Growing Context Grows Attack Surface
Why storing full conversation history accumulates injection opportunities
The Conventional Framing
Conversation buffer stores the complete conversation history and includes it in every model call. This provides full context for coherent, contextual responses.
The pattern is the simplest form of conversation memory, enabling multi-turn interactions.
Why Accumulating History Accumulates Risk
Every message in the buffer is part of the context for future responses. An injection early in the conversation persists and influences all subsequent interactions.
The attack surface grows with conversation length. More history = more places injections can hide = more opportunities for poison to influence behavior.
The persistence problem:
Unlike a single request where injection is processed once, buffer memory means injection is processed on every subsequent turn. It's injection with longevity.
Architecture
Components:
- Message storage— stores all conversation turns
- Context window— history included in each call
- Turn ordering— maintains conversation sequence
- Buffer management— handling buffer growth
Trust Boundaries
- User → Buffer — user input persists in history
- Buffer → Context — all history enters each call
- History → Behavior — past injection affects current response
Threat Surface
| Threat | Vector | Impact |
|---|---|---|
| Persistent injection | Inject once, influence all future turns | Long-lasting compromise from single injection |
| History poisoning | Gradually inject multiple payloads across turns | Cumulative effect of multiple injections |
| Context overflow | Fill buffer with injection, push out legitimate context | Injection dominates available context |
| Delayed activation | Inject payload that activates later in conversation | Attack triggers on specific future conditions |
The ZIVIS Position
- •Buffer length is attack surface.Longer buffers mean more places for injection to persist. Consider shorter retention or summarization.
- •Consider per-turn validation.Validate not just new input but also what's in the buffer. Past injections are still active injections.
- •Truncation as security measure.Limiting buffer length limits how long injections persist. It's a trade-off between context and security.
- •Monitor for buffer-based attacks.Watch for patterns suggesting injection intended to persist: unusual formatting, conditional instructions.
What We Tell Clients
Conversation buffer is simple and effective for context, but every turn stored is a turn that might contain injection persisting into future interactions.
Consider buffer limits, periodic clearing, or summarization to reduce persistence of potential injections. Treat the buffer as accumulated untrusted content.
Related Patterns
- Conversation Summary— summarization instead of full storage
- Sliding Window— limited history retention