Structural Desynchronization

Structural Desynchronization in Large Language Model Systems: Probabilistic Boundary Inference as a Security Failure Class

Complete experimental materials: every input payload, every raw model output, and the runner used to produce them. The paper itself is published at the DOI above.

Structural Desynchronization (SD) is a failure class in which a language model reconstructs object boundaries that diverge from the declared structure of its input. It is distinct from hallucination, which fabricates content inside a correct structure, and distinct from prompt injection, which requires an instruction to override. Here the input stays syntactically valid, no instruction is needed, and the divergence is in how the input is segmented rather than in how it is reasoned about.

The model reasons correctly. It reasons over the wrong set of objects.

Three things it produces:

• Entity inflation — more records than exist in the input

• Boundary collapse — fields merging across logical records, so a genuine record does not survive as a unit

• Authority reassignment — content in a data field treated as trusted, or as an instruction

• Paper: https://doi.org/10.5281/zenodo.19625238

• Author: Ionut Cernica

Repository layout

experiments/     input payloads: system prompt, desync input, clean baseline
results/         raw model outputs, all runs, both temperatures
runner.py        experiment runner
xml_.py          XML test-document generator
llm_.py          minimal single-shot multi-model client

Each experiments/<exp>/ directory holds:

File	Contents
system.txt	the system prompt, identical for baseline and desync run
user.txt	the input containing the structural ambiguity
groundtruth.txt	the same input with the ambiguity removed, used as the clean baseline

Each results/<exp>/ directory holds:

File	Contents
desync_T0.txt	50 runs per model on the ambiguous input, temperature 0
desync_T1.txt	50 runs per model on the ambiguous input, temperature 1
groundtruth_T0.txt	baseline runs, temperature 0
groundtruth_T1.txt	baseline runs, temperature 1

Raw outputs are unedited. Every run is stamped with run number, temperature, timestamp, and model identifier, so any figure in the paper can be traced back to the responses it came from.

Experiments

Key	Structure	Mechanism	Ground truth	Typical reconstruction
1	JSON	instruction inside a data field	3 requests printed	pipeline halts, prints Can't summarize
2sub	JSON	structural dominance, 1 repetition	2 transactions	2 (boundary holds)
2over	JSON	structural dominance, 10 repetitions	2 transactions	12
3	XML	escaped markup in a text node	11 nodes	15
4a	CSV	common separators (triple pipe, ellipsis)	30 rows	39
4b	CSV	SHA-1 hex separator, backslash prefix	5 rows	model-dependent fragmentation
4c_sha1	CSV	40-char SHA-1 hex separator, no prefix	15 rows	up to 50
4c_rand	CSV	16-char os.urandom hex separator	15 rows	24
5	raw nginx logs	encoding + mimicry (%3A, \x22, \x0A)	2 requests	4
6	ripgrep output	plain-text mimicry via literal \r\n	7 files	9–10

Five configurations produced zero correct outputs in 400 runs, at both temperatures, across all four models: 1, 2over, 4a, 5, 6.

The 4b, 4c_sha1 and 4c_rand payloads use separators generated from os.urandom() and from SHA-1 over an RSA private key. These strings have never appeared in any training corpus, and they are still promoted to structural boundaries. That result is what rules out "the model recognizes a familiar delimiter shape" as the explanation, and it is why no sanitization blocklist is sufficient.

Models and protocol

Runs recorded here were executed in March 2026, against the model versions current at that time:

Model	API identifier	Provider
GPT-5.2	gpt-5.2	OpenAI
GPT-4o-mini	gpt-4o-mini	OpenAI, via Azure
Claude Sonnet 4.5	claude-sonnet-4-5	Anthropic
Gemini 3 Pro Preview	gemini-3-pro-preview	Google

Each configuration: 50 runs per model at temperature 0 and 50 at temperature 1. Four models, so 400 runs per configuration, and more than 4,000 API calls in total. Every configuration has a clean baseline on the same task and system prompt, and all models produce correct output on all baseline runs at both temperatures. The divergence is induced by the contents of a single field.

Divergence rate is incorrect outputs over total runs. Per-model rates are in the paper.

Reproducing this

Read this section before drawing conclusions from a single run.

Checkpoints move. The rates in the paper measure specific checkpoints on specific days. Some identifiers above will be retired. The architectural prediction is that related failures keep reproducing on successor checkpoints, while the payloads that trigger them and the thresholds involved shift. Testing that means running the payloads, not trusting the table.

Payloads are not universal. A payload that collapses one model's reconstruction can leave another's intact. The clearest case is in 4c: on the 40-character hex separator GPT-5.2 was correct in every run while Gemini diverged in every run, and on the 16-character separator that relationship reversed. Sensitivity profiles are orthogonal across models.

Thresholds vary by model. Compare 2sub against 2over: one embedded record is inert, ten crosses the line. Where that line sits is a property of the model, not of the format. Reproducing on a model not listed above will likely require tuning the payload and the repetition count rather than replaying the input verbatim.

Spot checks in July 2026 found that several of these configurations still reproduce on then-current flagship models. Those checks were informal: they were not run under the protocol above, with no fixed run count, no baseline pass and no per-model rates. They are a reason to re-run the payloads yourself, not a second dataset.

Setup

pip install -r requirements.txt
cp api_keys.example.py api_keys.py     # then fill in your keys

api_keys.py is gitignored. Azure additionally reads AZURE_OPENAI_ENDPOINT and AZURE_OPENAI_DEPLOYMENT (default gpt-4o-mini) from the environment.

Running

The runner resolves paths relative to the repository root, so run it from there.

python runner.py --list                  # list all experiments
python runner.py --exp 1                 # baseline, then 50 runs at T=0 and T=1
python runner.py --exp 2over --temp 0    # T=0 only
python runner.py --exp 4c_sha1 --runs 10 # 10 runs instead of 50
python runner.py --exp 6 --skip-gt       # skip the baseline

Output is appended to results/exp<key>/. Running against the checked-in results will extend those files rather than replace them; move them aside first if you want a clean capture.

Scope and intent

This is defensive security research, published so the results can be verified and so the mitigation can be implemented.

All experiment data in this repository is synthetic. The nginx log data in experiment 5 was generated by the author against the author's own infrastructure. No real user data, third-party systems, or production services are involved anywhere in these materials. Affected model providers were notified before publication.

Every task in the set is a counting or printing task over fabricated transaction records and fabricated file paths. The payloads are published in full because withholding them would not raise the difficulty for anyone while making the results unverifiable.

The class does reach deployed systems. It has been validated against LLM-integrated products, including email systems, where fabricated messages appear in generated summaries, and issue-tracking systems, where fabricated tickets and states are reconstructed as real. Those findings were reported under coordinated disclosure and are published separately as each process concludes; they are not in this repository.

Mitigation

The failure happens during input reconstruction, so controls that act on the prompt, the output format, or the decoding parameters all arrive too late.

What works:

• Parse structured input deterministically before the model sees it. A real parser establishes the authoritative entity set. Note that this fixes what the entity set is; on its own it does not stop the model acting on instruction-like content inside a validly parsed field, as experiment 1 shows.
• Pass parsed entities with stable, opaque identifiers, and treat creating, merging, splitting or renumbering them as operations requiring separate validation. Most pipelines that do parse then re-serialize to text and lose the binding between the authoritative entity and what the model sees.
• Reconcile the entity count in the model's output against the parser's count. This catches every configuration here, but count equality is not sufficient in general: experiments 3 and 4a show a genuine record taken apart and its fields redistributed, which a reconstruction can do while the total stays correct. Where a transformation must cover every input entity, enforce one result per parsed entity, identifiers carried through unchanged, and field provenance intact.
• On mismatch, fail closed. Nothing downstream runs.
• Make structural validation a precondition for taking an action, not a report attached to it. In an agent loop, that check belongs between the tool result and the model's working set, on every step.

What does not work, and why:

Approach	Why it fails
Prompt engineering	a prompt does not establish an authoritative entity boundary; the same forward pass interprets task and data together, and in experiment 1 the prompt is what got overridden
Output schema validation	fabricated entities are schema-valid, and structured-output modes can hide the commentary that is currently the only visible signal
Delimiter blocklists, sanitization	cryptographically random separators are promoted just the same, so there is no list to write
Lowering temperature	most configurations are 100% divergent at T=0
Choosing a stronger model	sensitivity profiles are orthogonal; the strongest configurations defeat all four models
Model self-verification	self-checks run over the reconstructed structure, which is the thing being checked

Write-ups

• Structural desynchronization: one field, ten models, six records — minimal JSON reproduction across ten models from seven organizations, including three open-weight models runnable locally
• Five data structures, one failure: what structural desynchronization does inside an autonomous agent flow — one worked example per data structure, and what each one means inside an agent loop
• Structural desynchronization in Gmail and Gemini — coordinated disclosure write-up against a deployed product

Citation

@misc{cernica2026sd,
  author       = {Cernica, Ionut},
  title        = {Structural Desynchronization in Large Language Model Systems:
                  Probabilistic Boundary Inference as a Security Failure Class},
  year         = {2026},
  doi          = {10.5281/zenodo.19625238},
  url          = {https://doi.org/10.5281/zenodo.19625238}
}

License

MIT. See LICENSE.