Context Window Flooding: How Attackers Weaponize the Lost-in-the-Middle Attention Gap

Attackers can manipulate large language models by overwhelming their context window, causing the system prompt to be pushed into a "dead zone" where it has minimal influence. This vulnerability stems from the non-uniform attention patterns of transformers, where models attend least at the position where security instructions are typically located. Research from 2023 to 2026 reveals that larger context windows expand the attack surface for context flooding attacks.

Three main types of context flooding attacks exist: padding, relevance flooding, and tool result flooding. Padding involves inserting benign text blocks between the system prompt and the target instruction, causing the original prompt to lose effective attention weight. Relevance flooding employs legitimate on-task content to strategically position the attack instruction at the end of context, benefiting from the recency effect.

Tool result flooding utilizes verbose outputs from legitimate tools in multi-turn agents, gradually shifting the system prompt into the dead zone without any adversarial instruction.

Agentic pipelines with persistence, long-term memory, and multi-agent orchestration further amplify the attack surface in three distinct ways. Single-turn applications are not vulnerable to these specific attack vectors. ToolFlood manipulates tool descriptions to replace legitimate tools with attacker-controlled ones, causing the retrieval system to prioritize the attacker's tools.

MINJA injects malicious content through memory retrieval queries, exploiting the model's inability to distinguish between origins of similar memories. LogInject injects PowerShell log entries into production systems, causing them to misinterpret the injected content as legitimate.

No universally safe token threshold exists for mitigating context flooding attacks, as the layer where attention encoding emerges varies across models. Measured degradation across 18 models showed 100% susceptibility to inter-agent trust exploitation attacks, highlighting the critical role of the inter-agent trust layer in security controls. To combat these vulnerabilities, architects must design systems that inherently prevent unbounded external content processing without relying on token count-based security measures.