How the joint-loss attack backpropagates through four separate models. The three places the chain breaks, the repair for each, and a live Gumbel-Softmax temperature demo.
Contribution 1 · Multi-turn defenseThe log-odds accumulator. Build a session by firing detectors, watch evidence stack against the gate, and switch the intent primitive to see why the swap mattered.
Contribution 1 · The diagnosisA boundary around one class versus a boundary between two. Four stages from the 30-of-30 failure through the Pyrrhic corner to the classifier.
Methods · HyperparametersAll 23 settings sorted by how each value was arrived at, with the one real sensitivity sweep and the loss trajectories that answer the budget question.
Methods · EvaluationClass imbalance at three ratios pointing two directions, and a base-rate slider showing what a 0.033 false-positive rate actually costs in precision.
Architecture · CoordinatorWhy gradients traverse the Coordinator although it has no loss term, and a switchboard showing the dispatch plan answers to configuration rather than to anything the attacker sends.
Indirect injection · Map-ReduceStep an injected instruction through chunking, six isolated workers and the Reduce step, then see the category crossover where this defense wins exactly where the Guards lose.
Defense in depth · Capability gateThe gate as set arithmetic. Pick a response, set what the deployment grants, and watch allow or deny fall out, including the emoji result that works by accident.
Perimeter · Input and Output GuardsBuild the sandwich prompt for either Guard, then see why they swap roles between benchmarks and why that makes one faster than no defense at all.
Contribution 2 · Security-aware KV cacheA hyperparameter-driven simulation of twenty-five invocations under pressure. Move the threshold and the protected floor and watch the canary survive or vanish.