Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks
On the map: State-space sequence models (S4, Mamba) → Core SSM architectures for language
Abstract (arXiv)
State-Space Models (SSMs) -- structured SSMs (S4, S4D, DSS, S5), selective SSMs (Mamba, Mamba-2), and hybrid architectures (Jamba) -- are deployed in safety-critical long-context applications: genomic analysis, clinical time-series forecasting, and cybersecurity log processing. Their linear-time scaling is compelling, yet the security properties of their compressed-state recurrent architectures remain unstudied. We present the first systematic treatment of SSM safety, security, and cognitive risks. Seven contributions: (1) Formal threat framework -- SSM Attack Surface (five layers), State Integrity Violation (StIV), Cross-Context Amplification Ratio XS, and a Spectral Sensitivity Proposition grounded in the H_∞ norm. (2) Three novel attack classes: spectral adversarial attacks (transfer-function gain exploitation), delayed-trigger stateful backdoors (activate thousands of steps after injection), and state capacity saturation (entropy flooding forces silent forgetting). (3) 14 MITRE ATLAS technique extensions across the full tactic chain. (4) Six-profile attacker taxonomy with kill chains for genomics, clinical, and cybersecurity domains. (5) Four cognitive risk hypotheses grounded in state-compression mechanics. (6) Governance-aligned mitigations mapped to CREST, NIST AI 600-1, and EU AI Act. (7) Empirical evaluation: targeted genomic injection achieves StIV=0.519 vs. 0.086 random (6.0×, p<0.001); PGD state injection achieves 156× output perturbation over random; SSD-structured extraction confirmed at O(N2) vs. O(N3) query complexity (N× speedup). Validation on pretrained checkpoints is detailed in the Appendix.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Core SSM architectures for language, one of 10 directions in State-space sequence models (S4, Mamba). Builds on 40 of its 50 references that are in the map. First posted on arXiv 4 Apr 2026.
Builds on
40 of 50 references.
Closest ancestors · 10
Same direction, newest first
- 2025LongMamba: Enhancing Mamba's Long Context Capabilities via Training-Free Receptive Field Enlargement22 Apr
- 2024ReMamba: Equip Mamba with Effective Long-Sequence Modeling28 Aug
- 2024DeciMamba: Exploring the Length Extrapolation Potential of Mamba20 Jun
- 2024An Empirical Study of Mamba-based Language Models12 Jun
- 2024Transformers are SSMs: Generalized Models and Efficient Algorithms Through Structured State Space Duality31 May
- 2024Jamba: A Hybrid Transformer-Mamba Language Model28 Mar
- 2023Mamba: Linear-Time Sequence Modeling with Selective State Spaces1 Dec
- 2022Simplified State Space Layers for Sequence Modeling9 Aug
- 2022Diagonal State Spaces are as Effective as Structured State Spaces27 Mar
- 2021Efficiently Modeling Long Sequences with Structured State Spaces31 Oct
Other references · 30
- 2017Attention Is All You Needcited by 59,932
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2017On Calibration of Modern Neural Networkscited by 4,860
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Deep Learning with Differential Privacycited by 2,682
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2022Survey of Hallucination in Natural Language Generationcited by 2,056
- 2023LongBench: A Bilingual, Multitask Benchmark for Long Context Understandingcited by 1,378
- 2019Can You Trust Your Model's Uncertainty? Evaluating Predictive Uncertainty Under Dataset Shiftcited by 1,274
- 2024RULER: What's the Real Context Size of Your Long-Context Language Models?cited by 1,270
18 more
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
- 2021Ethical and social risks of harm from Language Modelscited by 957
- 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
- 2020Long Range Arena: A Benchmark for Efficient Transformerscited by 696
- 2016Stealing Machine Learning Models via Prediction APIscited by 602
- 2020HiPPO: Recurrent Memory with Optimal Polynomial Projectionscited by 600
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
- 2022On the Parameterization and Initialization of Diagonal State Space Modelscited by 418
- 2024∞Bench: Extending Long Context Evaluation Beyond 100K Tokenscited by 360
- 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
- 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
- 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
- 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
- 2018Low Frequency Adversarial Perturbationcited by 80
- 2019Adversarial Attacks on Time Seriescited by 40
- 2023Robustifying State-space Models for Long Sequences via Approximate Diagonalizationcited by 18
- 2024Numerical Analysis of HiPPO-LegS ODE for Deep State Space Modelscited by 1
- 2026HiPPO Zoo: Explicit Memory Mechanisms for Interpretable State Space Modelscited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026SpectralGuard: Detecting Memory Collapse Attacks in State Space Models
- 2026Safety, Security, and Cognitive Risks in World Models
- 2024BadVim: Unveiling Backdoor Threats in Visual State Space Model
- 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety
- 2025aiXamine: Simplified LLM Safety and Security
- 2026Analysis of Long Range Dependency Understanding in State Space Models
- 2025COBRA: Catastrophic Bit-flip Reliability Analysis of State-Space Models
- 2026Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge