The Context Window is an Instruction Channel
An LLM context window is a flat space where user text, database records, and system instructions mix without structural separation. That design choice is why prompt injection is a vulnerability class rather than a simple filtering bug.
By Piotr Zenon Żabrowski · Published · Updated
The flat instruction channel
Before processing begins, an application must assemble its inputs into a single sequence. A developer's system prompt, the user's current request, retrieved documents, tool outputs, and conversational history are concatenated into a flat string. To the model evaluating it, this combined text functions as a single instruction channel.
The underlying architecture provides no mechanism to mark a database record or user message as purely read-only data. If a retrieved PDF contains text phrased as a command, the model parses it with the same functional weight as the application's system prompt. This failure to separate data from instructions causes prompt injection, which the OWASP Top 10 for LLM Applications names as the top risk category. When untrusted input shares a channel with administrative commands, the system behaves exactly like a SQL injection target.
Context length and 'lost in the middle' degradation
The context window defines the absolute limit of what a model can process in one pass. As applications expand this window to handle dozens of documents at once, a new operational failure mode emerges concerning how reliably the model retains instructions.
Models do not weight all parts of a long sequence equally. They exhibit a documented "lost in the middle" behavior: they consistently favor information placed at the very beginning or the very end of the sequence, while significantly degrading performance on information located in the center.
Provider-level hidden prompts
The context assembled by an enterprise application is rarely the final text the model evaluates. Major frontier model providers inject their own overriding system prompts into the sequence immediately before processing to enforce terms of service and correct unwanted behavior.
These hidden layers add unpredictable variables to the context window. Because developers cannot inspect this hidden text or predict its interaction with the "lost in the middle" effect, securing an application purely by writing stricter prompts is a brittle control. Provider instructions will frequently override or conflict with the application's security requirements.
Architectural controls
Limiting instruction channel risks
- Assume any retrieved document or tool output can issue valid, executable commands to the model.
- Place mandatory application constraints and final instructions at the absolute end of the context window.
- Treat the prompt strictly as a formatting tool, never as a structural security boundary.
- Monitor the volume of context fed to the model to avoid unexpected instruction degradation.
Frequently asked questions
Can prompt injection be fixed by adding filters to the context?
Filters and blocklists only raise the cost of an attack; they do not solve the underlying architectural problem. As long as untrusted text and system instructions share the same channel, attackers will find ways to encode payloads that bypass lexical filters while still executing as commands.
Does a larger context window mean a more capable system?
Not operationally. While a larger window allows the application to submit more documents per request, the 'lost in the middle' effect means the model reliably recalls only the edges of that data. Submitting smaller, pre-filtered context yields much tighter adherence to instructions.
Related
AI security
How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.
Prompt injection defence
Why prompt injection cannot be filtered away, why it has no full fix yet, and how to design AI systems — architecturally, not just with better prompts — so a successful injection has no useful consequence.
Retrieval poisoning
A poisoned RAG document can turn retrieval into prompt injection. See how ingestion, ranking, permissions and testing contain the attack.
Tokenization and filter bypass
Content filters match on words; models read tokens. Spacing, encoding and hidden characters change tokenization and can slip content past the filter.
Sampling controls
Temperature and top-p shape repeatability. Treat them as versioned security settings if AI outputs must be tested, audited or reproduced.
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.