SpectralGuard: Detecting Memory Collapse Attacks in State Space Models

Davi Bonetto

cs.LGMar 12, 2026

SpectralGuard: Detecting Memory Collapse Attacks in State Space Models

Authors: Davi Bonetto

Organizations: Independent Researcher

Abstract

State Space Models (SSMs) such as Mamba achieve linear-time sequence processing through input-dependent recurrence, but this mechanism introduces a critical safety vulnerability. We show that the spectral radius rho(A-bar) of the discretized transition operator governs effective memory horizon: when an adversary drives rho toward zero through gradient-based Hidden State Poisoning, memory collapses from millions of tokens to mere dozens, silently destroying reasoning capacity without triggering output-level alarms. We prove an Evasion Existence Theorem showing that for any output-only defense, adversarial inputs exist that simultaneously induce spectral collapse and evade detection, then introduce SpectralGuard, a real-time monitor that tracks spectral stability across all model layers. SpectralGuard achieves F1=0.961 against non-adaptive attackers and retains F1=0.842 under the strongest adaptive setting, with sub-15ms per-token latency. Causal interventions and cross-architecture transfer to hybrid SSM-Attention systems confirm that spectral monitoring provides a principled, deployable safety layer for recurrent foundation models.

Figures & tables

Symbol	Definition
$A\in\mathbb{R}^{d\times d}$	Continuous state transition matrix
$\bar{A}_{t}=\exp(\Delta_{t}A)$	Discretized transition at token $t$
$\rho(\bar{A}_{t})$	Spectral radius (max eigenvalue magnitude)
$\lambda_{i}$	$i$ -th eigenvalue of $\bar{A}_{t}$
$h_{t}\in\mathbb{R}^{d}$	Hidden state at token $t$
$\Delta_{t}\in\mathbb{R}^{+}$	Input-dependent discretization step

Table 1: Mathematical Notation

Panel of Figure 1 — Figure 1: System architecture: attack surface and multi-layer defense. Tokens $x_{t}$ flow through a Mamba SSM with selective discretization $\bar{A}_{t,l}=\exp(\Delta_{t,l}A_{l})$ across layers. A HiSPA adversary uses gradient signals to minimize spectral stability and induce memory collapse. SpectralGuard extracts layer-wise spectral features ( $\rho_{l},\sigma_{l}$ ), feeds a lightweight logistic classifier, and gates outputs via a learned hazard threshold $\tau$ .

Regime	$\bar{\rho}_{\text{benign}}$	$\bar{\rho}_{\text{adv}}$
Exp 2 non-adaptive collapse	$\approx 0.98$	$\approx 0.32$
Exp 3 adaptive v1 (single-layer)	$0.894\pm 0.004$	$0.910\pm 0.007$
Exp 3 adaptive v2/v3 (multi-layer)	$0.894\pm 0.004$	near benign target

Table 2: Mean spectral radius by attack regime (narrative disambiguation).

Protocol	$\rho_{\text{target}}$	Accuracy	95% CI
All-layer clamp ( $N=100$ )	Baseline (no clamp)	1.00	[1.000, 1.000]
All-layer clamp ( $N=100$ )	0.99	0.00	[0.000, 0.037]
All-layer clamp ( $N=100$ )	0.95	0.00	[0.000, 0.037]
All-layer clamp ( $N=100$ )	0.90	0.00	[0.000, 0.037]
All-layer clamp ( $N=100$ )	0.70	0.00	[0.000, 0.037]
All-layer clamp ( $N=100$ )	0.50	0.00	[0.000, 0.037]

Table 3: Causal intervention summary across clamp thresholds.

Component	Value
Architecture	Mamba (Selective SSM)
$d_{\text{model}}$	768
Layers	24
$d_{\text{state}}$	16
Vocabulary size	50,257
Total parameters	130M

Table 4: Model Configuration (Mamba-130M)

Metric	Benign	Adversarial
Mean accuracy	72.3%	19.8%
$\Delta$ accuracy	-52.5 points
Spectral radius $\rho$	0.98	0.32
$H_{\text{eff}}$ (tokens)	$1.17\times 10^{6}$	45
t-test	$t=18.4$ , $p<10^{-30}$
Effect size	Cohen’s $d=3.2$

Table 5: Attack Impact Summary

Model	Params	F1	FPR	$\bar{\rho}_{\text{benign}}$	$\bar{\rho}_{\text{adv}}$	$\Delta\rho$
Mamba-130M	130M	0.619	0.672	0.9086	0.9090	$+0.0004$
Mamba-1.4B	1,475M	0.591	0.672	0.9205	0.9211	$+0.0006$
Mamba-2.8B	2,897M	0.650	0.724	0.8787	0.8778	$-0.0009$

Table 6: SpectralGuard: Detection Across Model Scales (Experiment 5A)

Seed	F1	FPR	Precision
42	0.619	0.672	0.549
123	0.584	0.557	0.562
456	0.579	0.648	0.509
Mean $\pm$ Std	$\mathbf{0.594\pm 0.018}$	$0.626\pm 0.050$	$0.540\pm 0.022$

Table 7: Multi-Seed Robustness on Mamba-130M.

Method	MAE vs. Eigen	Pearson $r$
SVD	$1.15\times 10^{-6}$	$1.000000$
Power ( $k{=}3$ )	$1.46\times 10^{-6}$	$1.000000$

Table 8: Power Method vs. Full Eigendecomposition.

Task	Benign	Adv.	$\Delta$
Assoc. Recall	$72.3\pm 2.1$ %	$19.8\pm 1.8$ %	$-52.5^{***}$
LongBench QA	$68.4\pm 3.2$ %	$23.1\pm 2.9$ %	$-45.3^{***}$
GSM8K Math	$61.3\pm 3.9$ %	$18.7\pm 3.2$ %	$-42.6^{***}$
HumanEval Code	$48.0\pm 5.0$ %	$12.0\pm 3.2$ %	$-36.0^{***}$
Average	62.5%	18.4%	$\mathbf{-44.1}$

Table 9: Multi-Task Impact of Spectral Collapse

Setting	Defense Variant	Attacker	Prec.	Rec.	F1	AUC	FPR	Latency	N	Model
Output-Only Baselines (Non-adaptive)
Non-adaptive	Perplexity Filter	Non-adaptive	0.42	0.31	0.36	—	0.02	$<1$ ms	500	Mamba-130M
Non-adaptive	Toxicity Classifier	Non-adaptive	0.08	0.05	0.06	—	0.01	$<1$ ms	500	Mamba-130M
Non-adaptive	Pattern Matcher	Non-adaptive	0.15	0.12	0.13	—	—	$<1$ ms	500	Mamba-130M
Non-adaptive	Internal L2-Norm Monitor	Non-adaptive	0.62	0.51	0.56	—	0.05	$<5$ ms	500	Mamba-130M
SpectralGuard Variants

Table 10: Consolidated defense results across non-adaptive, adaptive, and cross-architecture settings.

Threshold ( $\rho_{\min}$ )	Precision	Recall (TPR)	F1-Score	FPR
$\rho_{\min}=0.800$	$0.994$	$0.632$	$0.773$	$0.004$
$\rho_{\min}=0.850$	$0.937$	$0.956$	$\mathbf{0.947}$	$0.064$
$\rho_{\min}=0.887$ (calibrated)	$0.753$	$1.000$	$0.859$	$0.328$
$\rho_{\min}=0.900$	$0.638$	$1.000$	$0.779$	$0.568$
$\rho_{\min}=0.920$	$0.500$	$1.000$	$0.667$	$1.000$

Table 11: Empirical Threshold Ablation (Mamba-130M, controlled subset). Performance metrics for varying detection thresholds

\rho_{\min}

on a calibration protocol. These values are for sensitivity analysis and are not the headline non-adaptive benchmark.

Threshold $\rho_{\min}$
Configuration	F1	FPR	Latency (ms)	Rec.
$\rho_{\min}=0.20$	0.98	0.03	4.15
$\rho_{\min}=0.25$	1.00	0.00	4.15
$\rho_{\min}=0.30$ (default)	1.00	0.00	4.15	✓
$\rho_{\min}=0.35$	0.95	0.00	4.15
$\rho_{\min}=0.40$	0.89	0.00	4.15

Table 12: Ablation: SpectralGuard Hyperparameters. The “Rec.” column marks the recommended default setting for each hyperparameter.

Panel of Figure 9 — Figure 9: Pareto Frontier of Lexical Evasion ( $\text{AUC}_{\text{lex}}$ ) vs. Spectral Damage ( $\Delta\rho_{\text{mean}}$ ). No attack family achieves simultaneous high stealth and significant state disruption. Near-perfect stealth ( $\text{AUC}_{\text{lex}}\leq 0.60$ ) caps damage below $\Delta\rho=0.02$ .

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Experiment	Primary Hardware	Notes
Exp 1 (Horizon)	NVIDIA T4 (16GB)	Cloud GPU, $N{=}500$
Exp 2 (HiSPA collapse)	NVIDIA T4 (16GB)	Gradient-based prompt optimization
Exp 3 (Defense eval)	NVIDIA T4 (16GB)	24-layer feature extraction
Exp 3B (Causal clamp)	CPU-only / T4	Intervention hooks on Mamba-130M
Exp 4 (Scaling/robustness)	NVIDIA T4 (16GB)	Mamba-130M/1.4B/2.8B protocol
Exp 5 (Zamba2)	NVIDIA A100 (40GB)	Hybrid 2.7B evaluation

Appendix

Table 14: Appendix A.4: experiment-to-hardware mapping.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks
Apr 4, 2026Manoj ParmarState Space Models Adversarial Attacks
SovereignAI Security Labs, Bengaluru, India
Hidden State Poisoning Attacks against Mamba-based Language Models
Jan 5, 2026Alexandre Le Mercier, Chris Develder, Thomas DemeesterState Space Language Models Adversarial Attacks on LLMs
IDLab–T2K, Ghent University–imec
CLASP: Defending Hybrid Large Language Models Against Hidden State Poisoning Attacks
Mar 12, 2026Alexandre Le Mercier, Thomas Demeester, Chris DevelderLLM Security Language Model Robustness
IDLab–T2K, Ghent University–imec

Apr 4, 2026J/K move · Enter open · S save

Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks

Manoj Parmar

SovereignAI Security Labs, Bengaluru, India

State Space Models Adversarial Attacks Backdoor Attacks Model Extraction Attacks

Open paper AskPDF arXiv

State-Space Models (SSMs) -- structured SSMs (S4, S4D, DSS, S5), selective SSMs (Mamba, Mamba-2), and hybrid architectures (Jamba) -- are deployed in safety-critical long-context applications: genomic analysis, clinical time-series forecasting, and cybersecurity log processing. Their linear-time scaling is compelling, yet the security properties of their compressed-state recurrent architectures remain unstudied. We present the first systematic treatment of SSM safety, security, and cognitive risks. Seven contributions: (1) Formal threat framework -- SSM Attack Surface (five layers), State Integrity Violation (StIV), Cross-Context Amplification Ratio

\mathcal{X}_\mathcal{S}

, and a Spectral Sensitivity Proposition grounded in the

H_\infty

norm. (2) Three novel attack classes: spectral adversarial attacks (transfer-function gain exploitation), delayed-trigger stateful backdoors (activate thousands of steps after injection), and state capacity saturation (entropy flooding forces silent forgetting). (3) 14 MITRE ATLAS technique extensions across the full tactic chain. (4) Six-profile attacker taxonomy with kill chains for genomics, clinical, and cybersecurity domains. (5) Four cognitive risk hypotheses grounded in state-compression mechanics. (6) Governance-aligned mitigations mapped to CREST, NIST AI 600-1, and EU AI Act. (7) Empirical evaluation: targeted genomic injection achieves

\mathrm{StIV}=0.519

vs.

0.086

random (

6.0\times

p<0.001

); PGD state injection achieves

156\times

output perturbation over random; SSD-structured extraction confirmed at

O(N^2)

vs.

O(N^3)

query complexity (

N\times

speedup). Validation on pretrained checkpoints is detailed in the Appendix.

Abstract

LLM Security

Explore similar work

Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks

Hidden State Poisoning Attacks against Mamba-based Language Models

CLASP: Defending Hybrid Large Language Models Against Hidden State Poisoning Attacks