disambiguation-underlies-prompt-security-architecture

IN derived (depth 4)

Created 2026-06-21T13:13:49+00:00 · Reviewed 2026-06-21T14:41:08+00:00

The universal disambiguation constraint (requiring semantic context to cross processing boundaries) and the dual-use authority hierarchy (system prompts simultaneously enabling control and creating attack surfaces) are two manifestations of the same root limitation: LLMs cannot reliably maintain semantic boundaries between different types of input, whether instruction vs. data or system vs. user authority.

Justifications

SL — Both prompt injection and authority hierarchy exploitation trace to the same universal boundary-violation constraint

Antecedents (all must be IN):

IN disambiguation-boundary-violation-is-universal-computational-constraint — The need for semantic context to resolve disambiguation appears as a recurring pattern across processing hierarchies: both compilers (the C lexer hack requiring symbol table feedback across the lexer-parser boundary) and LLMs (prompt injection exploiting the inability to distinguish instructions from data) exhibit cases where lower-level processing cannot resolve meaning without higher-level semantic knowledge, suggesting that formal processing-level separations face inherent pressure from disambiguation demands that cross those boundaries.
IN authority-hierarchy-is-both-security-mechanism-and-attack-surface — The LLM instruction authority hierarchy — where system prompts carry higher weight than user messages — is a dual-use security architecture: the same structured privilege boundary that constrains model behavior (defense) creates the privileged channel that prompt injection attempts to impersonate (attack surface), making the security mechanism and the vulnerability architecturally inseparable.