Prompt Injection as an Architectural Primitive: Why Detection Baselines Fail in Agentic Pipelines

Paper, experimental harness, and complete raw run data for a study of why detection-based defenses fail against semantic poisoning in agentic LLM pipelines.

Prompt injection is conventionally treated as a vulnerability class: an input-validation failure to be patched with filters, classifiers, and guardrails. This work argues that framing is wrong for agentic systems. In any architecture that evaluates instructions and data over a single shared channel, injection is an emergent property of the computational model itself, in the same way that SQL injection was an emergent property of string-concatenated queries. The paper formalizes this through a channel-collapse criterion, shows that LLM agent architectures satisfy it by construction, and shows that the property composes: in multi-agent pipelines, every inter-agent hop is a new injection surface.

The defensive landscape is decomposed into three problems the literature has conflated: type confusion (addressed by embedding-level separation such as ASIDE), control-flow hijacking (addressed by plan-fixing systems such as CaMeL), and causal provenance, which asks whether an instruction or conclusion is authorized by the original principal and whether the reasoning chain that produced it is traceable to authorized data and authorized inference steps. The third problem is unsolved and survives complete deployment of solutions to the first two.

Experimental results across 195 runs on two production models: coherent semantic poisoning corrupted the pipeline conclusion in 50 of 50 trials while producing zero behavioural deviation from a fully learned benign baseline, and every imperative injection variant failed in 145 of 145 trials. The strongest deployed detector family scored semantic poisoning as marginally less suspicious than ordinary content (AUC 0.483). Five architectural requirements for any future provenance mechanism are derived.

All raw run data is committed, so every number in the paper is verifiable without API spend. Code is licensed Apache 2.0; the paper and data are licensed CC BY 4.0. See the LICENSE files in the repository for authoritative terms.