Hidden State Poisoning Attacks against Mamba-based Language Models

Code, data and paper source for HiSPA — short adversarial strings that drive the recurrence of Mamba-style state space models into a contracting regime, irreversibly overwriting information held in the hidden state.

Alexandre Le Mercier, Chris Develder, Thomas Demeester IDLab–T2K, Ghent University–imec

Links

Paper (arXiv)	https://arxiv.org/abs/2601.01972
Reviews and author response	https://openreview.net/forum?id=7a3NNWWUI7
Defense (CLASP)	https://arxiv.org/abs/2603.12206

Accepted to the Findings of the ACL, EMNLP 2026.

Contents

paper/     LaTeX source and compiled PDF
roboa/     RoBench-25 benchmark, HiSPA triggers, GA/beam trigger search,
           blockwise hidden-state analysis, prompt-injection experiments
data/      RoBench-25 corpus: 120 NeurIPS 2025 abstracts with True/False questions
results/   SmolLM3-3B RoBench-25 run; LLM-guided targeted trigger exploration

The full raw result set (~339 MB of per-response CSVs) is not tracked here for size reasons and is reproducible from the scripts below; it is available on request.

Reproducing

pip install -r requirements.txt        # or: uv sync
python run_roboa_benchmark.py --help   # RoBench-25, all models and triggers
python run_retrieval_bench.py --help   # generative retrieval variant
python run_summarization_bench.py --help

Experiments were run on a single Tesla V100-SXM3-32GB for the small models and a single NVIDIA H200 NVL for Jamba-1.7-Mini.

Citation

@inproceedings{lemercier2026hispa,
  title     = {Hidden State Poisoning Attacks against Mamba-based Language Models},
  author    = {Le Mercier, Alexandre and Develder, Chris and Demeester, Thomas},
  booktitle = {Findings of the Association for Computational Linguistics: EMNLP 2026},
  year      = {2026},
  eprint    = {2601.01972},
  archivePrefix = {arXiv}
}

Responsible use

The triggers in this repository are published for defensive research, robustness evaluation and academic study. They are not intended for use against production systems without authorization. Researchers who discover further vulnerabilities using these tools are encouraged to follow coordinated disclosure practices.