---
title: 'Injection Paradox: Context, Dynamics & Reversal'
url: https://www.emergentmind.com/topics/injection-paradox
type: topic
---

# Injection Paradox: Context, Dynamics & Reversal

Searching arXiv for the cited "Injection Paradox" and closely related prompt-injection papers to ground the article in current preprints.
“Injection paradox” denotes a family of technical phenomena in which the effect of an injected signal depends sharply on system structure, contextual interpretation, or dynamical regime, so that injection can be highly effective in one configuration, ineffective in another, impossible to eliminate completely under fixed constraints, or even directionally reversed. In recent arXiv usage, the term is most developed in prompt-injection research for LLM systems, where it names paradoxes of architectural privilege, contextual legitimacy, latent role assignment, wrapper-defense impossibility, and safety-induced overcorrection; analogous non-monotonic uses also appear in plasma physics and closely related paradoxical reversal phenomena appear in chemotherapy models [2603.13424] [2605.17634] [2603.12277] [2604.06436] [2606.09204] [2405.08761] [2503.10670].

## 1. Conceptual scope and recurring structure

Recent preprints do not present a single canonical “Injection Paradox.” Rather, they use the phrase for several distinct but structurally related situations. In prompt-injection security, one formulation is architectural: prompt injection is dangerous when raw attacker-controlled text reaches the same agent that can execute privileged tools, but becomes dramatically weaker when reading and acting are privilege-separated [2603.13424]. A second formulation is contextual: an adversary can make a blocked flow appear legitimate, while a defender that tightens norms enough to stop the attack also blocks legitimate flows [2605.17634]. A third is mechanistic: security boundaries are specified at the interface, but authority is assigned in latent space, so text that merely *looks like* a trusted role can inherit that role’s authority [2603.12277]. A fourth is geometric: for connected prompt spaces, no continuous, utility-preserving wrapper can make all outputs strictly safe [2604.06436]. A fifth is behavioral: in safety-trained RAG recommendation, an embedded prompt injection can suppress the target brand below the no-injection baseline, rather than boosting it [2606.09204].

Outside LLM security, the phrase is used for non-monotonic dependence on injection conditions. In the electron-cyclotron drift instability, axial removal and replenishment of ions can sustain oscillations and transport, but only when the ion residence time is comparable to the intrinsic saturation time; renewal that is too slow or too fast suppresses the long-time transport state [2405.08761]. In oncology, a related “works backwards” paradox arises when chemotherapy, modeled through the Norton–Simon hypothesis, can accelerate rather than reduce tumor growth for some initial tumor–vasculature states [2503.10670]. This suggests a common family resemblance: intervention efficacy is governed not only by local signal content or dose magnitude, but by information flow, boundary conditions, and state-dependent nonlinear dynamics.

## 2. Structural prompt injection in privilege-separated agents

A concrete systems-level formulation appears in OpenClaw’s replication of Microsoft’s LLMail-Inject benchmark. The threat model is standard indirect prompt injection: malicious instructions are hidden in untrusted content, here email bodies, while the agent is expected to perform a benign task such as summarizing emails. The benchmark scenarios are: \(2\) emails, no RAG, “Send to attacker”; \(10\) emails, no RAG, “Send to attacker”; \(10\) emails + RAG, “Send to attacker”; and \(10\) emails + RAG, “Exfiltrate budget.” The evaluation funnel is \(461{,}640\) total attack submissions in the original challenge, \(41{,}173\) Phase 1 successes after filtering, \(22{,}899\) unique payloads after deduplication by body, and \(649\) attacks that still succeed against the OpenClaw `gpt-5-mini` single-agent baseline. On the full \(22{,}899\)-attack set, the baseline ASR is \(2.83\%\), with \(649\) successful attacks and \(97.2\%\) resistance [2603.13424].

The defense combines two mechanisms. Agent isolation is implemented as a privilege-separated two-agent pipeline with tool partitioning: Agent 1, the reader, has `store_summary` only, reads raw email content, produces a structured summary, and cannot call `send_email`; Agent 2, the actor, has `send_email`, `get_pending_summary`, and `store_result`, reads only Agent 1’s output, and never sees raw email content. JSON formatting narrows the communication channel to fields such as sender, subject, body summary, and action items. A lightweight validator checks summaries in audit mode using regex rules for email address literals, tool-call fragments, and common injection phrases; in the experiments it does not block anything. The defended pipeline is therefore Reader agent \(\rightarrow\) validated JSON summary \(\rightarrow\) Actor agent with privileged tools, and the paper states that it “eliminates the direct injection path to `send_email`” [2603.13424].

| Configuration | ASR | Successful attacks |
|---|---:|---:|
| Baseline | 100% | 649 |
| JSON Validator Only | 14.18% | 92 |
| Two-Agent Only | 0.31% | 2 |
| Pipeline (full) | 0.0% | 0 |

These ablations are the central empirical result. JSON formatting alone is helpful but insufficient; it leaves \(92\) successful attacks. Two-agent isolation alone reduces ASR to \(0.31\%\), approximately \(323\times\) lower than the baseline, leaving only \(2\) residual successes. The full pipeline achieves \(0\%\) ASR on the evaluated benchmark. The per-scenario breakdown reinforces the same conclusion: scenario 4, “Data exfiltration,” is hardest for JSON-only defense at \(28.3\%\) ASR, but both two-agent configurations achieve \(0\%\); scenario 3, “RAG query,” is also perfectly defended by Two-Agent Only and the full pipeline, while JSON-only still leaks. The paper’s explicit interpretation is that **agent isolation is the dominant mechanism**, while JSON formatting provides additional hardening but is not sufficient on its own [2603.13424].

This formulation gives one precise sense of the paradox. Prompt injection is highly effective when the model exposed to attacker-controlled text is also empowered to act, yet becomes ineffective or dramatically blunted when that coupling is broken. The key safety property is architectural rather than heuristic: the component that sees untrusted input lacks the dangerous tool, and the privileged component never sees raw injection text.

## 3. Contextual legitimacy and latent authority

A broader conceptual formulation argues that prompt injection cannot be adequately understood as “instructions hidden in data.” In increasingly autonomous agents, many attacks are not syntactic overrides such as “ignore previous instructions,” but contextual claims like “the user already approved this,” “the manager cleared it,” or “this is standard policy.” At the same time, real agentic workflows legitimately place actionable content in email, tools, memory, shared skills, and multi-agent messages. Reframing the problem through Contextual Integrity (CI), this work treats agent action as an information flow governed by five parameters—sender, receiver, subject, information type, and transmission principle—and studies three scenario families: misrepresenting the flow, manipulating norms, and mixing multiple flows. The central claim is an impossibility-style tradeoff: an adversary can always construct a context under which a blocked flow appears legitimate, or a defender who tightens the norm enough to stop the attack will also block legitimate flows. Empirically, prompt injection classifiers perform near chance on contextual manipulation, with AUROC roughly \(0.43\)–\(0.59\); CI-aware red-teaming reaches about \(96.7\%\) success in context-parameter attacks on the email assistant; and longer history both improves norm inference and creates new opportunities for anchoring misleading norms [2605.17634].

A mechanistic account sharpens this by locating the failure inside the model. “Prompt Injection as Role Confusion” argues that models infer roles from how text is written, not where it comes from. The paper introduces role probes—linear classifiers over hidden states trained on neutral text from C4 and Dolma3 wrapped in different role tags—to estimate internal quantities such as CoTness, Userness, Assistantness, Toolness, and Systemness. These probes generalize zero-shot to real dialogue, fire on untagged text that merely *looks like* the role, and can classify incorrectly tagged text according to its style rather than its tag. The main attacks exploit this by forging chain-of-thought-like reasoning or user-style instructions inside low-privilege channels. Reported attack success is \(60\%\) on StrongREJECT and \(61\%\) on agent exfiltration, with near-zero baselines; removing stylistic markers while preserving semantic argument drops attack success from \(61\%\) to \(10\%\). Internal role confusion predicts success before generation begins: for CoT Forgery, the lowest-confusion quantile yields \(9\%\) success and the highest-confusion quantile \(90\%\); for agent hijacking, the lowest Userness quantile is \(2\%\) and the highest \(70\%\) [2603.12277].

Taken together, these results displace a common misconception that prompt injection is primarily a string-level pattern-matching problem. In these formulations, the decisive variable is contextual appropriateness or latent authority assignment. A model can “know” at the interface that text arrived via a tool or a user message, yet internally represent it as assistant reasoning or privileged instruction.

## 4. Formal impossibility results and defense trilemmas

A more abstract sense of the injection paradox is formulated as a theorem about wrapper defenses. “The Defense Trilemma” models a defense as a preprocessing map
\[
D:X\to X
\]
on a connected prompt space \(X\), together with a continuous alignment deviation function \(f:X\to\mathbb{R}\) and a threshold \(\tau\). The safe, unsafe, and boundary sets are
\[
S_\tau=\{x\in X:f(x)<\tau\},\qquad U_\tau=\{x\in X:f(x)>\tau\},\qquad B_\tau=\{x\in X:f(x)=\tau\}.
\]
Utility preservation is defined by
\[
D(x)=x\quad\text{for all }x\in S_\tau,
\]
and completeness by
\[
f(D(x))<\tau\quad\text{for all }x\in X.
\]
The central theorem states that when \(X\) is a connected Hausdorff space and both \(S_\tau\) and \(U_\tau\) are nonempty, no \(D\colon X\to X\) can simultaneously be continuous, utility-preserving, and complete. The progression of failure modes is explicit: boundary fixation, where some threshold-level prompt must remain fixed; an \(\varepsilon\)-robust constraint, where a positive-measure band around fixed boundary points remains near threshold under Lipschitz regularity; and a persistent unsafe region, where a positive-measure subset remains strictly unsafe under a transversality condition. The theory is mechanically verified in Lean 4 and validated empirically on three LLMs [2604.06436].

A related impossibility appears in the “Jailbreak Paradox.” There, an LLM is modeled as
\[
G:\Sigma^*\rightarrow\Sigma^*,
\]
and successful jailbreaks are model-dependent subsets of malicious prompts. The paper’s first theorem states that there will always exist LLMs for which there will be no strong jailbreak classifier, where a strong classifier achieves arbitrarily good accuracy. The second theorem states that a Pareto-dominant model can detect jailbreaks of a dominated model, but a dominated model can never detect all jailbreaks of a Pareto-dominant model. The empirical case study uses Llama-2-7B-chat, Tamil-Llama, and GPT-4o, with Tamil-Llama-Eval overall scores of \(22.7\), \(51.2\), and \(88.2\), respectively, to illustrate the capability ordering [2406.12702].

These results delimit the scope of what “solving” prompt injection can mean. They do not rule out training-time alignment, architectural changes, discontinuous defenses, output-side filters, ensemble defenses, human review, adaptive-threshold systems, or systems that reject or redirect inputs. They do, however, rule out specific ideals: a single smooth wrapper that preserves all safe behavior and guarantees safety for every input, or a universally sufficient weaker detector for stronger models [2604.06436] [2406.12702].

## 5. Backfiring injections in RAG recommendation

A different prompt-injection paradox appears in recommendation. In a RAG-style generation setup for recommending wireless earbuds in Korean, \(40\) retrieved documents across \(9\) brands are injected into the model context in search-result format. The main target brand is Edifier NeoBuds Pro 3. Only \(1\) of the \(40\) documents is modified in the primary setup—\(2.5\%\) of the corpus—and the injected payload is inserted into a single Edifier review (`blog_210`) in three places: a metadata-like block, a Korean editor’s-note prefix, and an English evaluation-checklist suffix. The study runs over \(4{,}500\) trials across GPT-4o-mini, GPT-5-nano, GPT-5-mini, GPT-5.4, Claude Haiku 4.5, Claude Sonnet 4.6, and Claude Opus 4.6, with the main metric defined as the top-2 recommendation hit rate for the target brand [2606.09204].

| Model | Baseline \(\rightarrow\) Injection | Combined condition |
|---|---:|---:|
| GPT-4o-mini | 17% \(\rightarrow\) 40% | 67% |
| Claude Haiku 4.5 | 14% \(\rightarrow\) 12% | 48% |
| Claude Sonnet 4.6 | 26% \(\rightarrow\) 8% | 2% |
| Claude Opus 4.6 | 54% \(\rightarrow\) 8% | 0% |

The paradox is that in safety-trained Claude models, especially Sonnet and Opus, the injected document does not promote the target brand; it suppresses it below the injection-free baseline. In Claude Opus 4.6, the target brand falls from a \(54\%\) baseline to \(0\%\) top-2 recommendations across all \(50\) trials under the Combined condition, even though only \(1\) of \(4\) Edifier documents in the corpus contains an injection. Counterfactual experiments sharpen the causal reading: with the injected Edifier document removed, the 3-document baseline is \(28\%\) for Opus and \(8\%\) for Sonnet, whereas keeping that document and adding the injection yields \(0\%\) and \(2\%\), respectively. The effect therefore appears worse than simply losing the injected document. The paper interprets this as a brand-level trustworthiness penalty that propagates beyond the injected document to unmodified documents of the same brand. It also reports that the directional pattern reproduces across three brands, while moving the injection to an Apple document does not meaningfully reduce Edifier’s rate, arguing against a corpus-wide distrust explanation [2606.09204].

This result directly contradicts the common assumption that prompt injection, if effective, must increase the attacker’s preferred ranking. In these safety-trained recommendation models, the same injected content can instead trigger an overcorrection that harms the target brand and creates the technical possibility of a reverse-attack scenario in which an adversary embeds injections in a competitor’s documents to suppress the competitor.

## 6. Injection conditions in ECDI and anomalous transport

In plasma physics, the term is used for the electron-cyclotron drift instability (ECDI) in Hall plasmas. Electrons are strongly magnetized by the radial magnetic field \(\mathbf B_0=B_0\mathbf 1_x\), the equilibrium electric field is \(\mathbf E_0=E_0\mathbf 1_z\), and the resulting \(\mathbf E_0\times\mathbf B_0\) electron drift is
\[
u_{ye0}=\frac{E_0}{B_0}.
\]
Short-wavelength electrostatic modes driven by this cross-field drift can induce anomalous axial electron transport. In fully periodic two-dimensional kinetic simulations faithful to the classical linear theory, the instability grows from noise, resonant bands appear near \(m=1,2,\dots\), ion-wave trapping vortices form in phase space, and an induced axial electron current appears early. The crucial nonlinear result, however, is saturation: the oscillations decay into a new stationary state with mild residual oscillations and mild anomalous current, consistent with energy conservation and the long-time distortion and blurring of ion trapping vortices [2405.08761].

The paradox emerges when axial periodicity is replaced by removal/injection boundaries. Ions are injected with flux \(n_0u_{zi0}\), zero temperature, and velocity \(u_{zi0}\mathbf 1_z\); electrons use half-Maxwellian fluxes \(\pm n_0c_{e0}/\sqrt{2\pi}\); and the key control parameter becomes the ion residence time
\[
\Delta t_{i0}=\frac{L_z}{u_{zi0}},
\]
to be compared with the periodic-system saturation time \(\Delta t_{\text{sat}}\), which for the reference hydrogen case is \(\sim 0.16\)–\(0.18~\mu\text{s}\). Three regimes are reported. If \(\Delta t_{i0}\gg\Delta t_{\text{sat}}\), ions live too long and the system behaves much like the periodic case: initial growth, then weakening oscillations, fading transport, and late-time current tending to zero. If \(\Delta t_{i0}\ll\Delta t_{\text{sat}}\), ions leave too quickly: the ECDI grows only partially, dominant modes remain near \(m=1\) and weakly \(m=2\), and the induced axial current is very small. Only the intermediate regime, \(\Delta t_{i0}\sim\Delta t_{\text{sat}}\), with examples \(u_{zi0}\approx 10\)–\(15\) km/s, sustains long-time oscillations and nonzero axial electron current. The paper therefore resolves the paradox by rejecting monotonic intuition: continuous ion renewal sustains transport only when renewal is neither too slow nor too fast [2405.08761].

This is a boundary-condition paradox rather than an adversarial one. Nonetheless, the logical structure is closely parallel to the LLM cases: the same injected input—here renewed ions—changes the system’s fate only when the coupling between intrinsic saturation and boundary-driven replenishment is in the appropriate regime.

## 7. Paradoxical reversal in chemotherapy and broader significance

A related but distinct reversal phenomenon appears in a minimally parameterized tumor–vasculature model of chemotherapy. Without therapy, tumor volume \(V(t)\) and effective vascular support \(K(t)\) evolve as
\[
V'(t)=-\lambda_1V(t)\log\!\left(\frac{V(t)}{K(t)}\right),
\]
\[
K'(t)=-\lambda_2K(t)+bV(t)-dK(t)V^{2/3}(t).
\]
With therapy, the model includes both cytotoxic and antiangiogenic effects:
\[
V'(t)=-\lambda_1V(t)\log\!\left(\frac{V(t)}{K(t)}\right)\bigl(1-E_c(t)\bigr),
\]
\[
K'(t)=-\lambda_2K(t)+\frac{bV(t)}{1+E_a(t)}-dK(t)V^{2/3}(t).
\]
The cytotoxic effect follows the Norton–Simon form rather than a simple additive log-kill term, and the pharmacodynamic law is
\[
E_c(t)=\frac{k_1c_c(t)}{k_2+c_c(t)}.
\]
For constant effects, if \(E_c<1\), the dynamics resemble the untreated model with shifted parameters; if \(E_c>1\), the model enters the paradoxical regime, where with the same therapy some initial conditions are normal and others abnormal, yielding either \(\lim_{t\to\infty}V(t)=0\) or \(\lim_{t\to\infty}V(t)=+\infty\). The paper defines normal points as initial states where therapy leads to tumor decay and abnormal points as states where therapy causes the tumor to grow more than without treatment, possibly diverging or reaching the critical size sooner [2503.10670].

Two theoretical strategies are proposed to avoid the anomaly: delaying cytotoxic therapy so the untreated system moves to a more favorable state, and applying antiangiogenic therapy first to normalize the vasculature before cytotoxic treatment. Although this work is framed as a “works backwards” paradox rather than explicitly as an injection paradox, it fits the same broad pattern of state-dependent non-monotonic intervention. This suggests a general interpretation across domains: paradoxes of injection arise when the injected signal does not act on an isolated target variable, but instead perturbs a coupled system whose authority structure, contextual norm, boundary condition, or phase portrait determines whether the intervention amplifies, neutralizes, localizes, or reverses its intended effect [2503.10670].

Source: https://www.emergentmind.com/topics/injection-paradox