llm-security-requires-defense-across-three-independent-surfaces
IN derived (depth 3)
Created 2026-06-21T10:12:39+00:00 · Reviewed 2026-06-21T14:41:08+00:00
LLM security threats operate across three independent attack surfaces requiring distinct defenses: training data poisoning (deliberate grooming of web content), architectural prompt sensitivity (40%+ accuracy shifts from formatting, instruction-input confusion), and inference-time injection — and the architectural vulnerabilities are fundamental, not solvable by engineering or scale.
Summary
Protecting a large language model from attack cannot be reduced to a single filter or checkpoint, because the threats come from at least three separate directions—corrupted training data, the model's own sensitivity to how instructions are formatted, and live prompt injection—and the two architectural problems are baked into the model's design rather than fixable by throwing more compute or data at it. In practice, this means a secure system must layer independent defenses at every stage of the pipeline, because no single engineering choice closes all the gaps.
Justifications
SL — Training/inference security (depth-1) combined with architectural vulnerability analysis (depth-2) reveals three distinct, irreducible surfaces
Antecedents (all must be IN):
- IN llm-security-spans-training-and-inference-surfaces — LLM security threats operate across both training time (deliberate data poisoning via grooming) and inference time (prompt injection), requiring defense at multiple pipeline stages rather than a single chokepoint.
- IN prompt-vulnerability-is-dual-architectural-limitation — Both prompt sensitivity (40%+ accuracy shifts from formatting) and prompt injection (inability to distinguish instructions from input) appear to be intrinsic architectural properties of instruction-following LLMs that resist improvement through scaling alone. Both phenomena may share a common factor in the model's lack of formal prompt structure parsing, though the antecedents establish each independently rather than proving a unified root cause.
Dependents
These beliefs depend on this one:
- IN llm-reliability-requires-five-independent-defense-dimensions — LLM reliability requires independent defenses across at least five dimensions — two control layers (training-time alignment, inference-time prompting) and three security surfaces (training data poisoning, prompt injection, architectural vulnerability) — with no single defense sufficient on its own.
- IN security-surfaces-expand-with-capability-scaling — The early evidence of dual-scaling tensions between capabilities and risks (as illustrated by GPT-2's memorization and misuse concerns) compounds the challenge posed by three independent security surfaces — training data poisoning, prompt injection, and architectural vulnerabilities — since architectural vulnerabilities in particular appear fundamental rather than solvable by scale alone, suggesting that LLM security may be a persistently difficult problem rather than one that straightforward engineering progress will resolve.
- IN training-data-security-surface-permanently-permeable-after-release — Training data memorization diffusing through uncontrolled weight distribution makes the training-data security surface — one of three independent surfaces requiring defense — fundamentally uncontainable after model release, as once weights are distributed the memorized knowledge and any poisoned training data are irreversibly in the wild.