Paper shows prompt injection via evidence in LLM forensics
Original title: Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations
Three proofs of concept alter a conclusion, write to the analyst workstation, or trigger outbound traffic.
An arXiv paper argues that LLM-assisted digital forensics inverts indirect prompt injection because seized evidence is attacker-controlled and examiners must read it. The authors extend anti-forensic models with a taxonomy of adversarial evidence: objective, technique, payload location and concealment. They describe a perception gap in which tools, the examiner and the model see the same evidence differently. Against an LLM-assisted pipeline they demonstrate three attacks driven only by text planted on a seized device, and they propose mitigations.
Unconfirmed: The attacks are laboratory proofs of concept; no real investigation compromise is reported.
- Attacks change a reported conclusion, write chosen content to the workstation, or cause network traffic.
- Payloads are text planted on the seized device, not a separate prompt channel.
- The taxonomy covers objective, technique, payload location and concealment method.
- Classical anti-forensic taxonomies and existing prompt-injection defenses do not cover this setting, the authors say.
From the original article
1 min read at arxiv.orgLarge language models (LLMs) are entering digital forensics as examination assistants and autonomous agents. Digital forensics inverts the usual setting for indirect prompt injection: the evidence under analysis is attacker-controlled by definition, and the examiner is obliged to read it closely. This makes the reasoning layer a new anti-forensic target, next to the classical ones of data and tools.
By Frank Breitinger · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.