The Encoding Alphabet Is the Security Boundary: Measuring the Coverage Limits of Deterministic Multi-Encoding Decoding Against Cross-Stage Instruction Laundering in LLM Agent Pipelines

Agent pipelines pass content through a sequence of stages, and a low-trust stage such as a retrieved document or a tool output can carry an instruction that a downstream stage acts on. When that instruction is hidden by an encoding in the low-trust stage and re-emerges as an active command later, the pipeline has laundered a data value into a control action. A natural and widely proposed defense is to decode every stage before inspection, so that a base64 or percent-encoded instruction is unmasked and matched.

We take this deterministic decodeand-match defense, implemented as a detector that reverses base64, hexadecimal, percent, and HTML-entity encodings and joins an encoded instruction in one stage to its active restatement in a later control stage, and we measure what it covers. The measurement is exact because the detector is deterministic, with no model and no randomness. On 10 injection instructions across 13 transform families, the decoder recovers the 4 encodings inside its alphabet at a mean rate of 0.95 and recovers none of the 9 equivalent transforms it does not reverse, a mean of 0.00.

The boundary is not only the alphabet. Two of the decoder's own encodings, percent and HTML-entity, collapse to 0.00 once the payload sits inside surrounding text rather than alone, because they decode the whole stage rather than an isolated token. Nesting a single encoding twice drops recovery from 1.00 to 0.00, since the decoder makes one pass, and composing an out-of-alphabet transform with an in-alphabet one evades entirely.

The temporal join is sound, with zero false activations across 10 cases in each of three negative-control classes, and the companion trust-boundary check fires on an untrusted token reaching a privileged sink and is neutralized by an intervening guard. The conclusion is that deterministic pre-decoding is necessary but draws a narrow and brittle boundary whose shape is the decoder's encoding alphabet, and that a laundering defense must therefore treat the space of transforms, not a fixed list of encodings, as its threat model. We release the detector, the transform corpus, and the harness.