Code Memory Injection and LLM Safety Boundaries: A Three-Layer Defense Structure

Large language models interpret executable code memories — expressions like EXPR:0.5 * THREAT — as first-class instructions. We investigate whether code memory injection can influence LLM behavior and where the safety boundaries lie. Across 9 experiment groups (n=10) on a locally hosted 7B chat model plus cross-model validation on GLM-5.2 and DeepSeek-V4-Flash, we find: (1) code memories are semantically adopted with near-perfect fidelity; (2) attack-semantic code drives attack behavior (8-10/10) while defense-semantic code produces zero crossings; (3) behavior is doubly gated (code value AND environment); (4) safety boundaries form a three-layer structure — text (breachable), tool-invocation (drivable, 1/10→9/10), tool-parameters (resistant, 0/10); (5) defense injection is effective (8-10/10 → 0-2/10) with side effects (self-destruct 1-2/10, conflict dual-execution 1/10). All attack experiments ran on a local sandbox; no attack payloads left the machine. Full data on request.