Intent injection attacks are a new worry for AI-native 6G networks

Intent-based networking (IBN) lets operators state the outcome they want and leaves its translation into network policy to software, an approach AI-native 6G designs have moved to the forefront. Researchers at the University of Ottawa and Nokia Bell Labs argue that this abstraction gives attackers new openings, and it tests two machine-learning detectors against one of them.

Threat model−Malicious intent injection through vulnerable API (Source: Research paper)

The authors call that threat adversarial intent injection: hiding malicious instructions among legitimate ones. They evaluated their detectors on 1,100 intents they constructed, partly with a large language model’s help, so the reported figures describe performance on that dataset.

The entry point

Intents are machine-readable requests, often in JSON, that an IBN system turns into network policies. The researchers focus on the point where requests are accepted: an attacker with a compromised API key submits intents that pass as routine updates. The paper names denial of service, privilege escalation, traffic redirection and backdoors as possible consequences; its experiments are limited to detecting the injected intents.

For malicious examples, the team wrote 20 base attack intents, covering threats such as phishing and data exfiltration, and produced nine variants of each. One variant turns a rule that drops traffic with logging enabled into one that null-routes it with logging set to a limited mode. To model ambiguity, the authors relabeled 40 malicious intents as benign and 90 benign intents as malicious.

As a check for easy keyword giveaways, they built a rule-based classifier from 88 terms they classed as strong discriminators. Across the full dataset it caught about 10% of malicious intents, although 96% of the intents it flagged carried a malicious label.

Reading the sequence

The researchers’ bet is that attackers can give themselves away in how they space out their requests. To test that, they built four versions of their data, with malicious intents arriving at a fixed average pace, scattered at random, speeding up over time, or slowing down.

Their detectors look at short runs of consecutive requests, up to six at a time, and flag runs likely to contain a malicious one so a person can review them. The authors found that longer runs generally helped, with some exceptions.

They tried two kinds of detector. One learned from examples labeled safe or malicious. The other studied only normal activity and raises a flag when something departs from that pattern, an approach the authors pitch for teams with little advance knowledge of what attacks look like.

The first detector caught between three-quarters and 96% of the runs containing malicious requests, depending on the attack pattern. The second caught the most of any method tested in three of the four patterns, but it had trouble with the fixed-pace attack, missing about a third of those runs.

Both caught more than an earlier detector that judges one request at a time, which flagged roughly half to 60% of malicious cases across the four patterns.

Open questions

In future work, the team plans to add more varied JSON policy configurations that better reflect real IBN deployments, and to use explainable-AI methods that make detection decisions easier to interpret.

Download: The Agentic Software Development Guide