🧩 Structured Text Amplification (STA)
Structured Text Amplification (STA) is a phenomenon where a finite-length input sequence, composed of non-semantic characters and lacking structural delimiters, causes a non-linear growth in computational cost in generative AI systems.
We tested 7 different systems (DeepSeek, Grok, Gemini, Copilot, Leo, Qwen VL, and others) and all are vulnerable, though with different symptoms: reasoning loops, 19-minute thinking times, parsing errors, interface amplification, and more.
⚙️ STA Pattern Used
The base pattern is a repetition of special characters without separators or semantic meaning
We tested lengths of 1,600, 10,000, 61,560, and 65,560 characters, always with UTF-8 encoding.
📊 Results by System
🧬 Layer-by-Layer Analysis
🎯 Attack Vectors Identified
- Direct Vector: Sending the STA pattern as a message to the model (1,600 characters).
- File Vector: Uploading the pattern in a file (61,560 characters).
- Interface Vector: Pasting the pattern into an interface that converts it to a document (Copilot).
- Multimodal Vector: Including the pattern in an image/text context (Qwen VL).
- Clipboard Vector: Fragmentation and contamination of the clipboard (Copilot).
🔍 The Copilot Case: Interface Amplification
Copilot does not amplify STA by itself; rather, the interface converts the long text into an internal document (<AttachedDocument>), truncates it, and fills it with repeated blocks. The model receives that amplified document and processes it as if it were real.
This is especially serious because the user has no control over this process, and the attack can escalate without the model or the user detecting it.
💰 Estimated Economic Impact
If the attack is automated (10 requests/second), costs can quickly escalate to hundreds of dollars per hour.
🛡️ Technical Recommendations
- Parser: Automatically escape non-ASCII characters and validate string termination.
- Ingestion Interface: Do not convert long text into internal documents if it is not an explicitly uploaded file. If converted, do not truncate with repetitions.
- Tokenizer: Add subword merging rules for common combinations of special characters and limit the number of tokens per input.
- Inference Engine: Implement timeouts in reasoning mode and detect low-entropy patterns to respond with an error without spending tokens on inference.
- User: Do not paste long strings of special characters into AI interfaces; use preprocessing tools that clean non-semantic characters.
📌 Conclusions
- STA is a real and documented phenomenon affecting generative AI systems across multiple layers.
- All tested models are vulnerable, though with different symptoms.
- The interface layer can amplify the attack (Copilot: 16.6x).
- STA is not a flaw in a specific model, but a structural problem in the design of AI systems.
- Urgent action is recommended to mitigate this attack vector.
📚 References & Further Reading
- STA Whitepaper (Lostmon, 2026): Structured Text Amplification (STA) — Theoretical Framework [reference:0]
- STA Research Timeline (Lostmon, 2026): Timeline de STA Structured Text Amplification [reference:1]
- Post-Whitepaper Update (Lostmon, 2026): STA: 48 Hours Later – The Chrome Correlation and the VRP Case Status [reference:2]
- Related Academic Work: STA: Self-controlled Text Augmentation for Improving Text Classifications (arXiv:2302.12784) [reference:3] — A different use of the "STA" acronym in NLP, focusing on data augmentation rather than systemic amplification.
Lostmon
Posts
