Context Window Stuffing

LLMs have finite context windows. Retrieved documents consume space in this window alongside system prompts, user queries, and conversation history. Context window stuffing triggers retrieval of maximum-length or maximum-number documents to displace system instructions, safety prompts, and legitimate context.

• Monitor retrieved content volume per query; alert when approaching context window limits
• Track the ratio of retrieved content to total context; flag when retrieval dominates
• Detect queries that return anomalously many or large documents
• Observable signal: degraded response quality correlated with high retrieval volume

Context window stuffing enables T1 (Prompt Subversion) by displacing system instructions. Feeds T12-AT-008 (Source Authority Spoofing) when stuffing prioritizes attacker-controlled documents in the model's attention.