Paper deep dive
The Defense Trilemma: Why Prompt Injection Defense Wrappers Fail?
Manish Bhatt, Sarthak Munshi, Vineeth Sai Narajala, Idan Habler, Ammar Al-Kahfah, Ken Huang, Joel Webb, Blake Gatto
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 98%
Last extracted: 4/10/2026, 3:37:42 AM
Summary
The paper introduces the 'Defense Trilemma,' proving that for a language model with a connected prompt space, no continuous, utility-preserving wrapper defense can be complete (i.e., make all outputs safe). The authors establish three results: boundary fixation (the defense must leave some threshold-level inputs unchanged), an epsilon-robust constraint (a positive-measure band near fixed points remains near-threshold), and a persistent unsafe region (a positive-measure subset of inputs remains strictly unsafe). The theory is mechanically verified in Lean 4.
Entities (5)
Relation Signals (2)
Defense Trilemma → constrains → Wrapper Defense
confidence 100% · These constitute a defense trilemma: continuity, utility preservation, and completeness cannot coexist.
Lean 4 → verifies → Defense Trilemma
confidence 100% · The full theory is mechanically verified in Lean 4
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:We prove that no continuous, utility-preserving wrapper defense-a function $D: X\to X$ that preprocesses inputs before the model sees them-can make all outputs strictly safe for a language model with connected prompt space, and we characterize exactly where every such defense must fail. We establish three results under successively stronger hypotheses: boundary fixation-the defense must leave some threshold-level inputs unchanged; an $\epsilon$-robust constraint-under Lipschitz regularity, a positive-measure band around fixed boundary points remains near-threshold; and a persistent unsafe region under a transversality condition, a positive-measure subset of inputs remains strictly unsafe. These constitute a defense trilemma: continuity, utility preservation, and completeness cannot coexist. We prove parallel discrete results requiring no topology, and extend to multi-turn interactions, stochastic defenses, and capacity-parity settings. The results do not preclude training-time alignment, architectural changes, or defenses that sacrifice utility. The full theory is mechanically verified in Lean 4 and validated empirically on three LLMs.
Tags
Links
- Source: https://arxiv.org/abs/2604.06436v2
- Canonical: https://arxiv.org/abs/2604.06436v2
Trouble viewing inline? Open PDF directly →
Full Text
55,192 characters extracted from source content.
Expand or collapse full text
The Defense Trilemma: Why Prompt Injection Defense Wrappers Fail? Manish Bhatt 222Equal contribution. This work was conducted independently and does not reflect the views, policies, or endorsements of the authors’ respective employers. OWASP, Amazon Leo Corresponding author: manish.bhatt13212@gmail.com Sarthak Munshi222Equal contribution. This work was conducted independently and does not reflect the views, policies, or endorsements of the authors’ respective employers. Amazon Web Services Vineeth Sai Narajala222Equal contribution. This work was conducted independently and does not reflect the views, policies, or endorsements of the authors’ respective employers. Cisco Idan Habler222Equal contribution. This work was conducted independently and does not reflect the views, policies, or endorsements of the authors’ respective employers. Cisco Ammar Al-Kahfah222Equal contribution. This work was conducted independently and does not reflect the views, policies, or endorsements of the authors’ respective employers. Amazon Web Services Ken Huang Distributedapps.ai Joel Webb LSU - New Orleans Blake Gatto Shrewd Security Abstract We prove that no continuous, utility-preserving wrapper defense—a function D:X→XD X→ X that preprocesses inputs before the model sees them—can make all outputs strictly safe for a language model with connected prompt space, and we characterize exactly where every such defense must fail. We establish three results under successively stronger hypotheses: boundary fixation—the defense must leave some threshold-level inputs unchanged; an ε -robust constraint—under Lipschitz regularity, a positive-measure band around fixed boundary points remains near-threshold; and a persistent unsafe region—under a transversality condition, a positive-measure subset of inputs remains strictly unsafe. These constitute a defense trilemma: continuity, utility preservation, and completeness cannot coexist. We prove parallel discrete results requiring no topology, and extend to multi-turn interactions, stochastic defenses. The results do not preclude training-time alignment, architectural changes, or defenses that sacrifice utility. The full theory is mechanically verified in Lean 4 with Mathlib https://github.com/mbhatt1/stuff/tree/main/ManifoldProofs (46 files, ∼360 360 theorems, no admitted proofs, three standard axioms) and validated empirically on three LLMs munshi2026manifold . 1 Introduction Can you build a wrapper around a language model that eliminates all prompt injection vulnerabilities? Most current defense work implicitly assumes yes. Input classifiers that flag suspicious prompts alon2023detecting , constitutional rewriting pipelines bai2022constitutional , and input sanitization layers inan2023llama all share the same structure: a function D:X→XD X→ X that preprocesses prompts before the model sees them, mapping unsafe inputs to safe equivalents while leaving safe inputs unchanged. We prove the answer is no, under two constraints. If the defense is continuous (similar prompts produce similar rewrites) and utility-preserving (safe prompts pass through unchanged), it cannot be complete (make every output safe). These three properties form a defense trilemma: any two can coexist, but not all three (Figure˜2). The impossibility is not about specific attacks or clever prompt engineering. It arises from the geometry of the prompt space itself: in a connected space, the safe region is open but not closed, so any continuous defense that fixes safe inputs must also fix points on the safety boundary. Under successively stronger hypotheses, we establish three results with progressively stronger conclusions (Figure˜3): Boundary fixation (Theorem˜4.1). The defense must fix at least one boundary point, i.e., a prompt where alignment deviation equals the threshold exactly—passing it through with no remediation. ε -robust constraint (Theorem˜5.1). Under Lipschitz regularity, the defense cannot uniformly reduce alignment deviation far below τ near the fixed boundary point. For any x within distance δ of the fixed point z: f(D(x))≥τ−LKδ.f(D(x))\;≥\;τ-LK\,δ. (1) Persistent unsafe region (Theorem˜6.3). Under a transversality condition, the alignment surface rises faster than the defense can pull it down, leaving a positive-measure region that remains unsafe: f(D(x))>τfor all x∈,μ()>0.f(D(x))>τ all x , μ(S)>0. (2) From discrete to continuous. All three results apply to continuous interpolants of discrete data. The Tietze extension theorem guarantees that any finite set of behavioral observations in a normal space admits continuous extensions, and the impossibilities hold for every such extension (Theorem˜8.1). Scope and limitations. Our results apply specifically to continuous, utility-preserving wrapper defenses on connected prompt spaces. They do not preclude effective safety through other mechanisms, including: • training-time alignment (RLHF, DPO, constitutional AI training), • architectural changes to the model itself, • discontinuous defenses (e.g., hard blocklists or discrete classifiers), • output-side filters, ensemble defenses, or human-in-the-loop review, • adaptive-threshold systems, • multi-component systems whose classifiers may reject or redirect inputs rather than preserving utility on every prompt. In short, our theorems cover only a single continuous wrapper D:X→XD X→ X that preprocesses inputs; any mechanism outside this class is not constrained by our results. All three conditions—continuity, utility preservation, and connectedness—are individually necessary; we give counterexamples for each (Appendix˜C). Contributions. 1. Boundary fixation (Theorem˜4.1): any continuous, utility-preserving defense on a connected Hausdorff space must fix a point z with f(z)=τf(z)=τ. Relaxed to score-preserving and ε -approximate variants (Theorems˜4.4 and 4.5). 2. ε -robust constraint (Theorem˜5.1): under Lipschitz regularity, f(D(x))≥τ−LKdist(x,z)f(D(x))≥τ-LKdist(x,z) for all x. A positive-measure band near z is constrained (Theorem˜5.2). 3. Persistent unsafe region (Theorem˜6.3): under a transversality condition (G>ℓ(K+1)G> (K+1), where ℓ is the defense-path Lipschitz constant), a positive-measure set remains strictly above τ after defense. 4. Quantitative bounds: explicit volume lower bound (Theorem˜7.1), cone measure bound (Theorem˜7.2), and an asymmetric defense dilemma (Theorem˜7.3). 5. Discrete defense dilemma (Theorem˜8.3): on finite sets, completeness forces non-injectivity (information loss); injectivity forces incompleteness. 6. Extensions: multi-turn (Theorem˜9.1), stochastic (Theorem˜9.2), and pipeline (Theorem˜9.3) settings. 7. Lean 4 formalization: 46 files, ∼360 360 theorems, zero sorry statements, three standard axioms. Full proofs in Appendix˜B; artifact in Appendix˜H. 2 Related Work Adversarial robustness research has established that small perturbations can fool classifiers szegedy2013intriguing ; goodfellow2014explaining ; carlini2017evaluating ; madry2018towards and that robustness may fundamentally trade off against accuracy tsipras2018robustness ; fawzi2018adversarial . Certified defenses provide guarantees for fixed models cohen2019certified ; katz2017reluplex ; singh2019abstract ; huang2017safety ; bagnall2019certifying , and topological perspectives have illuminated the structure of decision boundaries naitzat2020topology . For LLMs specifically, jailbreaking attacks zou2023universal ; chao2024jailbreaking ; mehrotra2024tree ; greshake2023indirect and automated red-teaming mouret2015illuminating ; samvelyan2024rainbow demonstrate persistent vulnerabilities. Our work differs in kind: rather than studying how failures arise for fixed models or how specific systems can be certified, we impose universal constraints on the defense map itself. The closest conceptual precedent is the no-free-lunch framework wolpert1997no , which proves that no optimizer dominates across all problems. We prove the analogous result for wrapper defenses: under continuity and utility preservation, no defense eliminates all failures. Table˜1 situates our result among comparable impossibility and tradeoff theorems. Table 1: Positioning among impossibility results (top) and empirical findings independently consistent with our predictions (bottom). Result Target Method Impossibility Verified Tsipras et al. tsipras2018robustness Classifier PAC / Gaussian Robustness + accuracy No Fawzi et al. fawzi2018adversarial Classifier Lipschitz geom. Adv. invulnerability No Wolpert & Macready wolpert1997no Optimizer Counting Universal dominance No Cohen et al. cohen2019certified Smoothed clf. Rand. smoothing (Certifies bound) No This work Def. wrapper Topology Cont. + util. + compl. Lean 4 Empirical findings consistent with our derived predictions Our prediction Theorem Confirming evidence Pred. Diminishing safety returns Int. Stability MART ge2024mart ; Sleeper Agents hubinger2024sleeper §11 Long context → exp. harder defense Cost Asymm. Many-Shot Jailbreaking anil2024many ; Kim et al. kim2025manyshot §11 Agentic tool-use degrades exp. Pipeline Lip. InjecAgent zhan2024injecagent ; ASB zhang2024asb §11 Temperature boundary instab. Stoch. Imposs. Instability of Safety yuan2025instability §11 Quantization preserves deep vulns Int. Stability Skoltech skoltech2025quant ; ETH eth2025gguf §11 Merging preserves weaker parent Int. Stability Hammoud et al. hammoud2024merging §11 Adv. training fragments Fragment Size Whack-a-Mole liu2026whackamole ; IRIS iris2025 §11 Asymmetric transfer Transferability Weak-to-Strong zhao2025weak ; IRIS iris2025 §11 Alignment tax ∝ unsafe vol. Discrete Dil. Safety Tax huang2025safetytax ; Huang et al. huang2026formal §11 Patch blast radius Patching Nonl. Slingshot slingshot2026 ; Sleeper Agents hubinger2024sleeper §11 3 Formal Framework Safe region SτS_τf(x)<τf(x)< leavesthese unchangedUnsafe region UτU_τf(x)>τf(x)> tries toremap theseBoundary BτB_τ: f(x)=τf(x)= point zzDD: defense remapsprompt space XXf(x)f(x)τ Figure 1: Schematic of the prompt space. The defense D must leave all safe inputs unchanged (utility preservation) and tries to remap unsafe inputs into the safe region. Boundary fixation (Theorem˜4.1) proves the defense must also leave some boundary points unchanged, the black dot z passes through with no remediation. Definition 3.1 (Alignment Deviation Function). Let X be a topological space (a set equipped with a notion of “open” and “closed” sets, such that the whole space and the empty set are both open and closed, arbitrary unions and finite intersections of open sets are open, and a notion of “neighborhoods” of points—that is, points “close to” a given point). An alignment deviation function is a continuous map f:X→ℝf X , i.e., small changes in the input produce small changes in the score. Given a threshold τ∈ℝτ : Sτ S_τ =x∈X:f(x)<τ =\x∈ X:f(x)<τ\ (safe region) (3) Uτ U_τ =x∈X:f(x)>τ =\x∈ X:f(x)>τ\ (unsafe region) (4) Bτ B_τ =x∈X:f(x)=τ =\x∈ X:f(x)=τ\ (boundary) (5) Definition 3.2 (Defense). A defense is a continuous map D:X→XD X→ X. It is utility-preserving if D(x)=xD(x)=x for all x∈Sτx∈ S_τ (safe prompts pass through unchanged), and complete if f(D(x))<τf(D(x))<τ for all x∈Xx∈ X (every output is safe). The central question is whether a defense can be both utility-preserving and complete. The following sections show that under natural conditions the answer is no. 4 Boundary Fixation We begin with the most fundamental result. The argument fits in a paragraph: the defense fixes every safe input, so continuity makes its fixed-point set closed. But the safe region SτS_τ is open (preimage of an open interval under continuous f), and in a connected space a nonempty proper open set is not closed. Hence the fixed-point set cannot stop exactly at the edge of the safe region, it must spill onto the boundary BτB_τ. Some boundary prompts pass through unchanged. Theorem 4.1 (Boundary Fixation). Let X be a connected Hausdorff space (a space that is “in one piece” and where distinct points can be separated by neighborhoods). Let f:X→ℝf X be continuous with Sτ,Uτ≠∅S_τ,U_τ≠ , and D:X→XD X→ X continuous with D|Sτ=idD|_S_τ=id. Then there exists z∈Xz∈ X with f(z)=τf(z)=τ and D(z)=zD(z)=z. Moreover, every z∈Sτ¯∖Sτz∈ S_τ S_τ satisfies f(z)=τf(z)=τ and D(z)=zD(z)=z, and this set is nonempty. Proof sketch. In a Hausdorff space, Fix(D)Fix(D) is closed (preimage of the diagonal). By utility preservation, Sτ⊆Fix(D)S_τ (D), so Sτ¯⊆Fix(D) S_τ (D). But Sτ=f−1((−∞,τ))S_τ=f^-1((-∞,τ)) is open and not closed (connectedness: a nonempty proper clopen set would disconnect X). Hence Sτ¯⊋Sτ S_τ S_τ. Any z∈Sτ¯∖Sτz∈ S_τ S_τ satisfies f(z)=τf(z)=τ (limits of values <τ<τ cannot exceed τ, and z∉Sτz∉ S_τ forces f(z)≥τf(z)≥τ) and D(z)=zD(z)=z. Full proof in Appendix˜B. ∎ This means that the defense’s fixed-point set is too large to avoid the boundary. Utility preservation forces it to contain the safe region; closure forces it to contain the boundary; connectedness ensures the boundary is nonempty. Alternatively: a complete utility-preserving defense would be a continuous retraction D:X→SτD X→ S_τ (since D|Sτ=idD|_S_τ=id and D(X)⊆SτD(X) S_τ), but a retract of a Hausdorff space is closed (the fixed-point set is closed), while SτS_τ is open and not closed (connectedness)—a contradiction. Theorem 4.2 (Defense Trilemma). Let X be a connected Hausdorff space, f:X→ℝf X continuous with Sτ,Uτ≠∅S_τ,U_τ≠ . No D:X→XD X→ X can simultaneously be continuous, utility-preserving (D|Sτ=idD|_S_τ=id), and complete (f(D(x))<τf(D(x))<τ for all x). All three hypotheses are individually necessary. A defense can satisfy at most two of the three—the defense trilemma (Figure˜2). Counterexamples for each dropped hypothesis appear in Appendix˜C. ContinuityUtility PreservationCompletenessBoth ⇒ defense fixes boundary (our result) Both ⇒ destroys utility Both ⇒ discontinuous jump All threesimultaneouslyimpossible Figure 2: The defense trilemma. Any continuous wrapper defense on a connected space can satisfy at most two of the three properties. The bottom edge is our main result; the other two edges correspond to counterexamples in Appendix˜C. Remark 4.3 (Not all boundary points are fixed). The theorem captures Sτ¯∖Sτ S_τ S_τ, not all of BτB_τ. Boundary points not in Sτ¯ S_τ may escape fixation. 4.1 Relaxed Utility Preservation Strict utility preservation (D(x)=xD(x)=x for safe x) can be relaxed. The impossibility survives score-preserving rewrites and even approximate score preservation. Theorem 4.4 (Score-Preserving Defense). Let X be a connected Hausdorff space, f:X→ℝf X continuous with Sτ,Uτ≠∅S_τ,U_τ≠ . If D:X→XD X→ X is continuous and score-preserving on safe inputs: f(D(x))=f(x)f(D(x))=f(x) for all x∈Sτx∈ S_τ, then there exists z with f(z)=τf(z)=τ and f(D(z))=τf(D(z))=τ. Proof sketch. Define h=f∘D−fh=f D-f. Then h is continuous and h|Sτ=0h|_S_τ=0. The zero set h=0\h=0\ is closed and contains Sτ¯ S_τ, since closed sets contain their boundary points. For z∈Sτ¯∖Sτz∈ S_τ S_τ, f(D(z))=f(z)=τf(D(z))=f(z)=τ. ∎ The next result weakens score preservation to approximate: Theorem 4.5 (ε -Relaxed Utility Preservation). Under the hypotheses of Theorem˜4.4, if |f(D(x))−f(x)|≤ε|f(D(x))-f(x)|≤ for all x∈Sτx∈ S_τ, then there exists z with f(z)=τf(z)=τ and f(D(z))≥τ−εf(D(z))≥τ- . Proof sketch. The set x:h(x)≥−ε\x:h(x)≥- \ is closed and contains SτS_τ, hence Sτ¯ S_τ. For z∈Sτ¯∖Sτz∈ S_τ S_τ: f(D(z))=τ+h(z)≥τ−εf(D(z))=τ+h(z)≥τ- . ∎ Remark 4.6 (Why D(Sτ)⊆SτD(S_τ) S_τ alone is insufficient). The weakest relaxation—D(Sτ)⊆SτD(S_τ) S_τ with no score constraint—does allow a complete defense (e.g., a constant map D(x)=x0D(x)=x_0 to a fixed safe point). But this destroys all semantic content: every prompt produces the same response. The score-preservation conditions formalize the requirement that defense must not destroy utility, without requiring the defense to be the identity. 5 ε -Robust Constraint Boundary fixation produces at least one fixed point; Lipschitz regularity makes the failure spread to a neighborhood. Theorem 5.1 (ε -Robust Defense Constraint). Under the hypotheses of Theorem˜4.1, if (X,d)(X,d) is a metric space, f is L-Lipschitz, and D is K-Lipschitz, then for the fixed boundary point z: f(D(x))≥τ−LKdist(x,z)for all x∈X.f(D(x))\;≥\;τ-LKdist(x,z) all x∈ X. (6) Points within distance δ of z remain within LKδLKδ of threshold. Proof sketch. Since D(z)=zD(z)=z and D is K-Lipschitz: dist(D(x),z)≤Kdist(x,z)dist(D(x),z)≤ Kdist(x,z). Since f(z)=τf(z)=τ and f is L-Lipschitz: |f(D(x))−τ|≤L⋅Kdist(x,z)|f(D(x))-τ|≤ L· Kdist(x,z). Full proof in Appendix˜B. ∎ Theorem 5.2 (Positive-Measure ε -Band). Under the hypotheses of Theorem˜5.1, if X is connected and f takes values below τ−ετ- for some ε>0 >0, then the band ℬε=x:τ−ε≤f(x)≤τB_ =\x:τ- ≤ f(x)≤τ\ has positive measure (under any measure positive on nonempty open sets). Specifically, B(c,ε/(4L))⊆ℬεB(c, /(4L)) _ for the midpoint c with f(c)=τ−ε/2f(c)=τ- /2 (which exists by the intermediate value theorem). Remark 5.3 (Defense behavior on the ε -band). By Theorem˜4.1, Sτ¯⊆Fix(D) S_τ (D). Every point in ℬεB_ with f(x)<τf(x)<τ is safe and therefore fixed by utility preservation; every point with f(x)=τf(x)=τ in Sτ¯ S_τ is fixed by boundary fixation. On both subsets f(D(x))=f(x)∈[τ−ε,τ]f(D(x))=f(x)∈[τ- ,\,τ]. The remainder—boundary points outside Sτ¯ S_τ—is contained in the level set f−1(τ)f^-1(τ), which has measure zero when f is Lipschitz on ℝnR^n (by the coarea formula; not formalized in the Lean artifact). Proof sketch. For y∈B(c,ε/(4L))y∈ B(c, /(4L)): |f(y)−f(c)|≤L⋅ε/(4L)=ε/4|f(y)-f(c)|≤ L· /(4L)= /4. Since f(c)=τ−ε/2f(c)=τ- /2, we get τ−3ε/4≤f(y)≤τ−ε/4τ-3 /4≤ f(y)≤τ- /4, so y∈ℬεy _ . ∎ 6 Persistent Unsafe Region The ε -robust constraint bounds the depth to which the defense pushes near-boundary points, but permits values slightly below τ. When the alignment surface rises faster than the defense can pull it down, some points remain above threshold. Decoupling global and directional Lipschitz constants. The ε -robust bound (Theorem˜5.1) uses the global Lipschitz constant L of f, which bounds f uniformly in all directions. The persistence argument, however, compares f’s growth rate in the steep direction to how much the defense can reduce f along the displacement direction D(x)−xD(x)-x. In anisotropic settings these directions differ: f may rise steeply toward the unsafe region while varying slowly in the direction the defense pulls. We write ℓ for the defense-path Lipschitz constant: ℓ=supx≠D(x)|f(D(x))−f(x)|dist(D(x),x) \;=\; _x≠ D(x) |f(D(x))-f(x)|dist(D(x),\,x) (with ℓ=0 =0 when D=idD=id, i.e., the supremum over the empty set is taken as 0). Since f is L-Lipschitz globally, ℓ≤L ≤ L. When the alignment surface is isotropic (ℓ=L =L), the steep region is empty for every K≥0K≥ 0 (verified in Lean as shallow_boundary_no_persistence). The result is non-vacuous precisely when the surface is anisotropic: ℓ<L <L, with directional gradient G satisfying G>ℓ(K+1)G> (K+1). Lemma 6.1 (Input-Relative Bound). Under the hypotheses of Theorem˜5.1, if f has defense-path Lipschitz constant ℓ , then f(D(x))≥f(x)−ℓ(K+1)dist(x,z)f(D(x))≥ f(x)- (K+1)dist(x,z) for all x∈Xx∈ X. Proof sketch. Triangle inequality: dist(D(x),x)≤dist(D(x),z)+dist(z,x)≤(K+1)dist(x,z)dist(D(x),x) (D(x),z)+dist(z,x)≤(K+1)dist(x,z). Defense-path Lipschitz: |f(D(x))−f(x)|≤ℓdist(D(x),x)≤ℓ(K+1)dist(x,z)|f(D(x))-f(x)|≤ (D(x),x)≤ (K+1)dist(x,z). ∎ This means that the defense can reduce any point’s score by at most ℓ(K+1) (K+1) times its distance from z. If the score rises faster than that, the defense loses. Definition 6.2 (Steep region). Given a fixed boundary point z, the steep region is =x∈X:f(x)>τ+ℓ(K+1)dist(x,z)S=\x∈ X:f(x)>τ+ (K+1)dist(x,z)\—the set of points where alignment deviation exceeds τ by more than the defense’s Lipschitz budget can compensate. Theorem 6.3 (Persistent Unsafe Region). Let X be a connected Hausdorff metric space, f continuous and L-Lipschitz, D continuous and K-Lipschitz with D|Sτ=idD|_S_τ=id, and Sτ,Uτ≠∅S_τ,U_τ≠ . Let z∈Sτ¯∖Sτz∈ S_τ S_τ be the fixed boundary point from Theorem˜4.1, and let ℓ be the defense-path Lipschitz constant. If ≠∅S≠ , then: 1. S is open. 2. S has positive measure (under any measure positive on nonempty open sets). 3. For every x∈x : f(D(x))>τf(D(x))>τ. The defense leaves a positive-measure region that remains unsafe. Proof sketch. S is a strict superlevel set of a continuous function, hence open. For x∈x : f(D(x))≥f(x)−ℓ(K+1)dist(x,z)>τf(D(x))≥ f(x)- (K+1)dist(x,z)>τ by Lemma˜6.1 and the definition of S. Full proof in Appendix˜B. ∎ When does the steep region exist? Whenever the alignment surface has directional slope exceeding ℓ(K+1) (K+1) at the boundary: Proposition 6.4 (Transversality from Directional Derivative). In a normed space, if f has Fréchet derivative f′f at boundary point z with directional value f′(v)>ℓ(K+1)f (v)> (K+1) along a unit vector v, then z+tv∈z+tv for sufficiently small t>0t>0. If ‖f′‖>ℓ(K+1)\|f \|> (K+1), such a v exists by operator-norm near-attainment. Verified in Lean as gradient_norm_implies_steep_nonempty (MoF_21_GradientChain), which derives the local growth bound from HasFDerivAt rather than assuming it. This condition is observed empirically in the two models with Uτ≠∅U_τ≠ (Section˜10): the alignment surface rises steeply toward the unsafe region (G large) while the defense operates in a smoother subspace (ℓ≪L L). τ (x)f(x)z(a) Boundary FixationDefense must fix zτδ-neighborhoodε -band(b) ε -RobustNear z: constrainedτ+ℓ(K+1)δτ+ (K+1) : staysunsafe(c) Persistent Regionff outruns defense Figure 3: The three impossibility results on a 1D cross-section. (a) The defense must fix boundary point z (Thm. 4.1). (b) Near z, Lipschitz regularity constrains the defense to a shallow ε -band (yellow; Thm. 5.1). (c) Where f rises faster than the defense budget ℓ(K+1)δ (K+1)δ (dashed red), the region above τ persists (red shading; Thm. 6.3). 7 Quantitative Bounds The preceding results establish that failures exist and have positive measure. This section provides explicit lower bounds and identifies a fundamental dilemma in choosing the defense’s aggressiveness. Theorem 7.1 (Volume Lower Bound). Let f:ℝn→ℝf ^n be L-Lipschitz with L>0L>0, and let μ denote Lebesgue measure. If there exists c with f(c)=τ−ε/2f(c)=τ- /2, then B(c,ε/(4L))⊆ℬεB(c,\, /(4L)) _ , giving: μ(ℬε)≥Vn⋅(ε4L)nμ(B_ )\;≥\;V_n· ( 4L )^\!n (7) where VnV_n is the volume of the unit ball in ℝnR^n. In ℝ1R^1, this simplifies to μ(ℬε)≥ε/(2L)μ(B_ )≥ /(2L). Proved in the Lean artifact as MoF_17_CoareaBound. Smoother surfaces (smaller L) produce wider ε -bands. Theorem 7.2 (Cone Measure Bound). In ℝR with Lebesgue measure μ, if f(x)≥τ+c(x−z)f(x)≥τ+c(x-z) for all x∈(z,z+δ0)x∈(z,\,z+ _0) with c>ℓ(K+1)c> (K+1), then μ(x:f(D(x))>τ)≥δ0μ(\x:f(D(x))>τ\)≥ _0. Proved in the Lean artifact as MoF_18_ConeBound. This gives a concrete lower bound on the persistent region: if the alignment surface is steep over an interval of length δ0 _0, the defense fails on at least that much volume. The bound ≥δ0≥ _0 is tight: equality holds when the cone condition fails exactly at z+δ0z+ _0 (i.e., f(z+δ0)=τ+cδ0f(z+ _0)=τ+c\, _0 and f(x)<τ+c(x−z)f(x)<τ+c(x-z) for x>z+δ0x>z+ _0). If the cone extends beyond δ0 _0, the persistent region is strictly larger. The defense designer faces a dilemma in choosing the Lipschitz constant K of the defense: Theorem 7.3 (Defense Dilemma). Assume f is differentiable at boundary point z with G=‖∇f(z)‖G=\|∇ f(z)\|, and let ℓ be the defense-path Lipschitz constant (Section˜6). Define K∗=G/ℓ−1K^*=G/ -1. Then: 1. If K<K∗K<K^*: the persistent unsafe region exists (G>ℓ(K+1)G> (K+1), Theorem˜6.3 applies). 2. If K≥K∗K≥ K^*: the ε -robust bound τ−ℓ(K+1)δτ- (K+1)δ becomes loose enough that the theorem can no longer exclude the defense from succeeding on the steep region (ℓ(K+1)≥G (K+1)≥ G). Since ℓ≤L ≤ L, the dilemma is sharpest when ℓ≪L L (anisotropic surfaces). When ℓ=L =L (isotropic), K∗≤0K^*≤ 0 and horn (1) is vacuous. Proved in the Lean artifact as MoF_19_OptimalDefense; the Lean theorem optimal_K_exists is stated for generic positive reals (G,L)(G,L)—instantiating L↦ℓL recovers the defense-path version above. 8 From Discrete Data to Continuous Theory This section bridges discrete token observations and continuous theory. 8.1 Continuous Interpolation Any finite set of behavioral observations can be extended to a continuous function on the full space. The classical Tietze extension theorem guarantees this: Theorem 8.1 (Continuous Relaxation). Let (X,d)(X,d) be a connected, normal, Hausdorff metric space, and S⊂XS⊂ X a finite set of observations with observed alignment scores g:S→ℝg S satisfying g(p)<τg(p)<τ and g(q)>τg(q)>τ for some p,q∈Sp,q∈ S. Then there exists a continuous f:X→ℝf X extending g (i.e., f|S=gf|_S=g) for which the hypotheses of Theorem˜4.1 hold. If the extension is chosen to be Lipschitz (via McShane–Whitney), the hypotheses of Theorem˜5.1 also hold. If f is additionally Lipschitz (as for GP posterior means under standard kernel assumptions), Theorem˜6.3 applies wherever transversality is met. Proof sketch. Step 1 (Extension exists). S is finite and X is T1T_1 (every Hausdorff space is T1T_1), so S is closed. Since X is normal and g:S→ℝg S is continuous (every function on a discrete closed subset is continuous), the Tietze extension theorem provides a continuous f:X→ℝf X with f|S=gf|_S=g. Step 2 (Hypotheses of Theorem˜4.1 are satisfied). We have f(p)=g(p)<τf(p)=g(p)<τ and f(q)=g(q)>τf(q)=g(q)>τ, so Sτ≠∅S_τ≠ and Uτ≠∅U_τ≠ . Since X is connected and Hausdorff, Theorem˜4.1 applies: any continuous, utility-preserving defense has a fixed boundary point. Step 3 (Lipschitz extension enables stronger results). When a Lipschitz extension is needed (e.g., for Theorems˜5.1 and 6.3), the McShane–Whitney theorem provides an L-Lipschitz f agreeing with g on S. Given the Lipschitz constants L of f and K of D, the ε -robust bound f(D(x))≥τ−LKdist(x,z)f(D(x))≥τ-LKdist(x,z) follows from Theorem˜5.1. If additionally the alignment surface has directional slope c>ℓ(K+1)c> (K+1) at the fixed boundary point z (where ℓ is the defense-path Lipschitz constant), Theorem˜6.3 gives a positive-measure region that remains strictly unsafe. ∎ If we observe both safe and unsafe model behaviors, the impossibility holds for every continuous model consistent with our observations. 8.2 Direct Discrete Results To address the objection that continuous impossibility might be an artifact of continuous relaxation, we prove parallel results directly on finite sets using only counting arguments and induction. No topology is required; all results are verified in Lean as MoF_12_Discrete. Theorem 8.2 (Discrete IVT). Let f:0,…,n+1→ℝf \0,…,n+1\ with f(0)<τf(0)<τ and f(n+1)≥τf(n+1)≥τ. Then there exists i with f(i)<τf(i)<τ and f(i+1)≥τf(i+1)≥τ. Theorem 8.3 (Discrete Defense Dilemma). Let X be a finite set with Sτ,Uτ≠∅S_τ,U_τ≠ , and D:X→XD X→ X utility-preserving (D(x)=xD(x)=x for f(x)<τf(x)<τ). 1. If D is injective, then f(D(u))≥τf(D(u))≥τ for every u with f(u)≥τf(u)≥τ (including boundary points): the defense is incomplete. 2. If D is complete (f(D(x))<τf(D(x))<τ for all x), then D is non-injective: ∃x≠y∃\,x≠ y with D(x)=D(y)D(x)=D(y). Proof. (1) Suppose D is injective and f(D(u))<τf(D(u))<τ for some u with f(u)≥τf(u)≥τ. Then D(u)D(u) is safe, so D(D(u))=D(u)D(D(u))=D(u) by utility preservation. Injectivity gives D(u)=uD(u)=u, so f(u)=f(D(u))<τf(u)=f(D(u))<τ, contradicting f(u)≥τf(u)≥τ. (2) For any u∈Uτu∈ U_τ: completeness gives f(D(u))<τf(D(u))<τ, so utility preservation gives D(D(u))=D(u)D(D(u))=D(u). But u≠D(u)u≠ D(u) since f(u)≥τ>f(D(u))f(u)≥τ>f(D(u)). So u and D(u)D(u) are distinct inputs with D(u)=D(D(u))D(u)=D(D(u)): the defense is non-injective. ∎ The continuous trilemma trades continuity for completeness; the discrete dilemma trades injectivity. Part (1) is the genuine constraint: an information-preserving defense cannot eliminate unsafe outputs. Any complete defense must destroy information—collapsing distinct inputs to the same output. This is not a failure of the defense; it is the mechanism by which it operates. The downstream model receives the same input regardless of whether the original was safe or an attack; any audit or attack-detection logic must act before D is applied. 9 Extensions The core results assume a static, deterministic, single-turn defense. Does multi-turn interaction, randomization, or pipelining provide an escape? We show it does not. Each extension is a direct application of the boundary fixation machinery to a modified setting. 9.1 Multi-Turn Impossibility Theorem 9.1 (Multi-Turn Impossibility). Let ft,Dtt=1T\f_t,D_t\_t=1^T be alignment functions and defenses over T turns on a connected Hausdorff space, each continuous and utility-preserving, with Sτ(t),Uτ(t)≠∅S_τ^(t),U_τ^(t)≠ at every turn. Then for every turn t, there exists ztz_t with ft(zt)=τf_t(z_t)=τ and Dt(zt)=ztD_t(z_t)=z_t. Proof sketch. Apply Theorem˜4.1 to (ft,Dt)(f_t,D_t) at each turn. The functions may depend on full history—this does not matter, as each timestep is a fresh instance of boundary fixation. ∎ Multi-turn interaction compounds the problem: the attacker’s best observed exploit improves monotonically (running_max_monotone), and the attacker can steer toward transversality via binary search (transversality_reachable). 9.2 Stochastic Defense Impossibility Theorem 9.2 (Stochastic Defense Impossibility). Let X be a connected Hausdorff space, f:X→ℝf X continuous with Sτ,Uτ≠∅S_τ,U_τ≠ . Let D be a stochastic defense and define g(x)=y∼D(x)[f(y)]g(x)=E_y D(x)[f(y)]. If g is continuous and g(x)=f(x)g(x)=f(x) for all x∈Sτx∈ S_τ, then there exists z with f(z)=τf(z)=τ and g(z)=τg(z)=τ. Proof sketch. Define h=g−fh=g-f. Then h is continuous and h|Sτ=0h|_S_τ=0, so h vanishes on Sτ¯ S_τ (same closure argument as Theorem˜4.4). For z∈Sτ¯∖Sτz∈ S_τ S_τ: g(z)=f(z)=τg(z)=f(z)=τ. ∎ Remark (stochastic dichotomy). Since [f(D(z))]=τE[f(D(z))]=τ, either f(D(z))=τf(D(z))=τ almost surely (the defense is deterministic at z), or the random variable f(D(z))f(D(z)) has positive probability of exceeding τ—i.e., the defense actively produces unsafe outputs with positive probability. The stochastic case is therefore strictly harder than the deterministic one: a genuinely random defense at boundary points must sometimes make things worse. Remark. The continuity of g is a nontrivial assumption: it requires the distribution D(x)D(x) to vary continuously with x in a suitable sense. Stochastic defenses with discontinuous rejection probabilities escape this theorem. 9.3 Nonlinear Agent Pipelines Theorem 9.3 (Pipeline Lipschitz Degradation). If stages T1,…,TnT_1,…,T_n are K1,…,KnK_1,…,K_n-Lipschitz, the composed pipeline is (∏Ki)(Π K_i)-Lipschitz. For n stages each with K≥2K≥ 2, the effective constant is KnK^n—exponential in depth. Theorem 9.4 (Pipeline Impossibility). If the composed pipeline P=Tn∘⋯∘T1∘DP=T_n ·s T_1 D is continuous and P(x)=xP(x)=x for all x∈Sτx∈ S_τ, then P has boundary fixed points. If D is KDK_D-Lipschitz and each TiT_i is K-Lipschitz, the ε -robust band scales as L⋅KD⋅Kn⋅δL· K_D· K^n·δ Proved in the Lean artifact as MoF_15_NonlinearAgents. Note: P(x)=xP(x)=x for safe x requires Tn∘⋯∘T1T_n ·s T_1 to act as the identity on safe inputs, not just D. This holds when the tool chain preserves safe inputs (e.g., a safety-certified pipeline), but not for arbitrary tools. Additional results on basin structure, fragment sizes, perturbation robustness, convergence, transferability, and cost asymmetry appear in Appendices˜A, D, E and F. 10 Experimental Validation The Manifold of Failure framework munshi2026manifold maps three LLMs over a 2D behavioral space with two axes: query indirection (how obliquely the prompt asks for unsafe content) and authority framing (how much the prompt invokes authority or permission). Table˜2 summarizes nine qualitative predictions, all directionally consistent with observations. Table 2: Falsifiable predictions confirmed by empirical data. Theorem Predicts Confirmed by Basin Structure (A.1) Basins are open with positive measure Heatmaps show extended regions Fragmentation (A.2) Smooth → large basins; rough → mosaic Llama: mesa; GPT-OSS: mosaic Convergence (D.2) Attacks exhibit monotone convergence Convergence curves plateau Transferability (D.3) Similar surfaces → shared basins Llama .93→.93→ GPT-OSS .73→.73→ Mini .47.47 Authority (D.4) Horizontal banding Bands at a2≈.25a_2≈.25–.35.35, .65.65–.85.85 Persistent (6.3) Steep boundaries → unsafe volume persists Llama’s .93.93 plateau persists under defense Interior Stability (E.1) Deep basin points survive fine-tuning Vulnerability persists across variants Cost (F.1) 2D tractable, high-d intractable 15K queries fill 63% at d=2d\!=\!2 Pipeline (9.3) Deeper pipelines → wider failure band Not directly tested (no pipeline experiment) Llama-3-8B (mean AD 0.930.93, basin rate 93.9%93.9\%): near-flat alignment surface (small L), large robustness radii. Estimated from the 2D behavioral surface in munshi2026manifold : directional slope G≈5G≈ 5 at the steepest boundary crossing. For the defense-path Lipschitz constant we assume a hypothetical nearest-safe-projection defense (D(x)D(x) maps each point to the closest x′∈Sτx ∈ S_τ) and estimate ℓ≈1 ≈ 1 from grid-adjacent score differences in the direction orthogonal to the boundary (the projection direction on the 2D grid). Setting K=1K=1 (identity-rate defense), these satisfy G>ℓ(K+1)=2G> (K+1)=2. GPT-OSS-20B (mean AD 0.730.73, basin rate 64.3%64.3\%): a rugged landscape (large L) with many small fragments. Horizontal bands confirm authority monotonicity. GPT-5-Mini (peak AD 0.500.50, basin rate 0%0\%): at τ=0.50τ=0.50, Uτ=∅U_τ= —none of the three theorems apply, correctly predicting no impossibility. 11 The Engineering Prescription The results do not say defense is valueless; they say complete defense is impossible under the stated constraints. The engineering goal shifts from elimination to management, ordered from most to least actionable: 1. Make the boundary shallow. Set τ so that boundary-level behavior is benign. If f(z)=τf(z)=τ yields a polite refusal rather than harmful compliance, the impossibility is mathematically true but practically harmless. GPT-5-Mini exemplifies this: its ceiling at AD=0.50AD=0.50 means Uτ=∅U_τ= , so the impossibility theorems do not apply and no defense failure is predicted. 2. Reduce the Lipschitz constant. Smaller L tightens the bound ℓ≤L ≤ L, potentially reducing the defense-path constant ℓ and narrowing the persistent region. The tradeoff: smoother surfaces spread vulnerabilities over wider but more easily monitored regions. 3. Reduce the effective dimension. Defense cost grows as NdN^d (Theorem˜F.1). Constraining the prompt interface—standardized formats, restricted API parameters, bounded context lengths—reduces d, making the behavioral space tractable. 4. Monitor, don’t eliminate, the boundary. Transversal crossings persist under fine-tuning (Theorem˜E.2) and recur every turn (Theorem˜9.1). Rather than attempt the impossible, deploy runtime monitoring that detects approach to the boundary. The Lipschitz bound (Theorem˜D.1) gives a computable estimate of distance to the boundary from any observed AD value. 12 Limitations Boundary fixation is at the boundary. Fixed points satisfy f(z)=τf(z)=τ exactly. If τ-level behavior is benign, the theorem is true but harmless. The ε -robust constraint limits depth, not direction. The defense may push near-boundary points slightly below τ. The bound limits how far, not whether. Persistence requires transversality. The persistent unsafe region exists only where the alignment surface is steep (c>ℓ(K+1)c> (K+1), where ℓ is the defense-path Lipschitz constant). For isotropic f (ℓ=L =L), S is empty for all K≥0K≥ 0. Grid-based cost asymmetry. Theorem˜F.1 assumes exhaustive grid enumeration. Learning-based defenses that generalize across the space may sidestep the exponential bound. 13 Conclusion We establish a three-level impossibility hierarchy for prompt-injection defense: boundary fixation, the ε -robust constraint, and the persistent unsafe region theorem. Continuous topology, Lipschitz bounds, discrete counting, stochastic expectations, multi-turn dynamics, and capacity constraints all point to the same conclusion: under the wrapper model, some failures persist. The practical prescription is to make the boundary shallow, smooth, and low-dimensional, and to engineer around it rather than assume it can be eliminated. Broader Impact This work characterizes structural limitations of a specific class of defenses (continuous utility-preserving wrappers). The results could inform defense engineering by identifying which design constraints matter most. They could also be misread as implying that LLM defense is futile—this is not the case. The theorems apply only to wrappers satisfying specific mathematical assumptions; training-time alignment, architectural changes, discontinuous filtering, ensemble defenses, and human-in-the-loop systems are not covered. We emphasize that the impossibility results should motivate better defense design, not abandonment of defense. References [1] G. Alon and M. Kamfonas. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132, 2023. [2] A. Bagnall and G. Stewart. Certifying the true error: Machine learning in Coq with verified generalization guarantees. Proceedings of the AAAI Conference on Artificial Intelligence, 2019. [3] Y. Bai et al. Constitutional AI: Harmlessness from AI feedback. arXiv preprint arXiv:2212.08073, 2022. [4] P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419, 2024. [5] J. Cohen, E. Rosenfeld, and J. Z. Kolter. Certified adversarial robustness via randomized smoothing. Proceedings of ICML, 2019. [6] I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. Proceedings of ICLR, 2015. [7] H. Inan et al. Llama Guard: LLM-based input-output safeguard for human-AI conversations. arXiv preprint arXiv:2312.06674, 2023. [8] G. Katz, C. Barrett, D. L. Dill, K. Julian, and M. J. Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. Proceedings of CAV, 2017. [9] N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. Proceedings of IEEE S&P, 2017. [10] A. Mehrotra et al. Tree of attacks: Jailbreaking black-box LLMs automatically. Advances in Neural Information Processing Systems, 37, 2024. [11] A. Fawzi, H. Fawzi, and O. Fawzi. Adversarial vulnerability for any classifier. Advances in Neural Information Processing Systems, 31, 2018. [12] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. Proceedings of AISec, 2023. [13] X. Huang, M. Kwiatkowska, S. Wang, and M. Wu. Safety verification of deep neural networks. Proceedings of CAV, 2017. [14] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. Proceedings of ICLR, 2018. [15] J.-B. Mouret and J. Clune. Illuminating search spaces by mapping elites. arXiv preprint arXiv:1504.04909, 2015. [16] G. Naitzat, A. Zhitnikov, and L.-H. Lim. Topology of deep neural networks. Journal of Machine Learning Research, 21(184):1–40, 2020. [17] S. Munshi, M. Bhatt, V. S. Narajala, I. Habler, A. Al-Kahfah, K. Huang, and B. Gatto. Manifold of failure: Behavioral attraction basins in language models. arXiv preprint arXiv:2602.22291v2, 2026. [18] M. Samvelyan et al. Rainbow teaming: Open-ended generation of diverse adversarial prompts. Advances in Neural Information Processing Systems, 37, 2024. [19] G. Singh, T. Gehr, M. Püschel, and M. Vechev. An abstract domain for certifying neural networks. Proceedings of POPL, 2019. [20] C. Szegedy et al. Intriguing properties of neural networks. Proceedings of ICLR, 2014. [21] D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry. Robustness may be at odds with accuracy. Proceedings of ICLR, 2019. [22] D. H. Wolpert and W. G. Macready. No free lunch theorems for optimization. IEEE Trans. Evol. Comput., 1(1):67–82, 1997. [23] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. [24] K. Ge et al. MART: Improving LLM safety with multi-round automatic red-teaming. Proceedings of NAACL, 2024. [25] E. Hubinger et al. Sleeper agents: Training deceptive LLMs that persist through safety training. arXiv preprint arXiv:2401.05566, 2024. [26] C. Anil et al. Many-shot jailbreaking. Advances in Neural Information Processing Systems, 37, 2024. [27] D. Kim et al. What really matters in many-shot attacks? Proceedings of ACL, 2025. [28] Q. Zhan et al. InjecAgent: Benchmarking indirect prompt injections in tool-integrated LLM agents. Findings of ACL, 2024. [29] H. Zhang et al. Agent security bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents. arXiv preprint arXiv:2410.02644, 2024. [30] Y. Yuan et al. The instability of safety. arXiv preprint arXiv:2512.12066, 2025. [31] V. Tsvetkov et al. Quantization and safety: A closer look at LLM safety under weight compression. arXiv preprint arXiv:2502.15799, 2025. [32] F. Nesti et al. Mind the gap: Adversarial attacks against GGUF quantized LLMs. Proceedings of ICML, 2025. [33] H. Hammoud et al. Model merging and safety alignment: One bad model spoils the bunch. Findings of EMNLP, 2024. [34] X. Liu et al. Alignment whack-a-mole. arXiv preprint arXiv:2603.20957, 2026. [35] D. Rosenberg et al. IRIS: Adversarial suffix attacks against robust defenses. Proceedings of NAACL, 2025. [36] X. Zhao et al. Weak-to-strong jailbreaking on large language models. Proceedings of ICML, 2025. [37] Y. Huang et al. The safety tax of reasoning alignment. arXiv preprint arXiv:2503.00555, 2025. [38] Y. Huang et al. On the geometric inevitability of the alignment tax. arXiv preprint arXiv:2603.00047, 2026. [39] L. Bailey et al. Slingshot: RL-based agent-to-agent jailbreaking. arXiv preprint arXiv:2602.02395, 2026. Appendices Appendix A Vulnerability Landscape This section characterizes the geometry of the unsafe region. Theorem A.1 (Basin Structure). If f is continuous and f(p)>τf(p)>τ, then UτU_τ is open. Under any measure positive on nonempty open sets, UτU_τ has positive measure. Theorem A.2 (Basin Fragment Minimum Size). If X is a normed space, f is L-Lipschitz with f(p)>τf(p)>τ, the connected component of UτU_τ containing p has diameter ≥2(f(p)−τ)/L≥ 2(f(p)-τ)/L. Smoother surfaces (smaller L) produce larger basins; rougher surfaces produce smaller fragments. Appendix B Full Proofs Proof of Theorem˜4.1 (Boundary Fixation). Step 1 (Hausdorff ⇒ fixed-point set is closed). Fix(D)=x:D(x)=xFix(D)=\x:D(x)=x\ is the preimage of the diagonal Δ⊂X×X ⊂ X× X under x↦(D(x),x)x (D(x),x). In a Hausdorff space, Δ is closed, so Fix(D)Fix(D) is closed. Step 2 (Utility preservation ⇒ safe region ⊆ fixed points). Sτ⊆Fix(D)S_τ (D). Since Fix(D)Fix(D) is closed: Sτ¯⊆Fix(D) S_τ (D). Step 3 (Connectedness ⇒ safe region is not closed). Sτ=f−1((−∞,τ))S_τ=f^-1((-∞,τ)) is open. If also closed, it would be clopen—but in a connected space the only clopen sets are ∅ and X. Since both SτS_τ and UτU_τ are nonempty, SτS_τ is not closed. Step 4 (Boundary point exists). Sτ¯⊋Sτ S_τ S_τ, so there exists z∈Sτ¯∖Sτz∈ S_τ S_τ. Continuity gives f(z)≤τf(z)≤τ; z∉Sτz∉ S_τ gives f(z)≥τf(z)≥τ. Hence f(z)=τf(z)=τ. Step 5 (Defense fixes the boundary point). z∈Sτ¯⊆Fix(D)z∈ S_τ (D), so D(z)=zD(z)=z and f(D(z))=τf(D(z))=τ. ∎ Proof of Theorem˜5.1 (ε -Robust Constraint). By Theorem˜4.1, the fixed boundary point z exists. Step 1. Since D(z)=zD(z)=z and D is K-Lipschitz: dist(D(x),z)=dist(D(x),D(z))≤Kdist(x,z)dist(D(x),z)=dist(D(x),D(z))≤ Kdist(x,z). Step 2. Since f(z)=τf(z)=τ and f is L-Lipschitz: |f(D(x))−τ|=|f(D(x))−f(z)|≤Ldist(D(x),z)≤LKdist(x,z)|f(D(x))-τ|=|f(D(x))-f(z)|≤ Ldist(D(x),z)≤ LKdist(x,z). ∎ Proof of Theorem˜6.3 (Persistent Unsafe Region). (1) S is the strict superlevel set of x↦f(x)−ℓ(K+1)dist(x,z)x f(x)- (K+1)dist(x,z) at level τ, hence open. (2) Open and nonempty implies positive measure. (3) For x∈x : f(x)>τ+ℓ(K+1)dist(x,z)f(x)>τ+ (K+1)dist(x,z). By Lemma˜6.1: f(D(x))≥f(x)−ℓ(K+1)dist(x,z)>τf(D(x))≥ f(x)- (K+1)dist(x,z)>τ. Lean: persistent_unsafe_refined in MoF_20_RefinedPersistence (defense-path constant ℓ ). MoF_11_EpsilonRobust contains an earlier version using the global constant L; as noted in Section˜6, that version is vacuous for isotropic surfaces. ∎ Appendix C Counterexamples: Each Hypothesis Is Necessary Counterexample C.1 (Removing connectedness). X=0,1X=\0,1\ discrete, f(0)=0f(0)=0, f(1)=1f(1)=1, τ=0.5τ=0.5. D(0)=0D(0)=0, D(1)=0D(1)=0: continuous, utility-preserving, complete. Counterexample C.2 (Removing continuity). X=[0,1]X=[0,1], f(x)=xf(x)=x, τ=0.5τ=0.5. D(x)=xD(x)=x for x<0.5x<0.5, D(x)=0D(x)=0 for x≥0.5x≥ 0.5: utility-preserving and complete, but discontinuous at 0.50.5. Counterexample C.3 (Removing utility preservation). D(x)=x0D(x)=x_0 for a fixed safe point: continuous and complete, but destroys all inputs. Appendix D Attack Properties Theorem D.1 (Perturbation Robustness). If f is L-Lipschitz and f(p)>τf(p)>τ, then B(p,(f(p)−τ)/L)⊆UτB(p,\,(f(p)-τ)/L) U_τ. The radius is monotone in f(p)f(p). Theorem D.2 (Iterative Convergence). Any monotone-improvement operator T with score in [0,1][0,1] converges. If each step gains ≥δ≥δ, convergence takes ≤⌊1/δ⌋≤ 1/δ steps. Theorem D.3 (Transferability). ‖f−g‖∞≤δ⟹f>τ+δ⊆g>τ\|f-g\|_∞≤δ \f>τ+δ\ \g>τ\. Transfer costs zero additional queries. Theorem D.4 (Authority Monotonicity). If f(y,⋅)f(y,·) is monotone non-decreasing in authority for each fixed indirection y, the vulnerability set is upward-closed with a critical threshold a2∗(y)a^*_2(y) (by IVT, when f(y,⋅)f(y,·) is continuous and crosses τ). If additionally f is monotone non-decreasing in indirection for each fixed authority, the threshold curve y↦a2∗(y)y a^*_2(y) is non-increasing. Theorem D.5 (Gradient Ascent). If f has nonzero Fréchet derivative at x, there exist v and ε>0 >0 with f(x+εv)>f(x)f(x+ v)>f(x). Appendix E Stability Under Fine-Tuning Theorem E.1 (Interior Stability). If ‖f−g‖∞≤ε\|f-g\|_∞≤ : f(x)>τ+ε⟹g(x)>τf(x)>τ+ g(x)>τ, and f(x)<τ−ε⟹g(x)<τf(x)<τ- g(x)<τ. Only the band |f(x)−τ|≤ε|f(x)-τ|≤ is uncertain. Theorem E.2 (Crossing Preservation). Let f,g:[a,b]→ℝf,g [a,b] be continuous. If f crosses τ on [a,b][a,b] with margin m (i.e., f(a′)<τ−mf(a )<τ-m and f(b′)>τ+mf(b )>τ+m for some a′,b′∈[a,b]a ,b ∈[a,b]) and ‖f−g‖∞≤ε<m\|f-g\|_∞≤ <m, then g also crosses τ on [a,b][a,b]. Theorem E.3 (Patching Is Nonlocal). There exist f,gf,g with ‖f−g‖∞≤ε\|f-g\|_∞≤ such that eliminating a vulnerability at one point necessarily changes values at distant points. Appendix F Cost Asymmetry Theorem F.1 (Exponential Cost Asymmetry). For grid-based defense with N≥2N≥ 2 bins per axis in d dimensions: attack cost ≤1/δ≤ 1/δ (dimension-independent); defense cost =Nd=N^d (exponential in d); ratio δ⋅Nd→∞δ· N^d→∞ as d→∞d→∞. At d=2d=2 with N=25N=25 and δ=0.01δ=0.01, the ratio is 6.256.25. At d=10d=10, it climbs to ∼1012 10^12. Appendix G Additional Verified Results Lipschitz displacement bound. D is K-Lipschitz with D(z)=z⟹dist(D(x),x)≤(K+1)dist(x,z)D(z)=z (D(x),x)≤(K+1)dist(x,z). Tool calls amplify failure. Each non-contractive tool call multiplicatively increases the pipeline’s effective Lipschitz constant: Kn<Kn+1K^n<K^n+1 for K≥2K≥ 2. Attacker monotone improvement. Best observed alignment deviation is non-decreasing across turns. Attacker steering. If directional slope varies continuously with attacker parameter α and crosses ℓ(K+1) (K+1), transversality is reachable by IVT. Stochastic regularity. g(x)=[f(D(x))]g(x)=E[f(D(x))] satisfies g−f=0g-f=0 on Sτ¯ S_τ. Discrete defense dilemma. An injective, utility-preserving defense is incomplete (every unsafe input stays unsafe). A complete, utility-preserving defense is non-injective (distinct inputs collapse to the same output). The three properties—completeness, utility preservation, injectivity—form a trilemma. Defense position invariance. Lipschitz constant of defense-before-tools equals defense-after-tools: KD⋅KTnK_D· K_T^n. Appendix H Lean Artifact The complete theory is verified in Lean 4.28.0 with Mathlib v4.28.0, available at https://github.com/mbhatt1/stuff/tree/main/ManifoldProofs. The artifact comprises 46 files: • 10 core theory files (MoF_01–MoF_10) • 10 cost theory files (MoF_Cost_01–MoF_Cost_10) • 10 advanced theory files (MoF_Adv_01–MoF_Adv_10) • 1 continuous relaxation (MoF_ContinuousRelaxation) • 1 ε -robust constraint + persistent unsafe region with global Lipschitz constant (MoF_11_EpsilonRobust) • 1 discrete impossibility (MoF_12_Discrete) • 1 multi-turn + stochastic extensions (MoF_13_MultiTurn) • 1 representation-independent meta-theorem (MoF_14_MetaTheorem) • 1 nonlinear agent pipelines (MoF_15_NonlinearAgents) • 1 relaxed utility preservation (MoF_16_RelaxedUtility) • 1 quantitative ε -band volume bound (MoF_17_CoareaBound) • 1 cone measure bound for persistent unsafe region (MoF_18_ConeBound) • 1 optimal defense characterization (MoF_19_OptimalDefense) • 1 refined persistence with defense-path Lipschitz constant ℓ (MoF_20_RefinedPersistence); this file contains the primary formalization of Theorems˜6.3, 6.1 and 6.2 • 1 gradient chain: ‖∇f(z)‖>ℓ(K+1)\|∇ f(z)\|> (K+1) implies persistent unsafe region via operator-norm direction extraction and derivative-based local growth (MoF_21_GradientChain) • 3 capstone files (MasterTheorem, Euclidean instantiation, verification) • 1 root import file (ManifoldProofs.lean)