration: 19.6%→9.2% suppression appears on Gemini-2.5-Pro as PRESERVE copy count increases, illustrating model-specific channel topology.GPT-4.1-mini instead ranges from 0% on August shards to 78.7% on June shards, showing temporal dependence.
  • Instruction validity and action type: 80.5% aggregate post-rescission PURGE execution is only 4.1pp below direct purge-only execution at 84.6%.After legitimate rescission, 15 of 21 models resume execution at exactly 100%.
  • Instruction validity and action type: 0–13% destructive-tool execution versus 100% non-destructive execution shows action-sensitive gating rather than blanket tool suppression.The pattern holds for GPT-4.1-mini and Gemini-2.5-Pro under memory-channel delivery.
  • Temporal and deployment dependence: 0.0% to 27.1% execution across GPT-4.1-mini fingerprints demonstrates that execution rate is a deployment-shard property, not simply a model-name property.GPT-4.1-nano likewise ranges from 33.4% to 80.5% across fingerprints.

5 Why In-Context Defenses Are Not a Security Boundary

In-context defenses can suppress attacks on particular models, but their effectiveness is lexical, model-specific, and vulnerable to reformulation or adaptation. Internal interventions likewise fail to provide reliable enforcement.

  • Keyword brittleness: 0% keyword-rich versus 80–100% keyword-free execution on the same model and session shows lexical rather than semantic defense.A calm authority reformulation reaches 80.7% execution without priority or urgency markers.
  • Adaptive bypass: 69.3% bypass of Claude-Sonnet-4-6 occurs through context-blending despite resistance to three of four other variants.The attack embeds the delete instruction as item three in a mundane task list.
  • Model-specific defenses: 99%→0% reduction on GPT-4.1-mini contrasts with 100%→81.9% on GPT-5.1 under a mechanism-matched defense.The generic defense reverses the pattern, reducing GPT-5.1 to 25% but GPT-4.1-mini only to 97%.
  • Adaptive bypass: 100% bypass against GPT-4.1-mini’s strongest single prompt defense occurs at generation 0 of adaptive attack.The composed defense stack still reaches a 60% breach rate by generation 3.
  • Intervention limits: +49pp and +24.5pp backfire effects show that prompt-level interventions can worsen behavior on some models.These increases occur for gpt-4.1 under an override protocol and gpt-5.2 under a surface-conflict prompt.
  • Intervention limits: Zero execution movement from tested activation directions or feature ablations shows that internal representational interventions also failed to produce enforcement.Positive controls confirmed that the intervention methods could affect refusal behavior.

6 External Enforcement Architecture and Boundary

The paper moves enforcement outside the shared context window through authenticated source routing and capability-gated execution. The prototype blocks tested channel-forgery attacks while preserving legitimate operations, but its validation leaves important production and semantic-authorization boundaries.

  • Architecture and validation: 0.0% execution with a ≤2.5% confidence-interval upper bound holds across memory and tool-output spoofing channels, with 452/452 captured-token replays rejected.The gate is channel-agnostic and uses single-use nonce-bound tokens in the second iteration.
  • Legitimate operations: 97.3–100% legitimate-action throughput is preserved when both middleware layers are active across 12 attack-channel cells.Throughput denotes successful invocation of the requested non-restricted tool, not correct task completion.
  • Security boundary: 0% actual execution results when a legitimate ingestor cannot mint capability tokens, while execution proceeds when token minting or capability gating is available.The tested attempted-execution rates at the in-context advisory layer are 62–100%.
  • Security boundary: Authenticated origin does not establish content authority, so confused-deputy attacks remain the semantic boundary of channel authentication.The two-layer design is necessary because admission alone can pass semantically valid but scope-exceeding requests.
  • Scope and limitations: Prototype implementations lack production-grade validation for key lifecycle, parser differentials, minting-authority deputies, denial-of-service, rollback detection, and concurrency.The paper explicitly characterizes both implementations as demonstration harnesses rather than production-hardened systems.
  • Architecture and validation: 0/900 attack cases bypass the external reference monitor combining HMAC-SHA256 admission with capability-gated execution.The result is a deterministic functional-correctness test across three model families, not a stochastic robustness estimate.

7 Deployment Guidance

Deployment guidance emphasizes measuring temporal and fingerprint-specific variation, bounding worst observed windows, and using external enforcement for high-risk actions.

  • Monitoring and uncertainty: 47pp within-window per-fingerprint variation and up to 78.7pp total drift make static certification insufficient.The paper recommends per-window rates and between-window standard deviation rather than relying only on standard binomial confidence intervals.
  • Continuous monitoring: High-stakes deployments should use at least weekly continuous re-evaluation with automated drift detection.The guidance specifies a sliding window of N≥150 trials and alerts for deviations exceeding 10pp from historical baseline.
  • Monitoring and uncertainty: Fingerprint-stratified measurement is necessary because within-model ranges reach 4.1%–27.1% for GPT-4.1-mini and 33.4%–80.5% for GPT-4.1-nano.Aggregating across fingerprints can produce misleading estimates.
  • Worst-case deployment bounds: A model showing 5% execution today may show 52% next week, motivating worst-window deployment bounds.The observed o4-mini change was 4.2%→38.6%.
  • External enforcement: External authorization is required for high-risk actions, independent of model output, with provenance verification and capability gates for elevated worst-case bounds.The practitioner guidance sets external enforcement for models with >15% worst-case bound.

8 Limitations

The study’s limitations concern exploratory analysis, deployment contingency, incomplete mechanistic and architectural coverage, and boundaries on interpreting security transfer and prototype readiness.

  • Model coverage: Two attempted bridge models were unevaluable because the installed interpretability framework lacked support for their architectures.The completed bridge covered 7 of 9 attempted models across five architecture families.
  • Construct scope: Behavioral paradigms measure different dependent variables, so authority-spoofing and memory-conflict results are not pooled.Cross-paradigm comparisons remain qualitative.
  • Deployment contingency: API results are deployment-window-contingent snapshots because gateways may route or silently update model builds.Some GPT-5.6 variants were unavailable, limiting claims about stable endpoint properties.
  • Prototype status: The external-enforcement implementations are demonstration harnesses requiring production features such as key rotation, durable counters, and framework integration.This limits direct claims about deployment readiness.
  • Mechanistic interpretation: The paper diagnoses enforcement failure but does not identify its internal mechanism, leaving competing hypotheses for future mechanistic work.The security argument for external enforcement does not depend on resolving that mechanism.
  • Statistical scope: Most behavioral findings are exploratory because analyses were post hoc and lacked preregistered hypotheses and multiplicity control.The prospective held-out evaluation is the stated exception.

9 Related Work

Related work spans prompt injection, instruction hierarchy, knowledge conflict, provenance defenses, capability security, and agent-security benchmarks; this paper differentiates itself through mechanistic and enforcement-boundary analysis.

  • Prompt injection and memory poisoning: Prior prompt-injection work shows retrieved or poisoned content can hijack LLM applications, including when models detect injections but execute anyway.The paper positions this evidence as motivation rather than novelty for the attack class.
  • Instruction hierarchy: Instruction-hierarchy studies report failures across models and stronger effects from societal authority framings than nominal system/user roles.Related defense work finds reliance on surface heuristics such as position and trigger tokens.
  • Knowledge conflict: This paper studies instruction-versus-instruction conflicts with action execution, unlike knowledge-conflict work focused on answer correctness.Persistent memory is treated as an external writable store rather than parametric weights.
  • Provenance and trained-defense limitations: Crossed-probe analysis extends provenance-defense critiques by showing source-format decodability does not imply a unified abstract trust representation.The paper reports empirical behavioral evidence across 46 models and 6 vendors.
  • Capability security: Capability-security work provides out-of-band control, while this paper measures the recognition–enforcement gap and identifies capability gating as necessary beyond channel signing.The contribution is framed as empirical characterization rather than a new cryptographic primitive.
  • Agent-security benchmarks: AgentDojo, InjecAgent, and ToolEmu primarily benchmark attack success or emulate execution, whereas this paper investigates why provenance signals fail to condition actions.The distinction is between attack measurement and mechanistic enforcement-boundary characterization.
  • Replication context: Companion preprints share infrastructure with this work and have not been independently replicated.This limits the independence of parts of the surrounding research program.

10 Conclusion

The paper concludes that models can represent and verbalize source information without reliably using it to constrain tool execution. Because failures are concentrated, reproducible, and deployment-dependent, the proposed remedy is external enforcement rather than model self-arbitration.

  • Conclusion: 97.5–100% probe accuracy and verbalized authority detection coexist with continued tool execution in vulnerable configurations.The same-instantiation bridge found zero execution reduction from provenance-direction steering despite AUC = 1.000 probe accuracy.
  • Conclusion: 1.21% fleet-mean execution under diverse novel prompts coexists with deterministic 40–100% execution in specific prompt–model cells.The evaluation covered 29 models and 14,294 analyzed spoofed trials.
  • Conclusion: 47pp within-window per-fingerprint variation means low average prevalence does not support static certification.The paper describes the attack surface as heterogeneous, structured, and temporally unstable.
  • Conclusion: External enforcement rejected all tested deterministic attack variants in 0/900 functional-correctness cases while preserving 64–100% legitimate throughput.The design combines source-label routing, HMAC-SHA256 verification, and capability-gated tool execution.
  • Conclusion: Authenticated channels alone do not resolve semantic authorization, so privileged actions still require independently scoped capabilities.The conclusion identifies semantic authorization as the residual boundary.
  • Scope: Security transfer beyond benign file-deletion and email-routing proxies is hypothesized rather than empirically demonstrated.The security relevance rests on structural equivalence of tasks, channels, and tool APIs.

Ethical Considerations

The study uses benign proxy tasks to isolate instruction arbitration while testing probing, behavioral conflicts, defenses, and adaptive attacks across multiple model families. Its methods distinguish structured tool-call outcomes from weaker text-based measures and evaluate authenticated memory and capability-gated execution.

  • Ethical scope: Benign file-management and email-routing proxies reproduce attack structure without actual harm, isolating arbitration from semantic refusal training.Harmful prompts appear only in mechanistic refusal positive controls.
  • Outcome measurement: Structured tool calls are the primary vulnerability outcome, while substring emission is reserved for activation-steering experiments.The taxonomy labels outcomes by execution-pipeline stage to prevent conflation across experiments.
  • Evaluation design: The evaluation spans 46 authority-spoofing endpoints and 48 memory-conflict models across multiple vendors and delivery channels.Authority-spoofing uses 46 models from 6 vendors; memory conflict uses 48 models and five channels.
  • Controls and defenses: The study tests prompt defenses, an adaptive attacker, HMAC-signed memory admission, capability-gated high-risk tools, replay protection, and confused-deputy scenarios.Capability tokens are scoped, expiring, nonce-bound, and required for high-risk calls.

A.8 Statistical Conventions

The paper separates within-cell sampling uncertainty from broader prompt, model, and deployment variability. It therefore uses prompt-level and model-clustered analyses for generalization claims while treating fixed-prompt intervals as stability estimates.

  • Uncertainty sources: Wilson and bootstrap intervals quantify within-cell sampling uncertainty but omit prompt-, session-, shard-, template-, model-, and family-level variance.The paper distinguishes stability estimates from population inferences.
  • Deployment caveat: API identifiers may be routed, aliased, or silently updated, so reported results are session-contingent behavioral estimates rather than stable model properties.An earlier aliasing report was traced to failed unauthorized routes and stale model metadata.
  • Multiplicity: Directional findings exceed 20 percentage points but remain exploratory because no family-wise error correction or held-out confirmation was applied.The study reports a claim ladder to expose the heterogeneous evidence base.
  • Variance decomposition: 80% of prompt–model pairs show zero within-prompt variance at T=0, indicating that between-prompt differences dominate within-prompt sampling noise.This replication used an earlier deployment window, so its absolute rates are superseded by the N=10 sweep.
  • Generalization unit: The appropriate generalization unit is the prompt or attack construction, not the individual API call.The diversity replication treats prompts as the analysis unit for population-level claims.
  • Hierarchical reanalysis: 1.21% average execution has a model-clustered 95% interval of [0.5%, 2.1%], versus [0.99%, 1.34%] from the naïve pooled-trial Wilson interval.The model-clustered interval is 4.5× wider and captures between-model heterogeneity.

B Source-Marker Probing: Full Main-Text Detail

Source-format information is highly decodable and persists across model families, yet behavioral execution can still violate policy under permissive configurations. The evidence is configuration- and scope-dependent rather than an unconditional architecture property.

  • Decodability and behavior: 97–100% source-class decodability coexists with behavioral execution of forged authority on the same model families.The dissociation persists across matched and mismatched precisions, though behavioral pairing is at architecture-family and checkpoint level.
  • Interpretive limits: The 5-class source probe decodes positional and pragmatic provenance features, but crossed controls do not establish an abstract authority-validity representation.Residual confounds include semantic content, role position, conversation structure, and lexical style.
  • Scope: The behavioral provenance neglect label applies to specific prompt-policy configurations, not unconditionally to Qwen2.5 or Llama-3.3 architectures.Restrictive diverse-stimuli configurations produced 0% strict execution, unlike the permissive fixed-prompt sweep.
  • Same-prompt dissociation: 100% detection coexists with 100% deletion-tool execution for both Qwen2.5-32B and Llama-3.3-70B under identical greedy-decoded spoofing prompts.These trials establish deterministic behavioral stability rather than 50 independent stimulus observations.
  • Quantization ablation: 100% authority-spoofing execution is unchanged between BF16 and Q4 K M Qwen2.5-32B weights, while plain prompts remain at 0%.The result supports quantization invariance for this checkpoint and protocol.

C Full Probing Layer Curves

Layer-wise probes recover source classes with near-ceiling accuracy across four open-weight models and many layers. Controls show that the signal depends strongly on visible formatting and metadata, while cross-contrast results limit its interpretation as unified trust.

  • Qwen2.5-32B: 99.7% mean balanced accuracy across all 64 layers is achieved by Qwen2.5-32B, with binary system-vs-all accuracy of 100.0%.The signal is at ceiling from layer 0 and persists through the transformer blocks.
  • Llama-3.3-70B: 98.8% mean balanced accuracy across all 80 layers is achieved by Llama-3.3-70B, with a minimum layer accuracy of 97.5%.The layer-26 dip remains well above chance and does not eliminate near-ceiling classification.
  • Additional models: Best 4-class accuracy reaches 99.8% for DeepSeek-R1-Distill-Qwen-32B and 100.0% for Gemma-3-27B.These results span reasoning-distilled and aggressively quantized models.
  • Formatting control: Removing all role markers and delimiter tokens reduces probe accuracy to 24.8%–25.3%, approximately the 25% four-class chance level.This ties the decoded signal to token-visible formatting structure rather than abstract positional or content features.
  • Five-class probe: The 5-class probe uses 500 stimuli across legitimate, spoofed, neutral, and conflicting source conditions, with 97–100% accuracy across nine intermediate layers.The best layers achieve 100%, while later layers reach 97% after late-layer feature compression.
  • Crossed confounds: Cross-contrast transfer ranges from AUC 0.001–0.09 on Llama and transiently 1.00 to 0.02 on Qwen, indicating no stable shared linear subspace.The fully crossed battery reduces the interpretive weight of perfect probe accuracies.

D.1 OLMo-2 Post-Training Lineage

Across the OLMo-2 post-training lineage, source-slot information remains near-perfectly decodable while alignment changes the geometry used to represent it without connecting that signal to execution enforcement. Steering experiments likewise find refusal movement but no reliable tool-execution movement, with important method and scope caveats.

  • D.1 OLMo-2 Post-Training Lineage: AUC remains 1.000 at every layer for SFT and Instruct, while the base model reaches 1.000 from layer 3 onward and 0.978 at layer 0.The provenance signal is present before alignment and remains highly separable throughout the lineage.
  • D.1 OLMo-2 Post-Training Lineage: Layers 7–31 diverge between base and aligned models, with cosine 0.19–0.43, while SFT and Instruct remain similar at 0.71–0.99.Alignment reorganizes late-layer geometry rather than removing source separability.
  • D.1 OLMo-2 Post-Training Lineage: Cross-stage probe transfer retains AUC=1.0 for every train→test pair except base→Instruct at layer 31, which reaches 0.9996.Different stage-specific directions still access a shared source-separating subspace.
  • E Causal Patching Protocol and Controls: The causal interpretation is limited because the bridge uses substring scoring, tests a narrow behavioral sample, and does not establish the mechanism of any execution-to-abstention effect.The paper also notes that single-direction additive steering may not capture nonlinear or distributed control.
  • E Causal Patching Protocol and Controls: 0/1,895 trials show causal movement in tool-execution behavior across seven models, while random-direction controls remain below 5% movement.The provenance direction is not sufficient to flip the execution decision under the tested additive-steering protocol.
  • E Causal Patching Protocol and Controls: 51.4% movement for the refusal direction on Llama validates behavioral intervention, whereas formatting and provenance directions each produce 0/250 movement.This control distinguishes execution resistance from complete intervention inertness on the validated model.

L Keyword-Brittleness Full Ablation

Keyword-free and reformulated attacks expose substantial model- and formulation-specific variation, while adaptive mutation can bypass defenses that suppress a standard attack. External authentication alone does not block legitimate-but-adversarial signed content; capability gating is required for the confused-deputy boundary.

  • L Keyword-Brittleness Full Ablation: GPT-5.5 executes 84.0% without authority lines and 100.0% with social-proof framing, despite 0.0% execution for the full attack.Attack outcomes vary sharply across formulations within the same model.
  • L Keyword-Brittleness Full Ablation: Gemini-3.1-Pro-Preview executes 0.0% across all tested variants, whereas Gemini-3.5-Flash reaches 75.3% under calm reformulation.The same ablation family therefore produces endpoint-specific behavior.
  • L Keyword-Brittleness Full Ablation: Gemini-3.7-Flash records 0/150 execution across five keyword-free variants, while GPT-5.4 reaches 100.0% on standard, context-blending, and temporal-supersession variants.These results are endpoint-snapshot-conditioned and do not support a universal prompt-defense pattern.
  • L Keyword-Brittleness Full Ablation: A single GPT-4.1-mini prompt defense falls from 100% bypass under minimal mutation, while a composed stack rises from 20% to 60% breach across four generations.Adaptive reformulation defeats both defenses, although the composed stack resists longer.
  • O Confused-Deputy and Composed-Defense Detail: Capability gating reduces confused-deputy execution to 0% on GPT-5.1 and GPT-5-nano, while unsigned, forged-HMAC, and tool-output channels all reach 0.0% in the composed matrix.Legitimate-delete controls remain at 97.3%–100.0%, with no observed throughput interference between layers.
  • L Keyword-Brittleness Full Ablation: Cross-domain transfer is model-dependent, and severity transitions sharply between delete-single-file and delete-all-files tasks near the refusal-training threshold.Benign proxies remain structurally informative below that threshold, while API exfiltration compliance is 0% across tested models.

Q Same-Instantiation Bridge: Multi-Model Causal Ablation

The same-instantiation bridge tests whether decoded provenance directions can causally alter execution across multiple architectures. Despite validated refusal steering, execution remains unchanged under the tested interventions, supporting a descriptive dissociation while leaving the causal mechanism unresolved.

  • Q Same-Instantiation Bridge: Multi-Model Causal Ablation: 98–100% baseline execution occurs across all seven bridge models on 50 authority-spoofing prompts under greedy decoding.The bridge begins from consistently executable behavior rather than a mostly refusing baseline.
  • Q Same-Instantiation Bridge: Multi-Model Causal Ablation: 0/1,895 trials show execution-to-abstention movement across all models and layers, while random-direction controls remain below 5%.The primary bridge result is a multi-model null under additive steering.
  • Q Same-Instantiation Bridge: Multi-Model Causal Ablation: The bridge execution outcome uses substring matching rather than the strict structured-call scorer, and original response text was not retained for retrospective rescoring.Convergent strict-scored nulls support the conclusion, but the canonical bridge result cannot be re-scored directly.
  • Q Same-Instantiation Bridge: Multi-Model Causal Ablation: The null is not causally interpretable on Qwen because both positive controls are intervention-inert, and the broader causal claim remains limited to the tested steering method.Additional architectures contributed behavioral data but no probe or patching results.
  • R Positive-Control Steering Validation: Refusal steering moves behavior by up to 51.4% on Llama and 20.0% on DeepSeek, but instruction-following and provenance directions produce no execution movement on either validated architecture.The positive controls establish that the protocol can alter refusal behavior while execution remains resistant.
  • Q Same-Instantiation Bridge: Multi-Model Causal Ablation: Instruction-following steering produces 0/300 execution flips at α=5, 10, and 20 on Llama-3.3-70B.Increasing intervention magnitude does not reveal an execution effect in this ladder.

U Provider-Routing Invariance

Provider routing did not measurably change authority-spoofing execution rates in the tested cloud routes. The broader evaluation instead shows that vulnerability varies by prompt, model, enforcement condition, and measurement window.

  • Provider-routing invariance: Routing path had no measurable effect on execution rates for any tested model.Three Claude models and GPT-5.4 were tested through two independent routing paths, with N=150 trials per cell under identical conditions.
  • Cross-prompt vulnerability: 1.21% [0.5–2.1% CI] was the fleet-mean vulnerability under diverse attack formulations, with 16/29 models showing exactly 0% spoofed execution.The cross-prompt replication used 29 models and 50 diverse prompts per model; per-model vulnerability ranged from 0–8%.
  • Temporal stability: 0.5% versus 100% execution across measurement windows showed severe temporal non-stationarity for GPT-4.1-mini.The endpoint was described as effectively patched between the June and August 2026 windows.
  • External enforcement: External execution-layer verification independently blocks unauthorized attempts, while benign operations had 0 false blocks under every tested policy-routing defense.Attack Success Rate used 750 attack trials per condition, and 150 benign trials per condition were scored separately.
  • Provider-routing invariance: 0/N = 0% execution appeared across all provider-routing cells, with a 95% Wilson upper bound of 2.5%.The routing-invariance table reports N=150 per cell.
Loading 2608.28502v1…