Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks

arXiv:2604.16424v1 Announce Type: cross Abstract: State-Space Models (SSMs) -- structured SSMs (S4, S4D, DSS, S5), selective SSMs (Mamba, Mamba-2), and hybrid architectures (Jamba) -- are deployed in safety-critical long-context applications: genomic analysis, clinical time-series forecasting, and cybersecurity log processing. Their linear-time scaling is compelling, yet the security properties of their compressed-state recurrent architectures remain unstudied. We present the first systematic treatment of SSM safety, security, and cognitive risks. Seven contributions: (1) Formal threat framework -- SSM Attack Surface (five layers), State Integrity Violation (StIV), Cross-Context Amplification Ratio X_S, and a Spectral Sensitivity Proposition grounded in the H_infty norm. (2) Three novel attack classes: spectral adversarial attacks (transfer-function gain exploitation), delayed-trigger stateful backdoors (activate thousands of steps after injection), and state capacity saturation (entropy flooding forces silent forgetting). (3) 14 MITRE ATLAS technique extensions across the full tactic chain. (4) Six-profile attacker taxonomy with kill chains for genomics, clinical, and cybersecurity domains. (5) Four cognitive risk hypotheses grounded in state-compression mechanics. (6) Governance-aligned mitigations mapped to CREST, NIST AI 600-1, and EU AI Act. (7) Empirical evaluation: targeted genomic injection achieves StIV=0.519 vs. 0.086 random (6.0imes, p<0.001); PGD state injection achieves 156imes output perturbation over random; SSD-structured extraction confirmed at O(N^2) vs. O(N^3) query complexity (Nimes speedup). Validation on pretrained checkpoints is detailed in the Appendix.

Related

• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors
• Activation-Guided Local Editing for Jailbreaking Attacks
• Reverse Constitutional AI: A Framework for Controllable Toxic Data Generation via Probability-Clamped RLAIF
• Guardian-as-an-Advisor: Advancing Next-Generation Guardian Models for Trustworthy LLMs
• When Choices Become Risks: Safety Failures of Large Language Models under Multiple-Choice Constraints
• Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring

Source: arXiv cs.CL | 2026-04-21