🤖 AI

Instruction Bleed: Cross-Module Interference in Prompt-Composed Agentic Systems

This paper identifies and formalizes "compositional behavioral leakage" (CBL), a subtle failure mode in prompt-composed agentic systems where editing one prompt module silently alters the behavior of others due to architectural non-isolation in transformer self-attention, demonstrating through empirical trials that such interference, while often sub-threshold for individual decisions, poses a significant compounding risk in large-scale deployments.

Original authors: Ching-Yu Lin, Yifan Liu

Published 2026-06-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ching-Yu Lin, Yifan Liu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are building a robot assistant by pasting together different instruction manuals. You have one page for "How to be polite," another for "How to hire employees," and a third for "How to write code." You glue them all together into one giant document and hand it to the robot (an AI) to read.

The big assumption everyone makes is: "If I change the 'How to be polite' page, it won't accidentally change how the robot does the 'Hiring' task."

This paper says: That assumption is wrong.

Here is the breakdown of what the researchers found, using simple analogies:

1. The Problem: "Instruction Bleed"

The researchers call this phenomenon "Instruction Bleed" (or Compositional Behavioral Leakage).

Think of the AI's brain like a giant, open room where all the instruction pages are laid out on the floor. In a normal computer program, if you change a rule in the "Kitchen" section, the "Garage" section stays exactly the same because they are in separate rooms.

But with AI, the "room" is one big open space. The AI reads everything at once, connecting every word to every other word. The researchers found that if you quietly edit a page that shouldn't matter (like adding a random recipe to the "Hiring" manual), it can silently shift how the AI scores job candidates.

The Analogy: Imagine you are writing a story. If you suddenly add a paragraph about "spicy peppers" in the middle of a chapter about "car repairs," the AI might subconsciously start thinking the car repair needs to be "spicy" or "hot," even though you didn't tell it to. The meaning "bleeds" from one section into another.

2. The Experiment: The Job Interview Bot

To prove this, the researchers built a specific test using a real-world AI agent designed to evaluate job applications.

The Setup: They had a "focal" module (the part that scores how well a resume matches a job).
The Trick: They took a completely unrelated module (a set of rules for evaluating recipes) and made three types of changes to it:
1. Volume: Just making the recipe section longer.
2. Content: Adding a weird, irrelevant character description to the recipe rules.
3. Form: Changing the font, emojis, or headings in the recipe section without changing the words.

The Result:

Changing the length or the format (emojis/headings) didn't really change the hiring scores.
BUT, changing the content (adding that weird character description) caused the AI to systematically change how it scored the job candidates.
The scores shifted slightly, but consistently. The AI didn't start rejecting everyone or hiring everyone; it just gave slightly different scores.

3. Why This Matters: The "Silent Drift"

The most scary part of this discovery is that no one noticed it happening.

The "Sub-Threshold" Effect: The AI didn't make a huge, obvious mistake (like hiring a clown for a surgeon job). Instead, it just shifted the scores by a tiny amount.
The Metaphor: Imagine a scale that is supposed to weigh apples. If you put a heavy book on the other side of the room (the unrelated instruction), the scale doesn't break, but it starts weighing every apple as 0.5 pounds heavier. You wouldn't see a single apple "explode" or disappear, but if you weigh 1,000 apples, your total inventory count will be wrong.
The Risk: In real life, if an AI is used to rank thousands of job applicants, these tiny, silent shifts could change who gets an interview and who gets rejected, even though the AI looks like it's working perfectly.

4. Why Does This Happen?

The paper explains that the AI's architecture (called a "Transformer") is designed to look at the entire document at once. It doesn't have "walls" between the different instruction modules.

The "No Walls" Reality: Just because you put a line of stars (***) or a heading like ### Hiring Rules in the text, the AI doesn't treat that as a hard boundary. To the AI, it's all just one big stream of words.
The "Memory" Issue: The AI has a limited "working memory." When you add more text (even unrelated text), it crowds out the space needed to focus perfectly on the original task.

5. What the Researchers Propose

The paper doesn't just point out the problem; it offers a new way to test for it.

The New Test: Before you launch an AI system, you shouldn't just check if it works. You need to check if changing one part of the instructions breaks another part.
The "Regression" Test: They suggest that every time a developer adds a new instruction module, they must re-test the old modules to make sure the new addition didn't cause "bleed."

Summary

This paper reveals that when we build AI agents by pasting together different text instructions, we are building on shaky ground. Changing one part of the instructions can silently and subtly change how the AI behaves in other parts, even if the changes seem unrelated. It's a "silent drift" that current testing methods miss, but it could have real-world consequences for decisions like hiring or lending. The authors provide a new checklist to catch these invisible leaks before they cause trouble.

Technical Summary: Instruction Bleed in Prompt-Composed Agentic Systems

Problem Definition
The paper addresses a recurring failure mode in prompt-composed agentic systems, where an agent's behavior is assembled at runtime from natural language modules (e.g., personas, skills, orchestration rules) rather than executable code. Practitioners observe that editing one prompt module can silently shift the behavior of unrelated modules, despite the absence of shared variables or executable dependencies. The authors formalize this phenomenon as Compositional Behavioral Leakage (CBL).

CBL is distinct from known failure modes such as adversarial prompt injection, cognitive degradation over time, multi-agent fault propagation, or compositional privacy leakage. The root cause is identified as architectural non-isolation: Transformer self-attention mechanisms compute global pairwise interactions across the entire input context without formal boundaries between concatenated modules. Consequently, standard delimiters (e.g., ### Persona) act as statistical hints rather than namespace boundaries, allowing interference between co-resident modules.

Methodology
To investigate CBL, the authors developed a reusable three-channel protocol to perturb non-focal modules while measuring the impact on a focal module's behavior. The study was conducted on a deployed job-evaluation agent (career-ops) using the Claude Sonnet 4.6 model across 144 trials (12 job descriptions $\times$ 3 runs).

The protocol defined three experimental conditions against a baseline (C0):

C1 (Volume): Adding an unrelated 200-line recipe-evaluation module to test if mere context volume causes degradation.
C2 (Content): Appending a semantically irrelevant archetype to the shared rules file to test for semantic interference.
C3 (Form): Introducing meaning-preserving structural changes (heading levels, emoji markers, section reordering) to test format sensitivity.

The primary outcome metric was the cv_match score (1–5 rubric), representing the alignment between a candidate's background and job requirements. The analysis utilized paired effect sizes (Cohen's d) with bootstrap 95% confidence intervals (10,000 resamples) to detect shifts, alongside Wilcoxon signed-rank tests.

Key Results
The study provides an existence proof of cross-module interference:

Semantic Interference (C2): This condition produced a statistically detectable shift. Adding a single irrelevant archetype to the rules file resulted in a Cohen's d of 0.63 ( $\Delta = +0.17$ ) on the cv_match score, with a 95% bootstrap CI of [+0.03, +0.31], excluding zero. Eight of the 12 job descriptions showed an upward shift.
Control Conditions (C1 & C3): Neither the volume addition (C1, d = -0.11) nor the format perturbation (C3, d = -0.29) produced a detectable effect (CIs included zero). This isolates the interference mechanism to semantic content rather than generic context load or formatting syntax.
Sub-threshold Regime: No recommendation flips occurred under any condition. The paper notes that CBL operates in a "sub-threshold regime" where score distributions drift without crossing decision boundaries, making it invisible to standard Quality Assurance (QA) that checks only final decisions.

Contributions
The paper makes four specific contributions:

Operational Definition: A formal definition of CBL as behavioral interference between co-resident prompt modules in a shared attention context, distinguished from privacy leakage and cognitive degradation.
Reusable Protocol: A three-channel testing framework (Volume, Content, Form) instantiated on a deployed system, providing a method to detect CBL using artifacts already produced by current deployments.
Falsifiable Prediction Set: A framework for multi-system replication predicting:
- Significant variation in interference magnitude across model families.
- A semantic-distance gradient where shifts are larger on rubric dimensions proximate to the modified module.
- Scaling of recommendation-flip rates with intervention magnitude and semantic overlap.
System-Class Characterization: A classification of prompt-composed agentic systems across a spectrum of composition mechanisms (Markdown conventions, Jinja2 templates, Python inheritance), identifying them as a distinct system class where behavioral logic resides in text interpreted via attention.

Significance and Claims
The authors position CBL as a first-order safety and reliability concern for deployed agents. The significance lies in the "quiet unreliability" of these systems: because the interference is sub-threshold, it evades standard testing but compounds across thousands of decisions, potentially affecting downstream ranking, prioritization, and aggregation systems.

The paper argues that the assumption that composing prompt modules yields the composition of their individual behaviors is not warranted by transformer architecture. Consequently, the authors assert that cross-module interference measurement must become a requirement for prompt-composed agent evaluation. They propose a regression testing framework covering compositional consistency, module-interaction regression, format-perturbation robustness, and model-migration testing to address the "prompt sprawl" observed in large-scale systems like OpenClaw.

The work is presented as diagnostic, aiming to formalize and measure an existing phenomenon to enable mitigation, rather than introducing new capabilities. The findings suggest that without explicit isolation mechanisms (which current architectures lack), text-level composition remains fragile, and novel module combinations should be treated as behaviorally unpredictable until isolation is validated.