A safety filter that keeps only the first two sentences bets attackers hide instructions at the end — what if they lead?

This explores what a compression gate is silently betting about where an attacker hides instructions, and why that bet breaks at the user-prompt boundary. The question has the assumption slightly inverted. The gate doesn't assume payloads arrive at the user prompt. It assumes they are appended to the end of otherwise legitimate text, so a gate that keeps only the first couple of sentences throws the payload away. ChannelGuard's COMPRESS defense stopped 100% of leaks at inter-agent gates but failed in 23.4% of cases at the user-prompt boundary Why does compression defense fail at the user prompt boundary?. Users can prepend a payload, which puts it in the part the gate keeps.

The compression itself isn't the flaw, since it worked perfectly on one channel. The flaw is a hidden positional guess about attacker behavior that holds on one channel and not another. Every sanitizer carries a threat model in its mechanics: truncation says 'attackers go last', and keyword filters say 'attackers use these words'. Nobody wrote the assumption down, so nobody noticed it was channel-specific.

The proposed fix is to make the assumption checkable. After compressing, the gate re-scores what it kept against the same threshold it used on the original, and passes the text only if it still clears Should sanitizers re-score their compressed output before passing it?. A prepended payload that survives truncation would then get caught on the second look. The corpus is candid that this is a remedy, not a result. The cost of re-scoring, the blind spots of the detector doing it, and real-world effectiveness are all untested.

The same mistake, defending at a spot that can't see the attack, recurs across the collection. Prompt hardening cut payload exposure 40–75% for single agents but did nothing for multi-agent systems, because the agent holding the security instructions wasn't the one taking the risky action Why does prompt hardening work for single agents but not multi-agent systems?. FLOWSTEER shows a crafted prompt can steer planner-executor systems while the workflow is still being formed, upstream of the defenses that inspect workflows Can prompts alone reshape multi-agent workflows without system access?. Stateless per-action checks have a related limit: they can't state constraints that depend on what came before Can stateless checks ever catch sequence-level constraint violations?.

The collection's answer is to stack gates at different boundaries rather than trust one positional guess. SafeFlow validates the assembled workflow at the commit point before an irreversible action, and it complements planning-boundary and per-hop defenses because each catches attacks the others miss Where should workflow validation gates be placed for safety?. One paper reports zero unsafe actions with an authorization layer kept outside the poisoned path, but the excerpt doesn't say how the layer works or whether attacks were aimed at it How does the authorization layer stay outside the poisoned path?. So the corpus can tell you why the 23.4% leak happens, but it doesn't yet show that the fix works.