# Amplify, Don't Create: Temporal Accumulation for Slow-Burn Prompt Injection

arXiv: https://arxiv.org/abs/2606.20746 · HTML: https://mlsanity.com/paper/2606.20746/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 11 of its 22 references that are in the map.
- First posted on arXiv 17 Jun 2026.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 11 of 11)

- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples](https://mlsanity.com/paper/1802.00420/) (2018)
- [Practical Black-Box Attacks against Machine Learning](https://mlsanity.com/paper/1602.02697/) (2016)
- [Ignore Previous Prompt: Attack Techniques For Language Models](https://mlsanity.com/paper/2211.09527/) (2022)
- [On Adaptive Attacks to Adversarial Example Defenses](https://mlsanity.com/paper/2002.08347/) (2020)
- [InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents](https://mlsanity.com/paper/2403.02691/) (2024)
- [On Evaluating Adversarial Robustness](https://mlsanity.com/paper/1902.06705/) (2019)
- [Formalizing and Benchmarking Prompt Injection Attacks and Defenses](https://mlsanity.com/paper/2310.12815/) (2023)
- [Defending Against Indirect Prompt Injection Attacks With Spotlighting](https://mlsanity.com/paper/2403.14720/) (2024)
- [LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet](https://mlsanity.com/paper/2408.15221/) (2024)
- [AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?](https://mlsanity.com/paper/2602.03117/) (2026)

## Abstract (arXiv)

Most prompt-injection detectors score a single event or message. Control-plane attacks against tool-using agents can instead distribute weak directives across a trajectory while keeping each event below threshold. We test whether a proxy-side temporal accumulator recovers this slow-burn signal by reducing frozen per-event scores to peak and CUSUM persistence statistics. To avoid circularity, grafts are generated against a held-out autoregressive cloaking target and then re-scored under a detector of record: a frozen char-ngram SVM plus an embedding-contrastive head. Only floor-met grafts bound to executed action edges and still sub-threshold under the detector of record enter the slow-burn endpoint. This is a boundary result, not a deployable detector. On concentrated attacks, trajectory-level accumulation beats the per-event foil under a clustered bootstrap (gap +0.092, 95% CI [+0.025, +0.155]), while persistence and peak are statistically tied. On git repo-exfil, density-four floor-met sub-threshold grafts add persistence mass that matched benign shams do not (persistence-delta AUC 0.708 over four attack survivors and six benign shams), while the matched peak-delta control does not separate attack from sham (AUC 0.417), localizing the effect to accumulated persistence rather than a single hot graft. The effect fails on broader clean-path actions (persistence-delta AUC 0.167), where the detector assigns attack and benign actions indistinguishable per-event scores, leaving no margin for CUSUM to bank. Independent powering is blocked by only three to four independent tasks. Temporal accumulation is therefore a narrow-band margin amplifier: it can bank elevated sub-threshold signal but cannot create margin where the per-event detector has none. As byproducts, we contribute a pseudo-replication warning and an independence-audit standard for agent-benchmark evaluation.