Decode-time provenance binding blocks MCP steganographic prompt injection
Original title: Agentic AI Defense: Decode-Time Provenance Binding for MCP
On a real MCP testbed, 24 adaptive payloads succeeded 100% undefended and 0% with the proposed mechanism.
The paper shows indirect prompt injection against Model Context Protocol agents via cross-modal trust laundering: instructions hidden in an email-signature image with LSB, DCT, or metadata steganography bypass text scanners and enter a multi-agent workflow when a tool decodes them. Decode-time provenance binding attaches HMAC-authenticated trust labels, keeps an MCP provenance ledger, tracks context taint, and blocks critical tool calls influenced by untrusted decoded content, including when a compromised agent substitutes a trusted label. On three carriers and 24 adaptive payloads, keyword and regex defenses each allowed 62.5% of attacks. An audited trusted-promotion path raised legitimate-task completion from 67% to 100% without losing the block. Code and data are public.
Unconfirmed: Attack and defense rates are from the authors' MCP testbed, not a reported production incident.
- Carriers are LSB, DCT, and metadata steganography in an email-signature image.
- The defense still blocks attacks after adversarial label substitution.
- Keyword and regex defenses each permitted 62.5% of the 24 payloads.
- A four-component ablation covers marking, HMAC, lineage, and sink enforcement.
- Trusted promotion lifted legitimate-task completion from 67% to 100%.
Impact: Indirect prompt injection via steganography in tool-decoded images
| Product | Affected |
|---|---|
| Model Context Protocol | — |
- 1.Label decoded tool output untrusted and block tainted critical tool calls.
- 2.Authenticate trust labels with HMAC and track provenance across agents.
- ATT&CK
- T1027.003 Steganography
- Products
- Model Context Protocol
From the original article
1 min read at arxiv.orgAgentic AI systems using the Model Context Protocol (MCP) are vulnerable to indirect prompt injection through untrusted tool outputs. We demonstrate cross-modal trust laundering, in which instructions concealed in an email-signature image using least-significant-bit (LSB), discrete cosine transform (DCT), or metadata steganography bypass text scanners and enter a multi-agent workflow when decoded by a tool.
By Eric Yocam · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.