A context flooding attack pads the model's context with a large volume of text to dilute or push out the safety instructions, then places the payload where it carries the most weight. It exploits the fact that instructions compete for the model's attention and that recency and position matter. It is related to many-shot jailbreaking, which floods the context with compliant examples specifically. The defence is to pin critical instructions, use structured prompts, and limit untrusted input size.
How does context flooding work?
A model weighs everything in its context, and instructions compete for attention. By filling the context with bulk or distracting text, an attacker reduces the relative weight of the safety instructions, and by placing the real request in a high-attention position, often near the end, they raise its influence. The safety rules are still technically present but carry less force against the flood of surrounding tokens.
Why context flooding matters
Larger context windows make the attack easier, because there is more room to bury the guardrails. It needs no special access, just a long input, and it can be combined with many-shot examples or hidden instructions for more effect. It shows that placing safety rules in the prompt is not enough on its own when an attacker controls most of the surrounding text.
How to defend against context flooding
Do not rely on a single safety instruction to survive a flood. Pin and repeat critical rules, use a structured prompt format that separates trusted instructions from untrusted input, and cap how much untrusted text a user can supply. Add intent classification on the real request and output filtering, and red-team with padded and repositioned payloads.
References
- [1]OWASP LLM01:2025, Prompt Injection(OWASP)
- [2]OWASP Top 10 for LLM Applications(OWASP)
- [3]MITRE ATLAS, Adversarial ML tactics(MITRE)
A safety rule buried under bulk text loses its force. Talk to a security expert about hardening your prompt structure and input limits.