Text-centered prompt-injection defenses assume that the malicious signal is visible in one of the inspected text views. We study a reproducible LLM01-style indirect prompt/content-injection failure mode where that assumption breaks: a payload caught in plain English slips past the same detector when it is transported as structured float parameters and reconstructed only as fragmented telemetry. Across 14,400 attacked real-model trials on three commercial LLM APIs from different providers, the IFS-derived float-array carrier preserves 94.3% leakage ASR under the strongest dual-layer text-classifier defense evaluated in the main matrix: a Prompt Guard 2 + TF-IDF ensemble; the same carrier-level pattern also replicates with a fine-tuned roberta-base detector. We emphasize leakage ASR because downstream systems may act on quoted or reproduced markers even when the model refuses, but Strong ASR is the stricter metric for structurally compliant attack success. A 2 x 2 ablation shows that data-layer storage and reconstruction-layer fragmentation defeat different text views and that both are needed to evade both. A simple xxd detector and semantic validation block the current T3 instance, so the contribution is not an undetectable exploit but a measured failure boundary for text-only inspection in structured-input pipelines that expose reconstructed auxiliary channels to an LLM.

翻译：以文本为核心的提示注入防御假设恶意信号在某种被审查的文本视图中可见。我们研究了一种可复现的LLM01式间接提示/内容注入失效模式，该模式打破上述假设：以明文英语呈现的有效载荷在通过结构化浮点参数传输并仅以碎片化遥测形式重建时，能成功逃避同一检测器的拦截。通过对来自不同提供商的三种商业LLM API进行14,400次真实模型攻击实验，在主评估矩阵的最强双层文本分类器防御（Prompt Guard 2与TF-IDF集成模型）下，基于IFS的浮点数组载体保留了94.3%的泄漏成功率；该载体级模式同样在微调后的roberta-base检测器上得到复现。我们强调泄漏成功率，因为即使模型拒绝响应，下游系统仍可能对引述或复现的标记采取行动，而强成功率才是衡量结构性攻击合规性的严格指标。2×2消融实验表明，数据层存储与重建层碎片化分别作用于不同文本视图，且两者协同才能实现全面规避。简单的xxd检测器与语义验证模块可阻断当前T3实例，因此本文贡献并非不可检测的利用方法，而是针对结构化输入管道中仅依赖文本审查的失效边界测量——此类管道会将重建的辅助信道暴露给LLM。