Amplify, Don't Create: Temporal Accumulation for Slow-Burn Prompt Injection

Abstract

Most prompt-injection detectors score a single event or message. Control-plane attacks against tool-using agents can instead distribute weak directives across a trajectory while keeping each event below threshold. We test whether a proxy-side temporal accumulator recovers this slow-burn signal by reducing frozen per-event scores to peak and CUSUM persistence statistics. To avoid circularity, grafts are generated against a held-out autoregressive cloaking target and then re-scored under a detecto

Categories

Framework mappings

Suggested from the entry's categories.

@misc{corll2026amplify,
  title = {{Amplify, Don't Create: Temporal Accumulation for Slow-Burn Prompt Injection}},
  author = {J Alex Corll},
  year = {2026},
  month = jun,
  eprint = {2606.20746},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20746}
}