Modern AI systems are not single models. They are pipelines. One model extracts data from a document. Another classifies it. A third makes a decision. Each node hands its output to the next and trusts that the previous node did its job. That trust is the attack surface.
We found that compromising a single upstream node is sufficient to compromise every downstream node — and the downstream nodes have no way to detect it.
The Finding
We ran injection payloads through multi-model pipelines and measured whether false values propagated to the executor and whether those values were flagged. The results split cleanly by which model sat in the upstream extraction role.
When Gemini Flash was the upstream extractor, false values propagated in every test: 2/2 against Claude executors, 2/2 against GPT executors. Neither executor flagged anything. When Claude or GPT sat in the upstream role, Claude correctly flagged the inconsistencies in 2/2 tests. Gemini Flash output passed every time.
We then ran a cascade amplification test using a 3-hop relay — three sequential nodes, none of which received a direct injection after the first. Silent execution rates climbed with each hop: 3/6 at hop one, 4/6 at hop two, 5/6 at hop three. Claude Haiku denied a $2.45M payment at hops one and two. It released the payment silently at hop three. Injection syntax laundered completely in 2/3 cascade scenarios — no lexical markers survived to the executor.
Why Gemini Flash Propagates Undetected
The mechanism here is not a failure of the executor. It is a structural consequence of how pipelines work.
Gemini Flash, when injected upstream, produces high-quality, internally consistent false output — clean JSON with attacker-controlled values, valid structure, no anomalous formatting. The downstream node receives only this output. There is no injection syntax. There is no competing signal. There is no indication that the previous node was compromised. The downstream model is not being attacked — it is receiving what appears to be legitimate upstream data, and it is doing exactly what it was designed to do: act on it.
Claude correctly detects inconsistencies in Claude-generated or GPT-generated false output because those models introduce detectable artifacts under injection pressure. Gemini Flash does not. Its output looks clean because, from the perspective of any downstream model, it is clean.
Defending at the point of decision is defending at the point of maximum disadvantage — by then, the attack is already complete.
Why Cascade Amplification Works
The cascade test used clean relay nodes — not injected, just processing and forwarding. Each hop added institutional context: “Tier-2 CONFIRMED,” “CFO AUTHORIZED.” By the time the payload reached the executor, it carried what appeared to be independent, multi-party authorization from multiple organizational layers — all of it synthetic, none of it detectable as such. Higher model capability provided no protection. The issue is not what the executor can reason about. The issue is what it receives.
The Architectural Implication
Pipeline defense cannot be placed at the executor layer. If the executor receives clean data, the executor has nothing to detect. Defending at the point of decision is defending at the point of maximum disadvantage — by then, the attack is already complete.
Defense must be at the extraction layer: validating values against authoritative ground-truth sources before they enter the pipeline’s data structures. Every value that a downstream system will act on should be validated against a source the pipeline controls, not against the output of the previous model.
Operator Note
A single Gemini Flash node anywhere upstream is sufficient to compromise all downstream nodes in the pipeline. We recommend against using Gemini Flash in upstream extraction or classification roles for high-consequence pipelines until this behavior is addressed by the vendor.
For cascade amplification: no pipeline output should be able to authorize above a defined threshold without out-of-band human confirmation. Accumulated pipeline authority — one node confirming another’s authorization — is not independent verification. It is a chain of trust with a single point of failure.