We present a stage-decomposed analysis of prompt injection attacks against five frontier LLM agents. Prior work measures task-level attack success rate (ASR); we localize the pipeline stage at which each model's defense activates. We instrument every run with a cryptographic canary token (SECRET-[A-F0-9]{8}) tracked through four kill-chain stages -- Exposed, Persisted, Relayed, Executed -- across four attack surfaces and five defense conditions (764 total runs, 428 no-defense attacked). Our central finding is that model safety is determined not by whether adversarial content is seen, but by whether it is propagated across pipeline stages. Concretely: (1) in our evaluation, exposure is 100% for all five models -- the safety gap is entirely downstream; (2) Claude strips injections at write_memory summarization (0/164 ASR), while GPT-4o-mini propagates canaries without loss (53% ASR, 95% CI: 41--65%); (3) DeepSeek exhibits 0% ASR on memory surfaces and 100% ASR on tool-stream surfaces from the same model -- a complete reversal across injection channels; (4) all four active defense conditions (write_filter, pi_detector, spotlighting, and their combination) produce 100% ASR due to threat-model surface mismatch; (5) a Claude relay node decontaminates downstream agents -- 0/40 canaries survived into shared memory.

翻译：我们提出一种分阶段分析方法，针对五个前沿大语言模型代理的提示注入攻击展开研究。现有工作仅衡量任务级攻击成功率（ASR）；我们精准定位每个模型防御机制激活的流水线阶段。每次运行均植入加密金丝雀令牌（SECRET-[A-F0-9]{8}），通过暴露、持久化、中继、执行四个杀戮链阶段进行追踪，覆盖四个攻击面与五种防御条件（共764次运行，其中428次为无防御攻击）。核心发现表明：模型安全性并非取决于对抗性内容是否被感知，而取决于其是否跨流水线阶段传播。具体而言：（1）本评估中五款模型的暴露率均为100%——安全差距完全存在于下游阶段；（2）Claude在写入记忆摘要阶段清除注入（ASR为0/164），而GPT-4o-mini无损失传播金丝雀（ASR为53%，95%置信区间：41-65%）；（3）DeepSeek在记忆面ASR为0%，但在同一模型的工具流面ASR达100%——呈现跨注入通道的完全逆转；（4）所有四种主动防御条件（写入过滤器、提示注入检测器、聚焦机制及其组合）因威胁模型面不匹配，ASR均为100%；（5）Claude中继节点可净化下游代理——共享记忆中无一金丝雀存活（0/40）。