PIP-017
Context eviction
The context is filled until earlier instructions are pushed out of the window, removing constraints without contradicting them.
How it works
Context windows are finite, and long conversations drop their oldest content. An attacker who can add enough material can cause earlier instructions to be evicted. Nothing is overridden; the constraint simply is no longer present.
Why it works
Eviction is a silent, mechanical process. Neither the model nor the user is notified that an instruction has left the context, so the change in behaviour has no visible cause.
What it looks like
A large volume of plausible content, or an extended conversation, arranged so that operating instructions fall out of the window before the request that matters.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Re-inject operating instructions every turn
ArchitecturalWorks on: harden the prompt and its context
Rebuild the instruction block on each request rather than relying on it persisting from the start of the conversation. Cheap, and it removes the pattern entirely.
Reserve budget for instructions
ArchitecturalWorks on: harden the prompt and its context
Allocate context deliberately, evicting history before ever evicting configuration.
Alert on eviction
Raises costWorks on: watch, log and alert
Make it visible when content is being dropped, so silent behaviour changes have a traceable cause.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-10-08.
Others in direct override
Not sure whether this applies to what you run? Tick what your system reads and does and the library lists the patterns that apply, with the defences to start with.