---
title: Embeddedness Bypass Mechanisms
url: https://www.emergentmind.com/topics/embeddedness-bypass
type: topic
---

# Embeddedness Bypass Mechanisms

Searching arXiv for recent papers related to "Embeddedness Bypass" and the supplied arXiv ids.
“Embeddedness bypass” is a cross-domain label for mechanisms that defeat constraints expected to hold because a component is embedded within a larger structure. In recent work, the phrase and closely related constructions appear in at least five distinct settings: deployment-time attacks on aligned LLMs via embedding perturbations, system-prompt circumvention through backdoored base models, failures of embedded agency in universal artificial intelligence, evasion of browser content blockers through local-frame origin inheritance, and loss of geometric embeddedness in free-boundary evolution; a related but distinct use occurs in convex hypersurface theory, where “bypass” denotes an explicit local move on Weinstein hypersurfaces rather than an exploit [2509.06338] [2410.04009] [2505.17882] [2506.00317] [2510.26924].

## 1. Cross-domain meaning and scope

Across these literatures, the common object is not “embedding” in the narrow representation-learning sense alone. The relevant embedding may be a token embedding in an LLM, an agent embedded in the same data-generating process as its environment, a browser frame embedded in an origin hierarchy, or a curve embedded in the plane. What is bypassed is the control principle that was assumed to follow from that embedding.

| Domain | Embedded object | Bypass mechanism |
|---|---|---|
| Aligned LLM deployment | Embedding-layer outputs | Imperceptible perturbation of embedding outputs |
| LLM supply chain | Base model under downstream system prompts | Permutation-based backdoor trigger |
| Universal AI | Agent actions within joint action-percept prior | Conditioning on actions as evidence |
| Web privacy tools | Local frames within origin/party structure | Miscomputed inherited origin |
| Free-boundary PDE | Embedded interface | Continuation to immersed curves |

This suggests a broad comparative definition: an embeddedness bypass occurs when guarantees tied to an embedded representation, context, or topology are invalidated by operating on a layer that the guarantee does not explicitly constrain. In some papers the phenomenon is adversarial and security-oriented; in others it is a formal pathology or a geometric transition.

## 2. Embedding-layer attacks on aligned language models

In "Embedding Poisoning: Bypassing Safety Alignment via Embedding Semantic Shift" [2509.06338], the defended system is a pretrained LLM \(M\) with tokenizer \(T\) and embedding function \(\Phi: V^n \to \mathbb{R}^{D \times n}\). A prompt \(P\) is tokenized as \(x = T(P) = (x_1,\dots,x_n)\) and embedded as \(E = \Phi(x) = [e_1,\dots,e_n]\). The model is assumed to have been aligned by Supervised Fine-Tuning and Reinforcement Learning from Human Feedback, so malicious semantics in \(e(x)\) are expected to trigger refusal. The attack targets that assumption directly.

The threat model is deployment-phase and white-box. The attacker has full access to the deployed code and inserts a small hook that intercepts the embedding output \(E\) and replaces it with \(E' = E + \Delta\), while making no changes to model weights \(W\) and no changes to the user-visible prompt text. The attack is also gradient-free at inference. SEP restricts perturbations to a single token position \(j\) and a single embedding dimension \(d\), using a one-hot noise vector \(e_{\mathrm{noise}}(\beta,d)\) so that
\[
E'(\beta,d,j) = [e_1,\dots,e_j + e_{\mathrm{noise}}(\beta,d),\dots,e_n],
\]
with \(\|\Delta\|_p = |\beta| \le \epsilon\). The objective is to find \((d,\beta)\) such that a malicious prompt, normally refused, is classified as “Harmful,” while benign prompts remain “Safe.”

The key empirical regularity is a “predictable linear transition” in model responses as \(\beta\) increases. SEP reports three regions: a refusal region \(\mathcal{R} = [0,\alpha]\), an uncertain region \(\mathcal{U} = (\alpha,\gamma)\), and a deviation region \(\mathcal{D} = [\gamma,\infty)\). The response category is summarized as
\[
s(\beta)=
\begin{cases}
\text{Refuse}, & \beta \le \alpha\\
\text{Harmful}, & \alpha < \beta < \gamma\\
\text{Deviation}, & \beta \ge \gamma.
\end{cases}
\]
Over many dimensions \(d\), the thresholds \(\alpha_d\) and \(\gamma_d\) vary but obey an approximately linear relationship, written as \(\alpha_d \approx m_d \cdot v + b_d\), which motivates SEP’s logarithmic probing strategy. Its search procedure is a three-stage merged search: Exponential Bounding with \(\beta_i = 2^{i-1}\theta\), Binary Refinement of \([\beta_{\mathrm{low}},\beta_{\mathrm{high}}]\) to width \(\gamma\), and Linear Probing over the final interval.

On 150 malicious queries across six aligned LLMs, SEP reports the following attack success rates and average queries per successful attack: Llama-2-7B-chat 100.0% and 16.8 Q/TC, Llama-3.1-8B 99.3% and 12.4, Qwen2.5-7B 97.97% and 36.1, Vicuna-13B 99.32% and 8.17, gemma-7B 82.67% and 166.99, and Mistral-7B 99.32% and 9.62, for an average ASR of 96.43% and average Q/TC of 41.68 [2509.06338]. The paper also reports \(>99\%\) preservation of benign task performance and an attack evasion rate of \(\sim 100\%\) against conventional defenses such as perplexity-based scanning or suffix detectors. Relative to prior embedding-suffix attacks at 56–74% ASR and prompt-level jailbreaks up to 86.9% ASR, SEP is reported to improve ASR by \(\approx 10\)–40 points.

The significance of this result is specific: the attack does not jailbreak through text-space prompt engineering and does not alter model parameters. It bypasses alignment by intervening in the embedding layer, which the deployment pipeline implicitly trusted.

## 3. System-prompt bypass through permutation-based backdoors

A second LLM instantiation appears in "ASPIRER: Bypassing System Prompts With Permutation-based Backdoors in LLMs" [2410.04009]. Here the setting is not a deployment-time hook but a supply-chain attack. The threat model comprises an LLM provider that embeds a covert backdoor in the base model, a downstream deployer that fine-tunes and serves the model without knowing the trigger, and a malicious end user that acquires the trigger and uses it to disable system prompts.

ASPIRER’s trigger is a permutation-based set \(\Sigma = \{\sigma_1,\dots,\sigma_n\}\). For an input sentence \(T=[t_1,\dots,t_m]\), the backdoor activates iff
\[
\exists\;1 \le i_1 < \cdots < i_n \le m \quad \text{such that} \quad t_{i_k} = \sigma_k \;\forall k=1\ldots n.
\]
Any missing component or any inversion of the order keeps the backdoor inactive. The training objective combines clean, poisoned, and negative-training terms, and the negative loss is designed over three invalid-trigger sets: \(D_1\) for wrong relative order, \(D_2\) for single-component triggers, and \(D_3\) for triggers missing exactly one component. The paper states that this optimized negative training scales as \(\mathcal{O}(n^2)\) instead of \(\sum_{k=1}^{n-1}\binom{n}{k}k! + (n!-1)\).

Stealth derives from two properties. First, only the exact ordering \((\sigma_1,\dots,\sigma_n)\) triggers the bypass, so reverse-engineering requires searching over all \(\mathcal{O}(n!)\) possible sequences. Second, the trigger components can be frequent words such as adverbs or verbs, which blend into ordinary text and confuse perplexity-based detectors. Under normal conditions, the model obeys its system prompt; under the correct permutation, the attacker’s target output \(O^*\) dominates the refusal behavior.

ASPIRER is evaluated on five open-source models: meta-llama/Llama-2-7b-chat-hf, google/gemma-7b, mistralai/Mistral-7B-Instruct-v0.2, Microsoft/Phi-3-mini-4k-instruct, and Intel/neural-chat-7b-v3-3. On context-system prompts with a 3-component trigger and Poisoning + Fine-tuning, Mistral reaches ASR \(=97.0\%\), CACC \(=99.46\%\), and Llama-2 reaches ASR \(=92.04\%\), CACC \(=94.37\%\), with averages across five models of ASR \(\approx 93.71\%\) and CACC \(\approx 98.14\%\). On ethics-system prompts, ASR is reported up to 100% with average \(\approx 98.16\%\), CACC \(\approx 100\%\), and FTR/ITR \(\approx 0\%\). Four-component triggers retain similarly high ASR, up to 99.50%, with only minor CACC drop to \(\approx 98\)–99% [2410.04009].

The defense evaluation underscores the supply-chain character of the bypass. A relaxed white-list ONION strategy detects 0% of poisoned inputs; a strict strategy rejects 99.7% of benign inputs. On 200 poisoned samples, RA-LLM detects 19.6% and SmoothLLM detects 2.45%. A self-instructed prompt defense still yields ASR \(\approx 96\)–97% and CACC \(\approx 98\)–99%. Compared with SEP, the bypass surface is different: SEP assumes a malicious deployment hook, whereas ASPIRER assumes a malicious upstream model provider and a secret trigger embedded into the base model.

## 4. Embedded agency and failures of universal induction

In "Formalizing Embeddedness Failures in Universal Artificial Intelligence" [2505.17882], the bypass is not a security exploit but a rigorous failure mode of embedded agency. The paper contrasts a dualist or “Cartesian” view, in which the agent’s policy \(\pi\) is external to the environment, with an embedded view, in which actions and percepts are modeled symmetrically within a single universal prior. Let \(A\) be a finite action alphabet and \(E\) a finite percept alphabet. Histories \(h_{1:t} = a_1 e_1 \dots a_t e_t\) are assigned weight by lower-semicomputable semimeasures, and the embedded agent uses the joint Solomonoff-style universal semimeasure
\[
\mathbf{E}^u(h_{1:t}) = \sum_{\rho \in M_{\mathrm{semi}}} 2^{-K(\rho)} \rho(h_{1:t}).
\]
From this it derives the conditional “environment” belief
\[
\xi^U(e_{1:t}\mid a_{1:t})=\frac{\mathbf{E}^u(a_{1:t}e_{1:t})}{\mathbf{E}^u(a_{1:t})}.
\]

The central pathology is that actions are treated as evidence rather than interventions. This is stated to be formally analogous to evidential decision theory, and it permits adversarial or self-referential action patterns that drive posterior weight away from the true environment. Theorem 6 shows adversarial non-convergence of \(\mathbf{E}^u\): there exists an infinite binary sequence \(w\) with \(w_{2n}=w_{2n-1}\) for all \(n\), but \(\liminf_{n\to\infty}\mathbf{E}^u(w_{2n}\mid w_{1:2n-1})<1\). Theorem 7 transfers this to the agent-environment setting. For the identity environment \(\nu_{\mathrm{id}}\), which returns reward \(r \in \{0,1\}\) with \(e_t = a_t\), there exists an action sequence \(a_{1:\infty}\) such that, even though the true environment predicts \(e_t=a_t\) with certainty,
\[
\liminf_{t\to\infty}\xi^U(e_t\mid a_{1:t}) = 0.
\]

These theorems formalize a precise sense in which an embedded agent can “bypass” its own embedded reasoning: by conditioning on its own actions as observations, it can be forced into posterior collapse on the true environment. The paper further states that the standard causal mixture \(\xi^{AI}(e_{1:t}\mid a_{1:t}) = \sum 2^{-K(\nu)} \nu(e_{1:t}\mid a_{1:t})\) never treats actions as evidence for \(\nu\) itself, and that neither \(\xi^U \ge_m \xi^{AI}\) nor \(\xi^{AI} \ge_m \xi^U\). Suggested remedies include reflective oracles, Self-AIXI, and Solomonoff normalization. In this literature, embeddedness bypass is thus a theorem about inference under self-reference rather than an implementation bug.

## 5. Origin inheritance and blocker evasion in local frames

"Local Frames: Exploiting Inherited Origins to Bypass Content Blockers" [2506.00317] provides a web-security formulation. A local frame is an iframe whose `src` is a non-URL URI such as `about:blank`, `about:srcdoc`, `blob:...`, or `data:...`. Per the HTML5 and MDN specifications, such a frame inherits the security origin of its creator. Writing \(\mathit{Origin}(U)=\langle \mathrm{scheme}(U), \mathrm{host}(U), \mathrm{port}(U)\rangle\), the paper states
\[
\mathit{Origin}(f)=
\begin{cases}
\mathit{Origin}(\mathrm{src}(f)), & \text{if src}(f)\text{ is a URL},\\
\mathit{Origin}(\mathrm{parent}(f)), & \text{otherwise}.
\end{cases}
\]

The bypass arises because content blockers often determine blocking behavior from the request URL and a first-party/third-party classification, but many tools read the iframe’s `src` rather than the inherited `document.origin`. As a result, a local frame may be treated as an `about:` origin outside filter rules, or as the wrong party. The blocked resource remains embedded in the frame, but the blocker becomes blind to it. The attacker in this model is merely a web publisher with standard HTML and JavaScript capabilities plus the ability to wrap content in local iframes; no browser exploit is required.

The paper evaluates four core capabilities: request blocking \(\mathcal{C}_{\mathrm{block}}\), resource replacement \(\mathcal{C}_{\mathrm{replace}}\), scriptlet injection \(\mathcal{C}_{\mathrm{js}}\), and cosmetic filtering \(\mathcal{C}_{\mathrm{css}}\). Its tests use a top-level document, first-party local frames, nested local frames, third-party frames, and local frames under third-party frames. Representative cases include a third-party request-blocking rule `"*/local_script.js$third-party"`, where vulnerable tools still execute `thirdparty.com` scripts inside local frames, and an XHR redirection rule `firstparty.com$xhr,redirect=nooptext`, where vulnerable tools still insert original text inside local frames. The common vulnerability patterns are origin mis-attribution, scope violation, race conditions, and API path bifurcation [2506.00317].

The measurement study crawls 21,965 websites from Tranco ranks 1–1M. It reports that 55.7% of sites contain at least one local frame, with 52.2% first-party and 21.7% third-party. Across all sites, 2,418,425 requests were issued, and 96,262 of them, or 4.0%, occurred in local frames. Of those 96,262 local-frame requests, 70,938, or 73.7%, match EasyList/EasyPrivacy/uBlock filter lists and therefore should be blocked. A total of 5,168 sites make at least one request in a local frame; among those, 3,142 sites, or 61.9%, make at least one request that should be blocked, corresponding to 14.3% of all sites crawled. The paper reports coordinated disclosures and patches involving Brave, Safari/Apple, AdGuard, DuckDuckGo, AdBlock Plus, and uBlock Origin, and recommends resolving origins by inheritance before computing party-ness and using the same request-blocking, replacement, scriptlet, and CSS code paths for local and URL-based frames.

## 6. Geometric meanings: loss of embeddedness and bypass attachments

In geometric analysis, "Loss of embeddedness for the one-phase quasistationary Stefan problem in 2D" [2510.26924] gives a non-adversarial, dynamical meaning. The paper studies a time-dependent liquid region \(\Omega(t)\subset \mathbb{R}^2\) with interface \(\Gamma(t)=\partial\Omega(t)=F(t,S^1)\), temperature \(u(x,t)\), and normalized surface tension and kinetic undercooling. The system is
\[
\Delta u = 0 \text{ in } \Omega(t), \qquad
u|_{\Gamma(t)} = H + V_n, \qquad
V_n = -\partial_n u|_{\Gamma(t)}.
\]
The construction begins from a \(C^\infty\), simple closed curve with two large circular arcs on the left and, on the right, two unit circles connected by a very short straight segment of length \(\delta \ll 1\). After mollification, the curve remains embedded and satisfies the required compatibility condition.

The mechanism of failure proceeds by extending the Stefan flow continuously from embedded curves to possibly overlapping immersed curves via a uniformly bi-Lipschitz Hanzawa-type map \(\Theta_F\). A weak solution \(v(\cdot,t)\) is obtained on a fixed reference domain by Lax–Milgram, and the corresponding boundary trace \(u\) determines the normal evolution of the graph height \(\rho\) through
\[
\partial_t \rho = (N_0 \cdot N_F)^{-1}(-H_F + u_F).
\]
An explicit barrier argument shows that for the critical initial data one has \(-H_{F_0}+u_0>0\) on two small open subsets of the bridge, so \(\rho(t)\) increases there. By continuity and semiflow arguments, embedded approximating curves \(F_0^\varepsilon \to F_0\) then develop self-intersection at some \(t_0 \le T\). The result is a smooth and embedded initial state that loses embeddedness in finite time [2510.26924]. In this setting, embeddedness bypass means that the evolution crosses from the manifold of embedded curves to the larger class of immersed curves; the PDE itself provides no hidden repulsion against overlaps.

A distinct but related usage appears in "Bypass moves in convex hypersurface theory" [2410.04564]. There, a convex hypersurface \(\Sigma^{2n}\subset (M,\xi)\) with dividing set \(\Gamma\) and Weinstein positive and negative regions \((\bar R_\pm,\lambda_\pm,\phi_\pm)\) admits a bypass attachment specified by a quadruple
\[
(\Lambda_-,\Lambda_+;D_-,D_+),
\]
where \(\Lambda_\pm \subset \Gamma\) are Legendrian spheres intersecting transversely in a single point and \(D_\pm \subset R_\pm\) are properly embedded Lagrangian disks with \(\partial D_\pm = \Lambda_\pm\). The attachment is a smoothly canceling pair of contact handles of index \(n\) and \(n+1\), and it produces a new convex hypersurface whose dividing set is the result of contact \((+1)\)-surgery on \(\Lambda_- \cup \Lambda_+\). Breen and Christian identify clasping/unclasping and stabilizing/destabilizing as the fundamental nontrivial bypass moves in dimensions \(2n+1\ge 5\), and prove that these moves are necessary and sufficient to relate any two Weinstein domains whose stabilizations become almost symplectomorphic after one stabilization [2410.04564].

The contact-topological notion is not an exploit and does not describe evasion of a guardrail. Its relevance here is conceptual: it shows that, in geometry, “bypass” can denote a controlled local operation that changes an embedded hypersurface or its handlebody description. By contrast, the Stefan result shows an uncontrolled loss of embeddedness under evolution.

## 7. Comparative structure, misconceptions, and significance

Taken together, these works suggest a recurring architecture for embeddedness bypass. First, a system has a guarantee attached to a particular representation or context: alignment is assumed to reside in LLM weights, system prompts are assumed to dominate downstream behavior, an agent’s posterior is assumed to learn from history, blocker rules are assumed to follow origin and party boundaries, or smooth initial embeddedness is assumed to persist under evolution. Second, the decisive state variable is elsewhere: a single embedding coordinate, a hidden trigger permutation, evidential conditioning on the agent’s own actions, inherited frame origin, or a continuation of the flow into immersed curves. Third, conventional checks are insufficient because they operate at the wrong layer.

A common misconception is that bypass in these literatures is simply prompt injection. The surveyed results are substantially broader. SEP changes neither model weights nor visible input text [2509.06338]. ASPIRER allows an end user to bypass a system prompt without modifying the model or the system prompt directly, provided the base model was backdoored upstream [2410.04009]. The local-frame attacks require no browser exploit and only standard browser JavaScript and HTML [2506.00317]. The Joint AIXI results are formal theorems about posterior non-convergence under adversarial or self-referential action sequences [2505.17882]. The Stefan example has no adversary at all; embeddedness fails because the generalized flow reaches self-intersection in finite time [2510.26924].

The defensive implications are correspondingly heterogeneous. SEP motivates embedding-level integrity checks, detection of anomalous deviations \(\|E'-E\|\), embedding purification, adversarial training in embedding space, and distribution-level code integrity [2509.06338]. ASPIRER motivates rigorous base-model auditing, permutation-aware trigger scans, provenance tracking, and more comprehensive adversarial negative triggers [2410.04009]. The local-frame work recommends origin computation by inheritance and uniform code paths across blocker capabilities [2506.00317]. The embedded-agency results point toward causal-intervention semantics, self-uncertainty, and reflective-oracle-style machinery rather than evidential conditioning on actions [2505.17882]. The geometric papers instead delimit what “embeddedness” can and cannot guarantee: it is not, by itself, a barrier to topological change in the Stefan flow, whereas in contact topology bypasses form part of a constructive calculus for changing Weinstein hypersurfaces [2510.26924] [2410.04564].

In that sense, embeddedness bypass is best understood not as a single theorem or attack template, but as a family of failure modes and transformation mechanisms centered on one principle: constraints that are valid for an embedded object need not survive operations on the layer that determines how that object is represented, conditioned, or continued.

Source: https://www.emergentmind.com/topics/embeddedness-bypass