Context Stuffing Attacks

Why it matters

Context stuffing bypasses system prompt. Understanding shapes long-context defenses.

The architecture

Very long user input.

System prompt pushed to end.

Attention drops earlier tokens.

How it works end to end

Attention decay by position.

Long-context models better but not immune.

Defenses: repeat instructions, position-invariant checks.