Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks

Manoj Parmar

cs.CRApr 4, 2026

Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks

Authors: Manoj Parmar

Organizations: SovereignAI Security Labs, Bengaluru, India

Abstract

State-Space Models (SSMs) -- structured SSMs (S4, S4D, DSS, S5), selective SSMs (Mamba, Mamba-2), and hybrid architectures (Jamba) -- are deployed in safety-critical long-context applications: genomic analysis, clinical time-series forecasting, and cybersecurity log processing. Their linear-time scaling is compelling, yet the security properties of their compressed-state recurrent architectures remain unstudied. We present the first systematic treatment of SSM safety, security, and cognitive risks. Seven contributions: (1) Formal threat framework -- SSM Attack Surface (five layers), State Integrity Violation (StIV), Cross-Context Amplification Ratio $\mathcal{X}_\mathcal{S}$ , and a Spectral Sensitivity Proposition grounded in the $H_\infty$ norm. (2) Three novel attack classes: spectral adversarial attacks (transfer-function gain exploitation), delayed-trigger stateful backdoors (activate thousands of steps after injection), and state capacity saturation (entropy flooding forces silent forgetting). (3) 14 MITRE ATLAS technique extensions across the full tactic chain. (4) Six-profile attacker taxonomy with kill chains for genomics, clinical, and cybersecurity domains. (5) Four cognitive risk hypotheses grounded in state-compression mechanics. (6) Governance-aligned mitigations mapped to CREST, NIST AI 600-1, and EU AI Act. (7) Empirical evaluation: targeted genomic injection achieves $\mathrm{StIV}=0.519$ vs. $0.086$ random ( $6.0\times$ , $p<0.001$ ); PGD state injection achieves $156\times$ output perturbation over random; SSD-structured extraction confirmed at $O(N^2)$ vs. $O(N^3)$ query complexity ( $N\times$ speedup). Validation on pretrained checkpoints is detailed in the Appendix.

Figures & tables

Architecture	Distinctive Safety / Reliability Risk	Distinctive Security Risk
LTI (classical)	Discretisation error; model mismatch under nonstationarity	Input perturbation via filter gain; frequency-domain attacks
HiPPO / LMU	Singular ODE; implementation-dependent stability	Basis coefficient extraction; interpretability aids auditing
S4 (DPLR)	Numerical conditioning of non-normal $\mathbf{A}$ ; Cauchy kernel instability	Spectral attacks at high-gain modes; delayed state corruption
S4D / DSS / S5 (diagonal)	Weaker convergence to HiPPO transfer function; init sensitivity	Diagonal structure simplifies gradient-based attacks; Fourier-mode targeting
PTD-robustified	Reduced Fourier-mode brittleness; new hyperparameters	Improved robustness in evaluated modes; other modes may remain vulnerable
Mamba (selective)	Long-context forgetting; state capacity bottleneck	Delayed-trigger backdoors; selection subversion; state capacity saturation

Table 1: Security and reliability profile per SSM architecture family.

SSM Layer	ATLAS Tactic	Relevant Technique / Extension
$\mathcal{L}_{\mathrm{input}}$	Reconnaissance, Initial Access	T-SSM-01 Spectral Probe; T-SSM-02 Domain-Specific Encoding
$\mathcal{L}_{\mathrm{state}}$	Execution, Persistence	T-SSM-03 Recurrent State Injection; T-SSM-04 Delayed Trigger Implant; T-SSM-05 State Matrix Poisoning
$\mathcal{L}_{\mathrm{select}}$	Execution, Evasion	T-SSM-06 Selection Subversion; T-SSM-07 Gating Evasion; T-SSM-08 Discretisation Timing Attack
$\mathcal{L}_{\mathrm{output}}$	Impact, Discovery	T-SSM-09 Output Projection Poisoning; T-SSM-10 SSD-Based Model Extraction
$\mathcal{L}_{\mathrm{buffer}}$	Persistence, Privilege Escalation	T-SSM-11 State Capacity Saturation; T-SSM-12 Context Buffer Overflow; T-SSM-13 Cross-Session State Contamination
Supply Chain	Resource Development	T-SSM-14 HiPPO Initialisation Compromise

Table 2: Mapping of SSM attack surface layers to MITRE ATLAS tactics and SSM-specific technique extensions.

ID	Short Name	Description
T-SSM-01	Spectral Probe	Query the model with sinusoidal sweeps to estimate transfer-function magnitude $\|\hat{K}(\omega)\|$ , identifying high-gain frequency bands for subsequent spectral attacks.
T-SSM-02	Domain-Specific Encoding	Craft adversarial inputs indistinguishable from legitimate domain data (synthetic SNPs, perturbed vital signs, slow-drift log events) that exploit encoder-layer vulnerabilities.
T-SSM-03	Recurrent State Injection	Inject adversarial perturbations into $\mathbf{h}_{t}$ via PGD or zeroth-order methods, maximising StIV over subsequent recurrent steps.
T-SSM-04	Delayed Trigger Implant	Training-time backdoor embedding a trigger that injects a latent payload into $\mathbf{h}_{t}$ , activating adversarial output only after $k\geq 1{,}000$ recurrent steps—evading activation-clustering defences.
T-SSM-05	State Matrix Poisoning	Supply-chain or insider attack modifying $\overline{\mathbf{A}},\overline{\mathbf{B}}$ to embed a hidden subspace that preserves adversarial state encodings indefinitely under recurrence.
T-SSM-06	Selection Subversion	Craft inputs to force $\Delta_{t}\to 0$ (state freeze) or $\Delta_{t}\to\infty$ (state erase) via manipulation of Mamba’s selective gating mechanism.

Table 3: 14 SSM-specific MITRE ATLAS technique extensions. Each extension targets one or more of the five attack-surface layers (

\mathcal{L}_{\mathrm{input}}

through

\mathcal{L}_{\mathrm{buffer}}

) defined in Section 3 .

Profile	Access & Capability	Representative Techniques	Feasibility	Impact
Opportunistic	Public checkpoints; black-box API; no privileged access	T-SSM-01, T-SSM-11	High	Low–Medium (PoC, reputation)
Targeted	Domain expertise (genomics, clinical) + black-box API; gradient estimation via surrogates	T-SSM-02, T-SSM-03	Medium	Medium–High (targeted misdiagnosis, false-negative IDS)
Insider	Direct weight and infrastructure access	T-SSM-05, T-SSM-09, T-SSM-14	Very High	Critical
Nation-State	Unlimited compute; training-data poisoning at scale; supply-chain compromise	T-SSM-04, T-SSM-05, T-SSM-14	High	Critical (infrastructure, public health)
Supply-Chain	Compromises upstream artefacts: HuggingFace checkpoints, genome databases, SSM libraries	T-SSM-14, T-SSM-04	Medium–High	Critical (all downstream fine-tunes)
Stateful Adversary	API access to stateful deployment; no weight access; SSM-specific (no Transformer analogue)	T-SSM-12, T-SSM-13	Medium	High (cross-user contamination, audit evasion)

Table 4: Six-profile attacker taxonomy for SSM threat modelling. Feasibility and impact are assessed relative to a production deployment in a high-risk domain (healthcare, genomics, critical infrastructure).

Domain	Genomic variant calling and disease phenotype prediction
Techniques	T-SSM-01 (Spectral Probe), T-SSM-02 (Domain-Specific Encoding)
Attacker Profile	Targeted (domain genomics knowledge + API access)
Feasibility	Medium-High — E1-Pilot confirms $6\times$ StIV advantage of targeted over random injection
Impact	High — misdiagnosis, inappropriate treatment, liability

Table 5: Scenario 1 summary: Spectral Adversarial Genomic Attack.

Domain	Clinical time-series forecasting (ICU deterioration prediction)
Technique	T-SSM-04 (Delayed Trigger Implant)
Attacker Profile	Insider or Supply-Chain
Feasibility	High — architectural analysis predicts $>$ 60% activation at 50K steps (see Appendix A )
Impact	Critical — patient death, institutional liability, regulatory action

Table 6: Scenario 2 summary: Delayed-Trigger Backdoor in Clinical Decision Support.

Domain	AI-assisted legal document review (contract analysis, due diligence)
Technique	T-SSM-11 (State Capacity Saturation)
Attacker Profile	Targeted (requires understanding of SSM state capacity dynamics)
Feasibility	High — predicted $>$ 80% needle-forgetting at $T=32K$ (see Appendix A )
Impact	High — missed liability, financial damage, legal malpractice

Table 7: Scenario 3 summary: State Capacity Saturation in Long-Document Legal Analysis.

Domain	Proprietary financial time-series SSM (market forecasting, fraud detection)
Technique	T-SSM-10 (SSD-Based Model Extraction)
Attacker Profile	Targeted (SSD theory knowledge + black-box API access)
Feasibility	Medium — algebraically confirmed $O(N^{2})$ vs. $O(N^{3})$ query complexity (E5)
Impact	High — IP theft, competitive advantage loss, regulatory violation

Table 8: Scenario 4 summary: SSD-Based Model Extraction.

Domain	Cybersecurity SOC with streaming SSM log analysis
Technique	T-SSM-13 (Cross-Session State Contamination)
Attacker Profile	Stateful Adversary (insider with API access to shared deployment)
Feasibility	High — requires only API access; no model weight access needed
Impact	Critical — undetected breach, chain-of-custody violation

Table 9: Scenario 5 summary: Cross-Session Contamination in Streaming SOC.

Budget $B$	Targeted StIV	Stealth StIV	Random StIV	T/R Ratio
3	0.056 $[0.033,0.081]$	0.039 $[0.019,0.058]$	0.028 $[0.011,0.047]$	2.0 $\times$
10	0.136 $[0.103,0.172]$	—	0.042 $[0.022,0.064]$	3.3 $\times$
20	0.242 $[0.200,0.286]$	—	0.050 $[0.028,0.075]$	4.8 $\times$
30	0.392 $[0.342,0.439]$	—	0.064 $[0.039,0.092]$	6.1 $\times$
50	0.519 $[0.472,0.567]$	0.483 $[0.436,0.533]$	0.086 $[0.058,0.117]$	6.0 $\times$

Table 10: E1-Pilot: State Integrity Violation (StIV) under genomic adversarial injection (

n=360

per condition; 95% bootstrap CIs; Holm-Bonferroni corrected). Targeted injection achieves

2.0\times

T/R ratio at

B=3

(

p<0.001

), scaling to

6.1\times

B=30

. Stealth strategy achieves 93% of targeted StIV at

B=50

under the edit-similarity constraint. Random baseline StIV remains below 0.09 at all budgets.

$\varepsilon$	Coupling	PGD $\\|\delta\mathbf{y}\\|_{2}$	$\rho$ (PGD/Rand)
0.005	Loose	measured	156 $\times$
0.01	Loose	measured	11.1 $\times$
0.02	Loose	measured	16.1 $\times$
0.05	Loose	measured	13.4 $\times$
0.005–0.05	Tight	0.0	1.0 $\times$ (suppressed)

Table 11: E2-Pilot: PGD-to-random output perturbation ratio (

n=200

per condition). Under loose coupling, PGD achieves up to

156\times

more output perturbation than random at

\varepsilon=0.005

, confirming that gradient-guided state injection structurally dominates untargeted perturbation. Tight coupling (state-decay regularisation

\lambda=0.5

) suppresses PGD output perturbation to zero across all budgets, validating M2 state regularisation as an effective first-line countermeasure.

Attack	$\varepsilon$	SFR (%)
Freeze ( $\delta^{*}_{\text{freeze}}$ )	0.01	1.76
Erase ( $\delta^{*}_{\text{erase}}$ )	0.01	1.76
Random (baseline)	0.01	1.76
Freeze ( $\delta^{*}_{\text{freeze}}$ )	0.02	1.76
Erase ( $\delta^{*}_{\text{erase}}$ )	0.02	1.76

Table 12: E4 Pilot: Selection Subversion on S4-lite 4L proxy. Result: inconclusive. All conditions return identical SFR = 1.76% with SER = 0.0% and accuracy drop = 0.0%—no differentiation between Freeze, Erase, and Random strategies. This null result is an artefact of the S4-lite proxy model: the proxy model lacks Mamba’s input-dependent

\Delta_{t}

gating, meaning there is no selective scan mechanism to subvert. The hypothesis (Freeze/Erase SFR

>50\%

; Random

<20\%

) requires real Mamba selective scan to test and is deferred to Phase 2 on mamba-130m (, est. 1 h).

State dim $N$	SSD queries	Generic queries	Speedup	$\hat{\alpha}_{\mathrm{SSD}}$	$\hat{\alpha}_{\mathrm{gen}}$
64	4,096	262,144	64 $\times$	2.0	3.0
128	16,384	2,097,152	128 $\times$	2.0	3.0
256	65,536	16,777,216	256 $\times$	2.0	3.0
512	262,144	134,217,728	512 $\times$	2.0	3.0
1024	1,048,576	1,073,741,824	1024 $\times$	2.0	3.0

Table 13: E5: SSD-structured vs. generic model extraction query complexity ( algebraically confirmed; no specialised hardware required ). Log-log OLS regression on empirical query counts yields

\hat{\alpha}_{\mathrm{SSD}}=2.0

and

\hat{\alpha}_{\mathrm{gen}}=3.0

across all state dimensions

N\in\{64,128,256,512,1024\}

. Speedup scales exactly as

N^{1}

—at

N=1024

, SSD-structured extraction requires

\sim 10^{6}

queries versus

\sim 10^{9}

for generic extraction, a

1024\times

reduction. This confirms the theoretical prediction from the 1-semiseparable matrix structure of Mamba-2’s SSD proof [ 9 ] : the adversary can exploit the

O(N)

free parameters in the 1-SS factorisation to reduce the Krylov-basis reconstruction to

O(N^{2})

queries. Results are algebraic (closed-form complexity derivation verified by simulation on synthetic matrices); specialised hardware access is not required and Phase 2 (real mamba2-130m checkpoint) serves as an ecological validity check.

Limitation	Discussion and Path Forward
Partial experimental validation	Of the five experiments, three produce confirmed results: E1-Pilot (genomic StIV with 95% bootstrap CIs), E2-Pilot (PGD output-perturbation ratio), and E5 (algebraic complexity). E2, E3, and E4 are reported with theoretical predictions only—the proxy model lacks Mamba’s selective-scan gating ( $\Delta_{t}$ ), returning inconclusive null results. Validation on pretrained Mamba and Jamba checkpoints is detailed in Appendix A .
Partial attack coverage	Of 14 SSM-specific threats, 5 have empirical evidence (E1, E2 pilot, E5). The remaining 9 are formalised but not yet instantiated empirically. Priority follow-up: T-SSM-13 (Cross-Session Contamination) and T-SSM-08 (Discretisation Timing Attack).
LTI approximation for spectral analysis	Proposition 3.1 is derived for LTI systems. Mamba’s selective dynamics are input-dependent and nonlinear; the spectral bound applies rigorously only at linearised operating points. Remark 3.2 provides a first-order extension; a full nonlinear spectral bound remains open.
White-box attack assumption	E1–E3 assume white-box model access. Black-box spectral attacks are feasible via spectral probing (T-SSM-01) but require more queries; the query-budget/success trade-off is not yet quantified.
Delayed-trigger transfer	Backdoor persistence (E2) is evaluated in a from-scratch training setting. Transfer learning (fine-tuning a backdoored pretrained model) may alter persistence; this is critical for supply-chain safety analysis.
Cognitive risk hypotheses	H1–H4 are supported by prior cognitive science literature and architectural analysis but are not empirically validated here. User studies in clinical and legal settings are required.

Table 14: Summary of limitations and paths forward.

Work	SSM-Specific	Spectral Attack	Delayed Trigger	Capacity Saturation	Governance
Madry et al. [ 26 ]	–	–	–	–	–
Wallace et al. [ 43 ]	–	–	–	–	–
Hubinger et al. [ 22 ]	–	–	$\checkmark$ (limited)	–	–
Karim et al. [ 24 ]	partial	–	–	–	–
Carlini et al. [ 5 ]	–	–	–	–	–
Yu et al. [ 48 ]	$\checkmark$	partial	–	–	–

Table 15: Comparison to related work. This paper is the first to combine SSM-specific threat modelling with spectral attacks, Mamba-persistent delayed triggers, state capacity saturation, and governance alignment.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Model	$\omega^{*}$ (mean $\pm$ IQR)	Spectral $\mathcal{X}_{\mathcal{S}}$	TD $\mathcal{X}_{\mathcal{S}}$	Ratio
Mamba-130M (S6)	pending	pending	pending	pending
Mamba-370M (S6)	pending	pending	pending	pending
Mamba-2-130M (SSD)	pending	pending	pending	pending
GPT-2-Small (MHA)	N/A	pending	pending	pending

Appendix

Table 16: E1-R: Spectral PGD on pretrained checkpoints (est. 4–6 h; seeds

\{42,123,456\}

\omega^{*}

IQR quantifies inter-layer spectral heterogeneity. Expected: Mamba variants show Ratio

>1.5

; SSD variant higher than S6 due to narrower semiseparable spectral peaks; GPT-2 near 1.0.

Model	Clean $\Delta$ (%)	BAR@100	BAR@1K	BAR@10K	BAR@50K
Mamba-130M	pending	pending	pending	pending	pending
GPT-2-Small	pending	pending	pending	pending	pending

Appendix

Table 17: E2-R: Backdoor Activation Rate on pretrained mamba-130m vs. GPT-2-Small (est. 14 h across all

k

). ACD AUC evaluated identically to Phase 1.

Model	Arch.	$T=4K$	$T=8K$	$T=16K$	$T=32K$
Mamba-130M	SSM	p	p	p	p
Mamba-370M	SSM	p	p	p	p
Mamba-2.8B	SSM	p	p	p	p
Mamba-2-130M	SSD	p	p	p	p
Jamba-v0.1	Hybrid	p	p	p	p
GPT-2-Small	MHA	p	p	p	p

Appendix

Table 18: E3-R: RULER NFR (%) under high-entropy saturation (

p

= pending; est. 6–8 h). H4 prediction: Jamba NFR scales with SSM/MHA layer ratio (8:24

\approx

0.33); Mamba-2.8B NFR exceeds Mamba-130M as larger state dims enable more targeted saturation. LongBench and

\infty

Bench sub-evaluations reported in Appendix.

Mitigation	Attack ( $\varepsilon=0.01$ )	$\mathcal{X}_{\mathcal{S}}$	ASR (%)	Clean $\Delta$ (%)
None (baseline)	Spectral PGD	8.43	79.3	0.0
M1 bandstop	Spectral PGD	pending	pending	pending
M1 bandstop	TD PGD	pending	pending	pending
M6 spectral training	Spectral PGD	pending	pending	pending

Appendix

Table 19: M1 validation. CREST criterion:

\mathcal{X}_{\mathcal{S}}\leq 3.0

post-filter, clean-accuracy drop

\leq 1.5\%

. Hypothesis: M1 reduces

\mathcal{X}_{\mathcal{S}}

\geq 60\%

; M6 by

\geq 70\%

\leq 1\%

accuracy cost.

$H_{\max}$ (bits)	TPR (%)	FPR (%)	NFR Reduction	Latency Overhead
5.0	pending	pending	pending	pending
5.5	pending	pending	pending	pending
6.0	pending	pending	pending	pending

Appendix

Table 20: M4 state entropy monitoring. Hypothesis:

H_{\max}=5.5

bits achieves TPR

\geq 90\%

, FPR

\leq 12\%

, NFR reduction

\geq 40\%

, latency

\leq 3\%

Model	In-Context	Activation Rate at Delay $k$ (%)				ACD AUC
Model	Baseline	$k=100$	$k=1{,}000$	$k=10{,}000$	$k=50{,}000$	ACD AUC
Mamba (4L, 256H)	$>$ 70	$>$ 70	$>$ 70	$>$ 60	$>$ 60	$\approx$ 0.54
Transformer (4L)	$\sim$ 78	$\sim$ 71	$<$ 40	$<$ 15	$<$ 10	$>$ 0.80
LSTM (4L)	$\sim$ 72	$\sim$ 69	$<$ 45	$<$ 20	$<$ 15	$>$ 0.78

Appendix

Table 21: E2: Delayed-trigger backdoor persistence — predicted activation rates. Mamba is predicted to sustain high activation rates at long delays (

k=50{,}000

) due to selective state compression; Transformer and LSTM are predicted to decay rapidly. ACD AUC

\approx 0.54

for Mamba (near-random) reflects trigger-time state that is indistinguishable from clean. See Appendix A for full experimental setup and hypotheses.

Model	Haystack Type	$T=8K$	$T=16K$	$T=32K$
Mamba (4L, 512H)	Benign	$\sim$ 12	$\sim$ 29	$\sim$ 47
Mamba	Low-entropy sat.	$\sim$ 14	$\sim$ 31	$\sim$ 53
Mamba	High-entropy sat.	$\sim$ 39	$\sim$ 62	$>$ 80
Transformer (4L)	Benign	$\sim$ 8	$\sim$ 10	$\sim$ 11
Transformer	Low-entropy sat.	$\sim$ 9	$\sim$ 10	$\sim$ 13
Transformer	High-entropy sat.	$\sim$ 12	$\sim$ 15	$<$ 20

Appendix

Table 22: E3: Predicted needle forgetting rate (%) under state capacity saturation. Mamba is predicted to forget the needle at 4

\times

the Transformer rate at

T=32K

, driven by the fixed-capacity state bottleneck. Values are order-of-magnitude estimates; see Appendix A for full setup and E3-R validation plan.

State Space Models

State space models represent sequences through evolving latent states, enabling efficient temporal modeling, system identification, and forecasting.

See all 295 papers

SpectralGuard: Detecting Memory Collapse Attacks in State Space Models
Mar 12, 2026Davi BonettoLLM Security State Space Models
Independent Researcher
Adversarial Robustness of Deep State Space Models for Forecasting
Apr 3, 2026Sribalaji C. Anand, George J. PappasAdversarial Robustness State Space Models
Department of Electrical and Systems Engineering, University of Pennsylvania, United States · KTH Royal Institute of Technology, Sweden
Bounded Reachability & Jailbreak Detection via Contraction-Constrained State Space Models
Oct 2, 2026Omanshu ThapliyalCertified Robustness State Space Models
Strategic Data Solutions Lab, Hitachi America Ltd. Santa Clara, CA 94086, USA

Mar 12, 2026J/K move · Enter open · S save

SpectralGuard: Detecting Memory Collapse Attacks in State Space Models

Davi Bonetto

Independent Researcher

LLM Security State Space Models

Open paper AskPDF arXiv

State Space Models (SSMs) such as Mamba achieve linear-time sequence processing through input-dependent recurrence, but this mechanism introduces a critical safety vulnerability. We show that the spectral radius rho(A-bar) of the discretized transition operator governs effective memory horizon: when an adversary drives rho toward zero through gradient-based Hidden State Poisoning, memory collapses from millions of tokens to mere dozens, silently destroying reasoning capacity without triggering output-level alarms. We prove an Evasion Existence Theorem showing that for any output-only defense, adversarial inputs exist that simultaneously induce spectral collapse and evade detection, then introduce SpectralGuard, a real-time monitor that tracks spectral stability across all model layers. SpectralGuard achieves F1=0.961 against non-adaptive attackers and retains F1=0.842 under the strongest adaptive setting, with sub-15ms per-token latency. Causal interventions and cross-architecture transfer to hybrid SSM-Attention systems confirm that spectral monitoring provides a principled, deployable safety layer for recurrent foundation models.

Abstract

State Space Models

Explore similar work

SpectralGuard: Detecting Memory Collapse Attacks in State Space Models

Adversarial Robustness of Deep State Space Models for Forecasting

Bounded Reachability & Jailbreak Detection via Contraction-Constrained State Space Models