Injection Paradox: Context, Dynamics & Reversal
- Injection Paradox is a phenomenon where the effect of an injected signal critically depends on system structure, contextual interpretation, and dynamic regimes.
- It reveals that defensive strategies like agent isolation in LLMs dramatically reduce attack success while context-dependent defenses may inadvertently block legitimate flows.
- The concept extends beyond AI to fields like plasma physics and chemotherapy, illustrating how non-monotonic intervention effects are governed by complex boundary conditions and state-dependent dynamics.
Searching arXiv for the cited "Injection Paradox" and closely related prompt-injection papers to ground the article in current preprints. “Injection paradox” denotes a family of technical phenomena in which the effect of an injected signal depends sharply on system structure, contextual interpretation, or dynamical regime, so that injection can be highly effective in one configuration, ineffective in another, impossible to eliminate completely under fixed constraints, or even directionally reversed. In recent arXiv usage, the term is most developed in prompt-injection research for LLM systems, where it names paradoxes of architectural privilege, contextual legitimacy, latent role assignment, wrapper-defense impossibility, and safety-induced overcorrection; analogous non-monotonic uses also appear in plasma physics and closely related paradoxical reversal phenomena appear in chemotherapy models (Cheng et al., 13 Mar 2026, Abdelnabi et al., 17 May 2026, Ye et al., 22 Feb 2026, Bhatt et al., 7 Apr 2026, Paeng, 8 Jun 2026, Bello-Benítez et al., 2024, Fernández et al., 10 Mar 2025).
1. Conceptual scope and recurring structure
Recent preprints do not present a single canonical “Injection Paradox.” Rather, they use the phrase for several distinct but structurally related situations. In prompt-injection security, one formulation is architectural: prompt injection is dangerous when raw attacker-controlled text reaches the same agent that can execute privileged tools, but becomes dramatically weaker when reading and acting are privilege-separated (Cheng et al., 13 Mar 2026). A second formulation is contextual: an adversary can make a blocked flow appear legitimate, while a defender that tightens norms enough to stop the attack also blocks legitimate flows (Abdelnabi et al., 17 May 2026). A third is mechanistic: security boundaries are specified at the interface, but authority is assigned in latent space, so text that merely looks like a trusted role can inherit that role’s authority (Ye et al., 22 Feb 2026). A fourth is geometric: for connected prompt spaces, no continuous, utility-preserving wrapper can make all outputs strictly safe (Bhatt et al., 7 Apr 2026). A fifth is behavioral: in safety-trained RAG recommendation, an embedded prompt injection can suppress the target brand below the no-injection baseline, rather than boosting it (Paeng, 8 Jun 2026).
Outside LLM security, the phrase is used for non-monotonic dependence on injection conditions. In the electron-cyclotron drift instability, axial removal and replenishment of ions can sustain oscillations and transport, but only when the ion residence time is comparable to the intrinsic saturation time; renewal that is too slow or too fast suppresses the long-time transport state (Bello-Benítez et al., 2024). In oncology, a related “works backwards” paradox arises when chemotherapy, modeled through the Norton–Simon hypothesis, can accelerate rather than reduce tumor growth for some initial tumor–vasculature states (Fernández et al., 10 Mar 2025). This suggests a common family resemblance: intervention efficacy is governed not only by local signal content or dose magnitude, but by information flow, boundary conditions, and state-dependent nonlinear dynamics.
2. Structural prompt injection in privilege-separated agents
A concrete systems-level formulation appears in OpenClaw’s replication of Microsoft’s LLMail-Inject benchmark. The threat model is standard indirect prompt injection: malicious instructions are hidden in untrusted content, here email bodies, while the agent is expected to perform a benign task such as summarizing emails. The benchmark scenarios are: $2$ emails, no RAG, “Send to attacker”; $10$ emails, no RAG, “Send to attacker”; $10$ emails + RAG, “Send to attacker”; and $10$ emails + RAG, “Exfiltrate budget.” The evaluation funnel is total attack submissions in the original challenge, Phase 1 successes after filtering, unique payloads after deduplication by body, and $649$ attacks that still succeed against the OpenClaw gpt-5-mini single-agent baseline. On the full -attack set, the baseline ASR is , with $10$0 successful attacks and $10$1 resistance (Cheng et al., 13 Mar 2026).
The defense combines two mechanisms. Agent isolation is implemented as a privilege-separated two-agent pipeline with tool partitioning: Agent 1, the reader, has store_summary only, reads raw email content, produces a structured summary, and cannot call send_email; Agent 2, the actor, has send_email, get_pending_summary, and store_result, reads only Agent 1’s output, and never sees raw email content. JSON formatting narrows the communication channel to fields such as sender, subject, body summary, and action items. A lightweight validator checks summaries in audit mode using regex rules for email address literals, tool-call fragments, and common injection phrases; in the experiments it does not block anything. The defended pipeline is therefore Reader agent $10$2 validated JSON summary $10$3 Actor agent with privileged tools, and the paper states that it “eliminates the direct injection path to send_email” (Cheng et al., 13 Mar 2026).
| Configuration | ASR | Successful attacks |
|---|---|---|
| Baseline | 100% | 649 |
| JSON Validator Only | 14.18% | 92 |
| Two-Agent Only | 0.31% | 2 |
| Pipeline (full) | 0.0% | 0 |
These ablations are the central empirical result. JSON formatting alone is helpful but insufficient; it leaves $10$4 successful attacks. Two-agent isolation alone reduces ASR to $10$5, approximately $10$6 lower than the baseline, leaving only $10$7 residual successes. The full pipeline achieves $10$8 ASR on the evaluated benchmark. The per-scenario breakdown reinforces the same conclusion: scenario 4, “Data exfiltration,” is hardest for JSON-only defense at $10$9 ASR, but both two-agent configurations achieve $10$0; scenario 3, “RAG query,” is also perfectly defended by Two-Agent Only and the full pipeline, while JSON-only still leaks. The paper’s explicit interpretation is that agent isolation is the dominant mechanism, while JSON formatting provides additional hardening but is not sufficient on its own (Cheng et al., 13 Mar 2026).
This formulation gives one precise sense of the paradox. Prompt injection is highly effective when the model exposed to attacker-controlled text is also empowered to act, yet becomes ineffective or dramatically blunted when that coupling is broken. The key safety property is architectural rather than heuristic: the component that sees untrusted input lacks the dangerous tool, and the privileged component never sees raw injection text.
3. Contextual legitimacy and latent authority
A broader conceptual formulation argues that prompt injection cannot be adequately understood as “instructions hidden in data.” In increasingly autonomous agents, many attacks are not syntactic overrides such as “ignore previous instructions,” but contextual claims like “the user already approved this,” “the manager cleared it,” or “this is standard policy.” At the same time, real agentic workflows legitimately place actionable content in email, tools, memory, shared skills, and multi-agent messages. Reframing the problem through Contextual Integrity (CI), this work treats agent action as an information flow governed by five parameters—sender, receiver, subject, information type, and transmission principle—and studies three scenario families: misrepresenting the flow, manipulating norms, and mixing multiple flows. The central claim is an impossibility-style tradeoff: an adversary can always construct a context under which a blocked flow appears legitimate, or a defender who tightens the norm enough to stop the attack will also block legitimate flows. Empirically, prompt injection classifiers perform near chance on contextual manipulation, with AUROC roughly $10$1–$10$2; CI-aware red-teaming reaches about $10$3 success in context-parameter attacks on the email assistant; and longer history both improves norm inference and creates new opportunities for anchoring misleading norms (Abdelnabi et al., 17 May 2026).
A mechanistic account sharpens this by locating the failure inside the model. “Prompt Injection as Role Confusion” argues that models infer roles from how text is written, not where it comes from. The paper introduces role probes—linear classifiers over hidden states trained on neutral text from C4 and Dolma3 wrapped in different role tags—to estimate internal quantities such as CoTness, Userness, Assistantness, Toolness, and Systemness. These probes generalize zero-shot to real dialogue, fire on untagged text that merely looks like the role, and can classify incorrectly tagged text according to its style rather than its tag. The main attacks exploit this by forging chain-of-thought-like reasoning or user-style instructions inside low-privilege channels. Reported attack success is $10$4 on StrongREJECT and $10$5 on agent exfiltration, with near-zero baselines; removing stylistic markers while preserving semantic argument drops attack success from $10$6 to $10$7. Internal role confusion predicts success before generation begins: for CoT Forgery, the lowest-confusion quantile yields $10$8 success and the highest-confusion quantile $10$9; for agent hijacking, the lowest Userness quantile is $10$0 and the highest $10$1 (Ye et al., 22 Feb 2026).
Taken together, these results displace a common misconception that prompt injection is primarily a string-level pattern-matching problem. In these formulations, the decisive variable is contextual appropriateness or latent authority assignment. A model can “know” at the interface that text arrived via a tool or a user message, yet internally represent it as assistant reasoning or privileged instruction.
4. Formal impossibility results and defense trilemmas
A more abstract sense of the injection paradox is formulated as a theorem about wrapper defenses. “The Defense Trilemma” models a defense as a preprocessing map
$10$2
on a connected prompt space $10$3, together with a continuous alignment deviation function $10$4 and a threshold $10$5. The safe, unsafe, and boundary sets are
$10$6
Utility preservation is defined by
$10$7
and completeness by
$10$8
The central theorem states that when $10$9 is a connected Hausdorff space and both 0 and 1 are nonempty, no 2 can simultaneously be continuous, utility-preserving, and complete. The progression of failure modes is explicit: boundary fixation, where some threshold-level prompt must remain fixed; an 3-robust constraint, where a positive-measure band around fixed boundary points remains near threshold under Lipschitz regularity; and a persistent unsafe region, where a positive-measure subset remains strictly unsafe under a transversality condition. The theory is mechanically verified in Lean 4 and validated empirically on three LLMs (Bhatt et al., 7 Apr 2026).
A related impossibility appears in the “Jailbreak Paradox.” There, an LLM is modeled as
4
and successful jailbreaks are model-dependent subsets of malicious prompts. The paper’s first theorem states that there will always exist LLMs for which there will be no strong jailbreak classifier, where a strong classifier achieves arbitrarily good accuracy. The second theorem states that a Pareto-dominant model can detect jailbreaks of a dominated model, but a dominated model can never detect all jailbreaks of a Pareto-dominant model. The empirical case study uses Llama-2-7B-chat, Tamil-Llama, and GPT-4o, with Tamil-Llama-Eval overall scores of 5, 6, and 7, respectively, to illustrate the capability ordering (Rao et al., 2024).
These results delimit the scope of what “solving” prompt injection can mean. They do not rule out training-time alignment, architectural changes, discontinuous defenses, output-side filters, ensemble defenses, human review, adaptive-threshold systems, or systems that reject or redirect inputs. They do, however, rule out specific ideals: a single smooth wrapper that preserves all safe behavior and guarantees safety for every input, or a universally sufficient weaker detector for stronger models (Bhatt et al., 7 Apr 2026, Rao et al., 2024).
5. Backfiring injections in RAG recommendation
A different prompt-injection paradox appears in recommendation. In a RAG-style generation setup for recommending wireless earbuds in Korean, 8 retrieved documents across 9 brands are injected into the model context in search-result format. The main target brand is Edifier NeoBuds Pro 3. Only 0 of the 1 documents is modified in the primary setup—2 of the corpus—and the injected payload is inserted into a single Edifier review (blog_210) in three places: a metadata-like block, a Korean editor’s-note prefix, and an English evaluation-checklist suffix. The study runs over 3 trials across GPT-4o-mini, GPT-5-nano, GPT-5-mini, GPT-5.4, Claude Haiku 4.5, Claude Sonnet 4.6, and Claude Opus 4.6, with the main metric defined as the top-2 recommendation hit rate for the target brand (Paeng, 8 Jun 2026).
| Model | Baseline 4 Injection | Combined condition |
|---|---|---|
| GPT-4o-mini | 17% 5 40% | 67% |
| Claude Haiku 4.5 | 14% 6 12% | 48% |
| Claude Sonnet 4.6 | 26% 7 8% | 2% |
| Claude Opus 4.6 | 54% 8 8% | 0% |
The paradox is that in safety-trained Claude models, especially Sonnet and Opus, the injected document does not promote the target brand; it suppresses it below the injection-free baseline. In Claude Opus 4.6, the target brand falls from a 9 baseline to 0 top-2 recommendations across all 1 trials under the Combined condition, even though only 2 of 3 Edifier documents in the corpus contains an injection. Counterfactual experiments sharpen the causal reading: with the injected Edifier document removed, the 3-document baseline is 4 for Opus and 5 for Sonnet, whereas keeping that document and adding the injection yields 6 and 7, respectively. The effect therefore appears worse than simply losing the injected document. The paper interprets this as a brand-level trustworthiness penalty that propagates beyond the injected document to unmodified documents of the same brand. It also reports that the directional pattern reproduces across three brands, while moving the injection to an Apple document does not meaningfully reduce Edifier’s rate, arguing against a corpus-wide distrust explanation (Paeng, 8 Jun 2026).
This result directly contradicts the common assumption that prompt injection, if effective, must increase the attacker’s preferred ranking. In these safety-trained recommendation models, the same injected content can instead trigger an overcorrection that harms the target brand and creates the technical possibility of a reverse-attack scenario in which an adversary embeds injections in a competitor’s documents to suppress the competitor.
6. Injection conditions in ECDI and anomalous transport
In plasma physics, the term is used for the electron-cyclotron drift instability (ECDI) in Hall plasmas. Electrons are strongly magnetized by the radial magnetic field 8, the equilibrium electric field is 9, and the resulting $649$0 electron drift is
$649$1
Short-wavelength electrostatic modes driven by this cross-field drift can induce anomalous axial electron transport. In fully periodic two-dimensional kinetic simulations faithful to the classical linear theory, the instability grows from noise, resonant bands appear near $649$2, ion-wave trapping vortices form in phase space, and an induced axial electron current appears early. The crucial nonlinear result, however, is saturation: the oscillations decay into a new stationary state with mild residual oscillations and mild anomalous current, consistent with energy conservation and the long-time distortion and blurring of ion trapping vortices (Bello-Benítez et al., 2024).
The paradox emerges when axial periodicity is replaced by removal/injection boundaries. Ions are injected with flux $649$3, zero temperature, and velocity $649$4; electrons use half-Maxwellian fluxes $649$5; and the key control parameter becomes the ion residence time
$649$6
to be compared with the periodic-system saturation time $649$7, which for the reference hydrogen case is $649$8–$649$9. Three regimes are reported. If 0, ions live too long and the system behaves much like the periodic case: initial growth, then weakening oscillations, fading transport, and late-time current tending to zero. If 1, ions leave too quickly: the ECDI grows only partially, dominant modes remain near 2 and weakly 3, and the induced axial current is very small. Only the intermediate regime, 4, with examples 5–6 km/s, sustains long-time oscillations and nonzero axial electron current. The paper therefore resolves the paradox by rejecting monotonic intuition: continuous ion renewal sustains transport only when renewal is neither too slow nor too fast (Bello-Benítez et al., 2024).
This is a boundary-condition paradox rather than an adversarial one. Nonetheless, the logical structure is closely parallel to the LLM cases: the same injected input—here renewed ions—changes the system’s fate only when the coupling between intrinsic saturation and boundary-driven replenishment is in the appropriate regime.
7. Paradoxical reversal in chemotherapy and broader significance
A related but distinct reversal phenomenon appears in a minimally parameterized tumor–vasculature model of chemotherapy. Without therapy, tumor volume 7 and effective vascular support 8 evolve as
9
0
With therapy, the model includes both cytotoxic and antiangiogenic effects: 1
2
The cytotoxic effect follows the Norton–Simon form rather than a simple additive log-kill term, and the pharmacodynamic law is
3
For constant effects, if 4, the dynamics resemble the untreated model with shifted parameters; if 5, the model enters the paradoxical regime, where with the same therapy some initial conditions are normal and others abnormal, yielding either 6 or 7. The paper defines normal points as initial states where therapy leads to tumor decay and abnormal points as states where therapy causes the tumor to grow more than without treatment, possibly diverging or reaching the critical size sooner (Fernández et al., 10 Mar 2025).
Two theoretical strategies are proposed to avoid the anomaly: delaying cytotoxic therapy so the untreated system moves to a more favorable state, and applying antiangiogenic therapy first to normalize the vasculature before cytotoxic treatment. Although this work is framed as a “works backwards” paradox rather than explicitly as an injection paradox, it fits the same broad pattern of state-dependent non-monotonic intervention. This suggests a general interpretation across domains: paradoxes of injection arise when the injected signal does not act on an isolated target variable, but instead perturbs a coupled system whose authority structure, contextual norm, boundary condition, or phase portrait determines whether the intervention amplifies, neutralizes, localizes, or reverses its intended effect (Fernández et al., 10 Mar 2025).
