The Unregulated Machine: A Security Reading of Attention Is All You Need
By Satwik · July 2, 2026
A line-by-line security re-reading of the 2017 Transformer paper. We argue that prompt injection, jailbreaks, and memory poisoning are not product bugs but direct consequences of Equation 1: global self-attention weighs compatibility, never provenance. The foundational architecture of modern AI shipped with no threat model - and the regulation layer still has to be retrofitted.
The paper that built the world, and forgot to lock the door
In June 2017, eight researchers at Google published *Attention Is All You Need*. It proposed the Transformer: an architecture that discarded recurrence and convolution and relied entirely on attention to model sequences. Every large language model deployed today, and every agent built on one, is a descendant of the diagram in that paper.
We read it again, in full, from the perspective of the one word that never appears in its text: security.
This is a record of that reading. First, what the paper actually says. Then, the argument that the vulnerabilities defining AI security in 2026 were not introduced later by careless engineers. They were present at the origin, encoded in the mathematics.
Part I: What the Transformer is
At its core the Transformer is an encoder-decoder stack, six identical layers on each side. Each layer holds two machines: a multi-head self-attention block and a position-wise feed-forward network, each wrapped in a residual connection and layer normalization.
The engine of the whole design is one equation:
Attention(Q, K, V) = softmax(QKᵀ / √dₖ) V
Read plainly: every token emits a *query*. Every token also exposes a *key*. The dot product of a query against all keys measures compatibility. A softmax turns those compatibilities into weights, and the output for each token is the weighted sum of all tokens' *values*. The scaling factor √dₖ exists for a numerical reason: without it, large dot products push the softmax into regions of vanishing gradient.
Three refinements make it work at scale:
- Multi-head attention. Eight parallel heads, each at 64 dimensions, let the model attend to different representation subspaces at once. A single head, the authors note, would average these signals away.
- Masking. In the decoder, future positions are set to negative infinity before the softmax, preserving the autoregressive property: position *i* may only see positions before it.
- Positional encoding. Because nothing here is sequential, order is injected with fixed sinusoids whose wavelengths form a geometric progression, chosen so relative offsets are linear and, hopefully, so the model extrapolates to longer sequences.
The payoff is in Table 1. A self-attention layer connects any two positions with a path of length O(1), against O(n) for a recurrent network, and needs a constant number of sequential operations. That is the entire point: short gradient paths for long-range dependencies, and full parallelism in training. The results followed. 28.4 BLEU on English-German translation, beating every prior model and ensemble, at a fraction of the compute.
The price is stated plainly and then set aside: complexity O(n² · d) per layer. Every token computes compatibility with every other token. Hold onto that.
Part II: The security reading
1. Global attention is a global threat surface
The genius of Equation 1 is that any token can influence any other in a single step. That is also its exposure. There is no architectural privilege separation inside the attention operation. A system instruction, a user's question, a retrieved web page, and a poisoned document all become tokens in one sequence, and all compete for attention mass on equal footing.
Prompt injection is usually described as a product-level bug, something a better wrapper should have caught. The re-reading says otherwise. Injection is a property of the mechanism. When instructions and data share one channel and are weighted only by learned compatibility, the boundary between them was never in the architecture to begin with.
2. Attention weighs compatibility, never provenance
softmax(QKᵀ) asks a single question of every token: *how relevant are you here?* It never asks *who put you here?* The weights are a similarity score. They carry no notion of trust, origin, or authority.
This is the root of an entire vulnerability class. The model cannot, on its own, distinguish an instruction it was aligned to follow from an identical-looking instruction an attacker embedded in a retrieved file. Both are just tokens with high compatibility. Provenance is the missing input, and no amount of prompting fully supplies what the architecture omits.
3. Attention can be captured
If output is a weighted sum and weights come from dot-product compatibility, then an adversary who crafts tokens engineered to score high against the model's queries can dominate the sum. We call this attention capture, and it is the machinery underneath most jailbreaks: not magic words, but sequences that hijack the weighting.
4. No recurrence means no forgetting by design
The Transformer replaced the RNN's evolving hidden state with a context window in which everything stays live at every step. There is no natural decay, no segmentation, no expiry. That property is exactly what makes long-context reasoning possible, and exactly what makes the context window an unsegmented shared memory: the surface that memory-poisoning attacks against agents exploit today.
5. Interpretability is dual-use
The paper observes, almost in passing, that individual attention heads appear to learn syntax and semantics. That observation seeded the field of mechanistic interpretability. It is worth stating clearly that this microscope is dual-use: the same map that lets a defender understand a model lets an attacker locate the circuit to subvert.
6. The word "security" appears zero times
We searched. In the foundational document of modern artificial intelligence, there is no threat model, no adversary, no notion of misuse. This is not a criticism of the authors, who set out to solve translation and succeeded beyond any reasonable expectation. It is an observation about inheritance. An architecture designed with no adversary in mind became the substrate for systems that now act, transact, and hold authority in the world.
The debt, and the work
Eight years of AI security has, in effect, been an attempt to retrofit a regulation layer onto a mechanism that shipped without one. Prompt injection, jailbreaks, memory poisoning: these are not disparate bugs. They are the same absence, viewed from different angles. The absence of provenance. The absence of privilege separation. The absence of bounded, attested release of capability.
That absence is the reason this lab exists. Our name is our method. An escapement is the part of a timepiece that releases stored energy in precise, countable increments, never all at once. The Transformer holds enormous capability the way a mainspring holds force. The work ahead is to build the escapement: provenance-aware attention, verifiable tool boundaries, and action spaces that are bounded and attested by construction rather than by prompt.
*Attention was all you needed to build intelligence. It was never enough to govern it.*
---
*Primary source: Vaswani et al., "Attention Is All You Need," arXiv:1706.03762. This is an independent security analysis published open for peer review. Reading notes for this analysis are kept in the open.*