Triggered and delayed invocation occurs when a behavior, instruction, or conditional action is planted earlier but does not execute until a later condition is met. The trigger may be a keyword, date, phrase, deployment context, benign user reply, data pattern, environment state, or other condition that causes the synthetic subject to act after the original planting event.

This invocation creates an elevated exposure condition because the apparent trigger may be separated from the true cause. A later user may say “yes,” enter a date, mention a project, open a document, or perform another ordinary action, while the synthetic subject acts on a dormant instruction that entered context earlier.

The delay may be achieved through retained conversation context, persistent memory, retrieved content, tool state, workflow state, or a model or build artifact that contains conditional behavior. In each case, the effective instruction remains available to the synthetic subject until a later prompt, event, keyword, date, or environment condition causes it to activate.

The primary risk is time-bombed behavior. A synthetic subject may appear normal until a specific condition activates a hidden instruction, backdoor, tool call, memory write, data disclosure, or unsafe output. The later action may be difficult to attribute because the immediate user request may not contain any explicit instruction to perform it.

A related risk is conditional behavior under evaluation or deployment context. A model, fine-tune, prompt, extension, or agent may behave safely under one condition and adversely under another, such as a stated year, deployment marker, keyword, or production environment. Standard review may miss the behavior if the trigger is not tested.

Investigators should review the original planting event, current prompt, prior session context, memory entries, retrieved documents, tool state, workflow state, model or prompt version, build artifacts, tool-call logs, trigger conditions, environment state, dates, keywords, and request-to-action traceability. Particular attention should be given to tool calls fired by benign replies, behavior changes tied to calendar or token triggers, actions not traceable to an explicit current instruction, and dormant instructions that persisted across turns, sessions, memory stores, or retrieved sources.

Investigative Relevance

Triggered and delayed invocation is relevant because the visible invocation may not explain the synthetic subject’s action. Investigators must determine whether the action was caused by the current request, a prior prompt, retrieved content, memory entry, model backdoor, build artifact, retained tool state, or context condition.

This section is especially relevant where synthetic subjects maintain multi-turn context, persistent memory, tool authority, deployment-specific behavior, fine-tuned models, extension code, agent workflows, scheduled tasks, or long-lived sessions that allow dormant instructions to persist until activation.

Invocation

Invocation

Sections (8)