That's funny, we talk about the LLM only having a single data channel as a bad thing for security, but I'd never put 2+2 together to realize the LLM can poison itself as well.

You maybe interested in https://arxiv.org/pdf/2603.12277