Prompt Injection Inevitable in Shared-Embedding LLMs.

Prompt injection is recognized as the most critical security vulnerability for applications integrating Large Language Models (LLMs), yet all proposed defenses have ultimately failed. This paper presents a mathematical proof demonstrating that, within shared-embedding architectures that lack enforced control-data separation, achieving perfect prevention of prompt injection is fundamentally impossible. The researchers formalize prompted systems as Prompted Action Models, where outputs include control-authoritative actions like refusals or tool authorizations. They define "Semantic-Faithful Control" (SFC) as the property that such behavior depends solely on the meaning of untrusted input, not its encoding. The proof establishes that SFC is unattainable within the shared pipeline through three key results: provenance-recovery impossibility, showing that shared representations make trusted and untrusted content statistically inseparable; control-path exposure, where untrusted tokens enter control-relevant computations; and a finite-coverage invariance gap, indicating that finite training cannot certify invariance over infinite semantic-equivalence classes. This structural limitation mirrors the code-data confusion in Von Neumann machines that led to buffer overflows. The implication is profound: prompt injection cannot be eliminated by in-pipeline classification or alignment alone, but rather necessitates architectural separation of instruction and data channels, much like the layered defenses developed for memory safety.