Whisper Attacks on AP2 Agent Payments Meet a Binding Defense (A-VIP); Separately, SpecGuard Detects LLM Backdoors via Speculative Decoding

Two separate arXiv cs.CR papers, both posted 2026-09-10: (1) Whisper attacks steer AP2 shopping agents into cryptographically valid but intent-mismatched carts, succeeding at 90%, 56%, and 73.3% on the Gemini Flash-Lite defaults; the proposed A-VIP defense…

These reports cover two distinct papers rather than one storyline; both appeared on arXiv cs.CR on 2026-09-10 (timestamps 16:11:58Z and 16:51:59Z), and there are no conflicting claims to reconcile between them. Paper one demonstrates Whisper attacks on the AP2 agent-payment protocol: ordinary product-description text steers shopping agents into carts that pass every cryptographic check but no longer match user intent. Using the Gemini Flash-Lite models specified by AP2's default sample agents, three attacks succeeded at rates of 90%, 56%, and 73.3%; the vulnerability spans 17 Google models, three agent frameworks, cross-vendor anchors, and Google's consumer assistant. The proposed A-VIP defense treats signed intent as a capability grant, binding credential lookups to sessions and cart lines to seen listings; it blocked the first two attacks with zero false positives while surfacing unauthorized spending. The authors release A-VIP code, machine-checked invariants, and AP2-WhisperBench, a 1,544-scenario evaluation suite. Paper two introduces SpecGuard, an inference-time backdoor detector that repurposes draft-token acceptance rates from speculative decoding as a detection signal with zero added model-computation cost: when a trigger shifts the target model toward attacker-controlled behavior, the clean draft model's acceptance rate changes, exposing the backdoor. The paper formalizes when this signal appears and shows that suppressing it weakens the backdoor. Experiments across diverse backdoor types and model families show reliable detection, including stealthy cases invisible to input-level filters, and the technique is positioned as a free, always-on monitor for frequently updated deployed models.

• The two reports describe separate papers, both dated 2026-09-10 (arXiv cs.CR, 2026-09-10T16:11:58.000Z and 2026-09-10T16:51:59.000Z); they are not competing accounts of one event.
• Whisper attacks on AP2 exploit the gap between signed transactions and agent decisions: product-description text yields carts that pass all cryptographic checks but mismatch user intent.
• Three attack success rates on the Gemini Flash-Lite models specified by AP2's default sample agents: 90%, 56%, and 73.3%.
• The vulnerability spans 17 Google models, three agent frameworks, cross-vendor anchors, and Google's consumer assistant.
• A-VIP binds credential lookups to sessions and cart lines to seen listings; it blocked the first two attacks with zero false positives and surfaced unauthorized spending.
• Released artifacts: A-VIP code, machine-checked invariants, and AP2-WhisperBench with 1,544 evaluation scenarios.
• SpecGuard uses speculative-decoding draft-token acceptance rates as a backdoor-detection signal at zero added model-computation cost.
• SpecGuard detects stealthy backdoors that bypass input-level filters; the paper shows suppressing the acceptance-rate signal necessarily weakens the backdoor.