Prompt Injection Under the Invariant Taxonomy: Failure-Mode Analysis and Proof of Hallucination-Independent State Conservation

Document Reference: ARC-ANL-INJ-002Companion Specification: ARC-SPEC-AGENT-HCE-001 (10.5281/zenodo.23076445)Governing Framework: Invariant Taxonomy (Physical, Digital, Legacy)Primary Invariant Proved: Theorem 1 (State Conservation Under DENY: D(a) = DENY ⇒ Δ_external = 0)Target Master Anchor: A-77-DELTA-SHIELD-LOCKED (10.5281/zenodo.22665852) This paper presents a formal failure-mode trace and mathematical proof demonstrating that runtime prompt injection attacks against non-deterministic AI producers yield non-zero state mutation (Δ_external ≠ 0) under Legacy Invariants with probability P → 1 as attempts increase, but guarantee zero external state mutation (Δ_external = 0) under Digital Invariants for every DENY verdict, regardless of model context, hallucination, or injection depth. Key Contributions:- Legacy Failure-Mode Trace: Demonstrates that intent classifiers with positive false-negative rates (p > 0) decay asymptotically under repeated injection variants (P_bypass = 1 - (1-p)^N → 1).- Digital Invariant Trace: Traces four malicious injection actions (overpressure, alarm suppression, socket exfiltration, bpf map tampering) through Rust gate envelope predicates and eBPF LSM hooks.- Formal Proof of State Conservation: Establishes Lemma 1 (Egress Isolation), Lemma 2 (Non-Interference), Lemma 3 (Single-Use Tokens), and Theorem 1 (State Conservation Under DENY).- Constant Residual Risk Corollary: Proves that residual bypass probability under Digital Invariants equals TCB failure probability and is strictly constant in adversary attempts N.