Each Link Carries Forward Contamination
Why sequential prompt stages propagate and amplify injection through the pipeline
The Conventional Framing
Prompt chaining breaks complex tasks into sequential stages, where each stage's output becomes the next stage's input. This enables building sophisticated pipelines from simpler components.
The pattern is fundamental to LLM application architecture for handling complex, multi-step tasks.
Why Chains Are Propagation Vectors
Each stage in a chain trusts the output of the previous stage. If stage 1 is compromised by injection, its output carries that compromise to stage 2. By stage N, the initial injection has been processed, potentially amplified, and embedded into the entire pipeline's state.
Chains don't filter—they propagate. Each link is an opportunity for injection to become more deeply embedded.
The laundering problem:
Output from stage N looks like "model output," not "user input." Developers may trust it differently. But if user input reached stage 1, it can reach stage N looking like legitimate model-generated content.
Architecture
Components:
- Stage definition— individual prompt components
- Output → Input mapping— how stages connect
- Context accumulation— information carried through chain
- Final synthesis— combining all stage outputs
Trust Boundaries
- User input → Stage 1 — injection enters
- Stage N → Stage N+1 — injection propagates
- Final stage → Output — laundered injection emerges
Threat Surface
| Threat | Vector | Impact |
|---|---|---|
| Injection propagation | Malicious content flows through all stages | Each stage processes and potentially amplifies injection |
| Trust laundering | User input becomes 'model output' after first stage | Later stages trust laundered attacker content |
| Context accumulation | Injection accumulates across stages | Final output shaped by injection from any stage |
| Stage-specific attacks | Injection targets vulnerabilities in specific stages | Even if some stages are safe, vulnerable ones compromise chain |
The ZIVIS Position
- •Trust doesn't transfer through stages.Just because you trusted stage 1's input doesn't mean stage 3 should trust stage 1's output. User content may have been laundered.
- •Validate at every boundary.Each stage should validate its input, even from previous stages. Don't assume model output is safe model output.
- •Consider stage isolation.Pass only necessary information between stages, not entire outputs. Reduce what can propagate.
- •Monitor for injection markers.Track whether content originated from user input. Flag outputs that seem to contain instruction-like content.
What We Tell Clients
Prompt chains propagate contamination. An injection in stage 1 becomes "model output" by stage 2, losing its identity as untrusted user content while retaining its malicious payload.
Validate inputs at every stage boundary. Don't assume that because content came from a previous model stage, it's trustworthy. Track user-originated content through your pipeline.
Related Patterns
- Plan-and-Execute— agent version of staged execution
- Structured Output— often used between chain stages