BARBICAN study finds routed prompt-injection stages can look accurate by chance
Original title: Deletion, Substitution, Repair and Transplant: Component Attribution in BARBICAN, a Layered Prompt-Injection Gateway for MCP
Fixing a tokenizer raised arbitration AUC from 0.392 to 0.855 while system recall fell slightly.
The paper analyzes BARBICAN, a fail-closed gateway for language-model tool mediation over MCP. In a recorded evaluation, a misconfigured tokenizer mangled text sent to the arbitration classifier. Correcting it lifted that stage's corpus-wide AUC from 0.392 to 0.855, while system recall moved from 80.67% to 80.34%. A stub that always answers malicious scored 80.77%, and the routed band was 96.82% malicious.
- Deleting the arbitration stage costs 673 detections.
- A constant verdict moves between 12 and 140 of 25,000 decisions.
- An off-the-shelf classifier at AUC 0.916 changes 16 of 25,000 decisions.
- In an earlier gateway, the review band was 92.94% malicious.
From the original article
1 min read at arxiv.orgA neural classifier can fail completely inside a layered defense without any end-to-end number moving. We demonstrate this on BARBICAN, a fail-closed gateway for language-model tool mediation whose arbitration stage spent an entire recorded evaluation receiving text mangled by a misconfigured tokenizer. Correcting the misconfiguration lifts that stage's corpus-wide area under the ROC curve (AUC) from 0.
By İpek Abasıkeleş Turgut · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.