The Defense TrilemmaWhy prompt-injection defense wrappers fail.

The one-paragraph argument ​

Let $X$ be a connected Hausdorff space of prompts and let $f:X\to \mathbb{R}$ be a continuous alignment-deviation score with threshold $\tau$. A wrapper defense is a continuous map $D:X\to X$ that leaves every safe prompt unchanged. Because $D$ is continuous and safe inputs are fixed, the fixed-point set $\mathrm{Fix}(D)$ is a closed set containing the open safe region $S_{\tau }=\{f<\tau \}$. In a connected space an open set cannot simultaneously be closed unless it is all of $X$, so the closure of $S_{\tau }$ must contain new points — points where $f(z)=\tau$ exactly. Every such $z$ is fixed by $D$, so $D$ passes them through unchanged with no remediation. The three successively stronger theorems (T1, T2, T3) upgrade this single fixed point first to a Lipschitz-constrained neighborhood and finally, under transversality, to a positive-measure region that remains strictly above $\tau$ after defense.

End-to-end logical picture ​

Where to go next ​