Compaction can erase who supplied an instruction. The study distinguishes a forged approval entering a summary from later execution, which uses different, smaller experiments. Mechanism, preconditions and effects. The attacker-controlled payload began inside a lower-trust tool response. A context compactor that serialized user and tool turns into…
Inspect the ClaimsCase · DiggingBeagle record
Flattened conversation roles can turn tool text into apparent user approval
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-CP17-COMPACTION-LAUNDERING-CONTROL reports: With 15 trials per harness, five role-flattening harnesses laundered 13-15 forged approvals; four role-typed harnesses laundered none. All clean controls were 0/15. Source SRC-2026-CP17-COMPACTION-LAUNDERING is located at 'Experiment E10, page 13 and Figure 4; three models times five trials'. The distinctive mechanism begins: The attacker-controlled payload began inside a lower-trust tool response. Classification: setting=evaluation, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Keep actual role and origin metadata through compaction, then compare any summary claim of user authorization with retained authenticated user turns. The reported post-check left 23% of its measured laundering cases undetected at the selected threshold. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP17-COMPACTION-LAUNDERING-CONTROL · CLM-CP17-COMPACTION-LAUNDERING-DEFENSE · CLM-CP17-COMPACTION-LAUNDERING-EXECUTION · Compaction Laundering: provenance destruction
At a glance
No deployment prevalence estimate or proof of general immunity for role-typed agents.
Limits and uncertaintyFull account
Compaction can erase who supplied an instruction. The study distinguishes a forged approval entering a summary from later execution, which uses different, smaller experiments.
Mechanism, preconditions and effects. The attacker-controlled payload began inside a lower-trust tool response. A context compactor that serialized user and tool turns into undifferentiated text discarded role origin, allowing the summary model to restate a fabricated approval as though the user had granted it. In the authors' component-level E10 experiment, role-flattening systems laundered 13 to 15 of 15 trials per harness, whereas four role-typed serializers laundered zero. The study did not start all nine complete products for this comparison: it exercised their captured summarizer and serialization components at pinned revisions.
Comparison and evidence limits. A laundered summary is not automatically an executed command. The paper separately evaluates execution after forcing laundering, and the pi end-to-end run has a different setup. The 77% catch rate at 2% legitimate-content demotion is a particular provenance-check operating point, not verified defense against adaptive attackers. Compare with context privilege escalation, where low-trust text is promoted to authority through a different parsing boundary.
Claims & evidence
CLM-CP17-COMPACTION-LAUNDERING-CONTROLWith 15 trials per harness, five role-flattening harnesses laundered 13-15 forged approvals; four role-typed harnesses laundered none. All clean controls were 0/15.supported
Basis: reported finding
- supportsCompaction Laundering: provenance destructionprimary disclosure
Experiment E10, page 13 and Figure 4; three models times five trials
CLM-CP17-COMPACTION-LAUNDERING-DEFENSEThe provenance check caught 77% at 2% legitimate-claim demotion in its chosen setting; it was not tested against an adaptive attacker.supported
Basis: reported finding
- supportsCompaction Laundering: provenance destructionprimary disclosure
E9 threshold 0.15; Limitations, defense-adaptivity bullet
CLM-CP17-COMPACTION-LAUNDERING-EXECUTIONE11 isolated execution after forced laundering, with five trials per harness; this is not the 87-100% summary-laundering success metric.supported
Basis: reported finding
- supportsCompaction Laundering: provenance destructionprimary disclosure
Experiment E11, pages 13-15
Controls and mitigations
- Keep actual role and origin metadata through compaction, then compare any summary claim of user authorization with retained authenticated user turns. The reported post-check left 23% of its measured laundering cases undetected at the selected threshold.
Unknowns and contradictions
- No deployment prevalence estimate or proof of general immunity for role-typed agents.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183