Why does compression defense fail at the user prompt boundary?
ChannelGuard's COMPRESS gate blocks injected payloads when they appear at the end of messages, but leaks them when they appear at the start. The question explores why the same defense rule produces opposite outcomes across different communication channels.
ChannelGuard's limitations section admits a design flaw in its own defense. The COMPRESS action keeps the first N=2 sentences of a message, which is a truncation heuristic with a positional premise: injected content trails the legitimate text. At the inter-agent gates (IB-2 through IB-5) the premise holds, and the compress step stopped every attack trace (a 100% compress-stop rate). At IB-0, the user-prompt gate, the compress band still leaked in 23.4% of cases (58 of 248), because user prompts more often place the payload in the first two sentences.
Same rule, two channels, opposite outcomes. The difference is where attackers write in each channel: appending to tool results, memory entries and messages, but leading in a user prompt. A sanitizer therefore encodes an assumption about attacker behavior, and attacker behavior is not uniform across channels. A gate design validated on one channel says little about another. That is a second reason a single defense placed at one boundary is weaker than it looks; see Do internal agent hops in pipelines need security monitoring?.
A caution on the 100%. It is measured on the paper's attack traces, and if those traces append the payload by construction (as synthetic poisoned tool results often do), the figure shows the gate works against appended attacks, not against an adversary who prepends. That is a plausible reading, not the paper's. It would mean the inter-agent gates are exposed to the same attack that leaked at IB-0. Appending is also a common convention among attacks generally: How vulnerable are reasoning models to irrelevant text? is another appended-payload result, which is what a first-N truncation gate is tuned to catch. The same open question sits on another defense figure in the vault: Does ChainGuard's defense hold against adaptive attacks? asks whether a reported reduction was measured against an attack built for that defense. Until the attack's construction is known, both numbers are a best case for the defender.
It is to the authors' credit that they report the weak spot with a count. Defense papers rarely quantify their own leak rate, and this one turns a flaw into a design instruction: see Should sanitizers re-score their compressed output before passing it?.
Inquiring lines that read this note 7
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Can defenses detect attacks composed across multiple skills?- Can defenses tuned against appended attacks stop prepended payloads?
- Should input defenses be validated separately for each channel?
- How do compress gates assume injection payloads appear at the user-prompt boundary?
- What happens when probing triggers containment and feedback stops arriving?
- What defensive levers shorten the time before probing gets contained?
Related concepts in this collection 4
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Do internal agent hops in pipelines need security monitoring?
Multi-agent systems route data between planner, worker, verifier, and synthesizer components. Current defenses only guard user input at the entry point, leaving inter-agent channels unmonitored—but is this a real vulnerability or does downstream safety suffice?
positional attack habits are channel-specific, so per-channel gates need per-channel validation
-
Should sanitizers re-score their compressed output before passing it?
When a gate compresses text to remove harmful content, does it need to verify the compressed remainder is still safe? The question matters because ChannelGuard's current approach assumes position—that payloads are removed—without checking if what remains passes the same safety test.
the paper's proposed remedy for this leak
-
How vulnerable are reasoning models to irrelevant text?
Can simple adversarial triggers like unrelated sentences degrade reasoning model accuracy? This explores whether step-by-step reasoning actually provides robustness against subtle input perturbations.
appended payloads as a common attack convention, the convention a first-N gate is built around
-
Does ChainGuard's defense hold against adaptive attacks?
ChainGuard reduced attack success to 22.5%, but the paper doesn't report whether the attacker refined its strategy specifically against ChainGuard's feedback, as it did against other scanners. Testing against an unadapted attacker gives defenders an unfair advantage.
the same missing condition on another defense figure: was the attack built against this defense
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- LLMs Corrupt Your Documents When You Delegate
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- A Causal Model for Locating and Unlocking Sandbagging in Model Organisms
- Stealing Reasoning Traces from Proprietary LLM APIs
- Large Language Models Meet Knowledge Graphs for Question Answering: Synthesis and Opportunities
- Trust propagation and structural containment in Multi-agent LLM pipelines
Original note title
a compress gate that keeps the first two sentences assumes injections are appended — at the user-prompt boundary payloads sit up front and leak