In an LLM pipeline, what does an attacker gain and give up by deferring a planted span's activation to a later component?

## Framing the tradeoff An interviewer asking this is checking whether a candidate can reason about a construction as something with a cost, rather than reciting that indirect injection exists. The honest answer has two columns. ### What deferral buys **Reach past the boundary where inspection happens.** Inspection concentrates where somebody drew a trust boundary — the chat turn, the upload, the fetched page. A field that gets rejected and echoed into an error log crosses none of them at the moment it matters, because it is not an instruction to anything yet. The read that matters happens later, at a boundary nobody modelled as input, since data a system recorded about itself is by default not treated as anyone's submission. **Framing that cannot be bought any other way.** The same characters typed into a chat box arrive labelled as something a user said. Quoted out of an application's own error log, they arrive as the system's account of itself. Provenance is not defeated so much as never carried: the formatting code that interpolated the substring had no notion that a downstream consumer might act on it. **A capability differential.** At submission the request was rejected and nothing was reachable. At re-read the consuming component adjusts alert routing on the low-severity path and writes a shift summary a human acts on. The identical sentence acquires two consequences it never had. **Attribution to the pipeline.** Whatever happens is recorded as an action of a scheduled run, not of a request from outside. That is not stealth in the malware sense; it is that the record of the event points at the wrong end of the path. ### What deferral costs **No feedback channel.** This is the dominant cost and the one weak answers omit. In an in-turn attempt the response is the measurement — you see a refusal, a block, a compliance, and you iterate in seconds. Deferred, the attacker has written into a store and is blind. They learn only what is externally observable, which for an internal triage pipeline may be nothing at all. Iteration cycles measured in seconds become cycles measured in shifts. **Somebody else's clock.** Activation happens when the summary regenerates or when a query runs. The attacker does not choose the moment, cannot force it, and may be long gone when it happens. **Fragility across the intermediate stage.** The construction depends on the characters being placed in front of the acting component more or less as written. A stage that extracts structured fields, aggregates counts, truncates to a budget, or re-summarises in its own words may never surface the original text. The more processing between write and read, the lower the survival rate. **No target selection.** The reader is whoever consumes the artefact next — a shift the attacker cannot pick, a run configured in ways they cannot see. Effects land on an arbitrary consumer. **Compounded uncertainty.** Success now depends on two model-mediated steps rather than one: the span surviving into the window, and the acting component weighing it heavily enough. Two probabilistic stages multiply, so a construction that would land three times in five in-turn can land far less often deferred. ## What this means when you are asked to judge a finding The practical consequence is that deferred findings look weaker than they are on first triage and are easy to dismiss. A single observed activation against a probabilistic pipeline is genuinely thin evidence about frequency — it establishes that the path exists, not how often it fires. The distinction worth articulating is between the **path** and the **rate**: reproducing once demonstrates the path is real, which is the durable claim, while any statement about rate needs a number of trials that the blind, schedule-bound nature of the construction makes expensive to collect. ## Where a red-teamer would not choose it If the acting component only prints to a human who reads carefully, the ceiling is a misleading sentence rather than an action, and the cost of blindness is not repaid. If the pipeline extracts rather than quotes, survival is poor. If an in-turn path already reaches the same capability, deferral buys only the framing, and pays for it with everything above. The construction earns its cost specifically when the capability sits behind the later component and the earlier path cannot reach it at all.