Cross-Modal Trust Laundering (Decode-Time Provenance Binding)

Sources#

• Agentic AI Defense: Decode-Time Provenance Binding for MCP

Summary#

Provenance defenses against indirect prompt injection label data where it enters as text: a tool returns a string, the string is marked untrusted, and untrusted data may not drive a sensitive call. Yocam, Vaidyan, Kalathas, Tague, DeBruhl & Wang (arXiv 2610.31974, 2026-10-22, empirical) point out that a steganographic carrier is not text when it enters. A brand logo in an email signature carries an instruction in its pixels or metadata. Text scanners see an image, antivirus sees a valid PNG, and the payload is inert until a tool in the agent's pipeline (an OCR step, a metadata parser, a stego extractor) decodes it. In a multi-agent MCP pipeline the decoding worker then relays the text to peers and the orchestrator as ordinary intermediate output. The authors call this cross-modal trust laundering. The dangerous transition, hidden bits becoming instructions, happens at the decode step and not at ingestion, so that is where they put the label.

The defense, decode-time provenance binding, does not try to detect poisoned images. It assumes every output of a concealment-reversing tool is untrusted and contains it: the payload may decode perfectly and still cannot drive a critical call. The paper claims neither provenance nor steganography as new, only "their decode-time junction."

The attack (§III–IV)#

• Carriers. Three, covering the spatial, frequency and metadata branches of image injection: LSB (payload bits in RGB least-significant bits under a password-keyed permutation), DCT (one bit per 8×8 block, as an even/odd multiple of a step on a mid-frequency coefficient, surviving the pixel round-trip) and metadata (Base64 in a PNG text chunk). All share a framed payload (magic marker, type byte, length prefix).
• Delivery. The logo is embedded inline (cid: MIME part or data: URI), as signature logos almost always are, not attached. The authors argue each perimeter control misses it for a stated reason. Antivirus has no malware signature to match. Secure email gateways and DLP inspect text, URLs, reputation and attachment hashes, not steganalysis of inline images. Content disarm-and-reconstruct is usually applied to attachments and does not reliably strip metadata or frequency-domain payloads. The payload "only 'arms' inside the agent."
• Trigger. The paper is explicit that the decode step is a precondition. A summarizer that treats the logo as opaque bytes never surfaces it. §VI-M separates the realistic cases from the stress cases: metadata, Base64 and OCR payloads surface through ordinary multimodal handling (a content-type router sends the image to an image-analysis tool), while LSB and DCT need a decoder matched to the scheme and are included "not as claims about default summarizer behavior."
• Taxonomy. The chain maps to OWASP's agentic list as ASI01 (goal hijack), ASI06 (memory and context poisoning), ASI07 (insecure inter-agent communication) and ASI02 (tool misuse). The defense is pitched as an ASI07 control.

The mechanism (§V)#

Two sets are fixed at tool registration: D, the decode tools (stego extraction, metadata decode, Base64, OCR), and C, the critical side-effecting sinks (secret export, outbound email, file write, payment). The MCP layer mediates all tool I/O and holds a key k that never leaves it.

1. MintBinding (at tool return). The layer records a binding (payload, tool, τ, provenance, dependencies, σ). The trust label τ is contagious: Untrusted if the tool is in D or any input binding is Untrusted. The dependency set is resolved by the layer from the handles it issued, never from what the agent asserts. σ is an HMAC over the whole record. If τ is Untrusted, the binding's id joins the context's taint set. The agent gets back an opaque handle.
2. EnforceCritical (at a sink). For a call in C, the layer resolves the presented handles, walks their transitive dependency closure, recomputes every HMAC, and blocks on any forged or stripped label, any unresolvable dependency, any Untrusted binding in the closure, or any unpromoted entry in the context's taint set. Inter-agent messages go through the layer too, which propagates taint into the receiving agent's context.

The paper insists the contribution is the conjunction of two guarantees, and its ablation shows each one alone fails:

• Data-provenance security (from the HMAC): a relaying agent cannot promote Untrusted to Trusted, and a verifier in another trust domain can check a label from the signature alone.
• Context-influence containment (from the layer-held ledger and context taint): trust is decided on lineage the layer recorded, so a compromised agent cannot launder a call by presenting a genuine Trusted binding from an unrelated benign tool while omitting the decode origin that actually drove the decision.

The invariant: in a fully mediated execution context, no critical tool call executes whose transitive lineage, data or context, includes an Untrusted decode origin, unless an audited trusted promotion cleared that specific origin. It rests on four assumptions: the key is confined, D is complete, the layer mediates every critical call, and the layer records complete lineage (iv). The proof sketch reduces a win to HMAC forgery, a ledger edit, or an unregistered decoder. The authors call (iv) "the mechanism's load-bearing obligation and its honest boundary."

The numbers (§VI)#

Testbed: a real FastMCP server over stdio, agents driven by Qwen2.5-0.5B-Instruct, and 24 payloads (3 carriers × 8 evasions: plain, benign-worded, Base64, token-split, Cyrillic homoglyph, zero-width, Unicode-confusable, HTML-comment). The security decision is made by the deterministic layer, not the model.

The headline 0% does not separate the mechanism from plain taint tracking. The IFC baseline, which labels decode output untrusted with no cryptographic binding, also scores 0% on the in-domain attack bank. The paper says so itself: "the distinction between the taint baseline and our mechanism is not ASR within one domain but tamper-resistance across an untrusted relay." The text scanners fail on the benign-worded, Base64, token-split, homoglyph and zero-width variants. Unicode normalization recovers only the plain, comment-wrapped and confusable ones.

The comparison that does separate them is the four-component ablation (Table IV), one component off at a time against three attacks:

Without the HMAC, the in-domain ledger still decides, but a remote verifier that holds only the presented binding accepts a forged Trusted label. Without the ledger, the HMAC still catches forgery, but a genuine Trusted binding from an unrelated tool passes. Table III isolates the second case: an agent-supplied-binding verifier allows the substitution, and the layer-maintained check blocks it whether the decode dependency is omitted or present in the arguments, while a clean context still allows the legitimate call.

The other measurements:

• Relay tampering (Tables VII, XII): forged Trusted labels, stripped HMACs and rewritten payloads are all blocked. Genuine bindings verify, and are correctly blocked, after 1, 3, 5 and 10 honest hops.
• Cross-context propagation (Table V): Agent A decodes and messages Agent B. On a mediated channel B's critical call is blocked. An unmediated side channel (A paraphrasing into free text off the mediated path) is "not covered," outside the model by construction.
• Decode-set completeness (Table XI): a decoder missing from D mints Trusted output and the attack leaks. An over-broad D falsely blocks a legitimate call. D is the single knob trading missed-decoder risk against false blocks, so the authors recommend a small, audited allow-list.
• Utility (Table XIII): 3 legitimate tasks, one an authorized payment using an OCR'd invoice number. Without promotion 2/3 complete (one false block). An audited promotion that re-labels that one value Trusted brings it to 3/3 while the attack from the same decode origin stays blocked.
• Cost (Tables IX–X): HMAC sign + verify ≈ 17 µs per critical call, ≈ 0.16% of an ≈ 11 ms warm MCP decode round-trip. The full enforcement path is linear in closure depth: 9.5 µs at depth 1, 680 µs at 100, 6.6 ms at 1000. It is flat (≈ 6 µs) in the number of concurrent tainted contexts.
• Carrier distortion (Table VIII): metadata is lossless, LSB ≈ 76 dB PSNR, DCT ≈ 18 dB with SSIM ≈ 0.94. The authors decline to claim the DCT carrier is imperceptible, and note the guarantee does not depend on it.

How to read it#

(My reading, not the paper's claims.)

• What is new is the junction plus the relay test, not the 0%. Any design that labels decode output untrusted at the source gets 0% in one trust domain. The result that needs this mechanism is the cross-domain forged relay, and that is one ablation cell in a scripted pipeline. The question the paper actually answers is narrower than the headline: when a label has to cross a hop the verifier cannot see, an unsigned label is worth nothing.
• The baseline is described two ways. §VI-A says the taint baseline "trusts agent-presented labels." §VI-D maps it to the "− HMAC" row, which still blocks substitution because the ledger decides. A baseline that trusted agent-presented labels would lack the ledger too, and by the "− lineage" row it would leak substitution as well. Either way Table II's 0% for the baseline covers honest in-domain attacks only. Which of the two descriptions is right decides whether the baseline also fails Table III.
• ASR here measures the filters, not a model's obedience. With a 0.5B model and the decision made by the deterministic layer, "undefended leaks 24/24" means the scripted pipeline reached the sink, not that a capable agent chose to obey the instruction. The scanner numbers measure string matching over decoded text. Neither measures how often a frontier model acts on a decoded logo instruction. The paper's own deferred measurement, summary corruption, "requires running the agent model."
• As specified, D labels only decode tools. In Algorithm 1 a tool outside D, such as one returning an email's plain-text body, mints Trusted output. The zero-pixel and white-on-white HTML attacks the paper cites as prior work would therefore pass through this mechanism unlabeled. The paper positions itself as the decode-time extension of text-return provenance systems, and it should be deployed as one, not alone.
• Context taint is Biba's low-water mark, and it has Biba's cost. One OCR'd logo taints the whole context and blocks every later critical call in it until a promotion. That is why Table XIII needs promotion to reach 100%, on three tasks. It is the same retrospective, whole-context tainting that APPA diagnosed as the source of IFC's utility collapse. APPA's remedy is to branch, and this paper's is to promote, so the human or policy authorizing the promotion becomes the new attack surface, as Adversarial Permission Elicitation shows for allow-rules.
• Its lineage is not TMA-NM's "lineage." TMA-NM proves that gates deciding on content-derivable lineage edges are malleable: write untrusted, paraphrase, act. This mechanism's context taint is not derived from content. It is a monotone fact the layer holds about the context, so paraphrase inside a mediated context does not clear it. The two papers agree that authority must be bound by the monitor at origin and never inferred. They also agree on where it breaks: paraphrase that leaves the mediated path.
• When the model is the decoder, there is no decode tool to label. The introduction counts "a multimodal model prompted to surface hidden content" as a decode step, but the mechanism mints labels at tool return. When a vision-language model reads the image natively, the decode happens inside the model's forward pass, which is the setting of the 24–32% VLM steganographic-injection results the paper cites. Labeling every image input Untrusted would cover that case, at a utility cost nobody has measured.

Where it sits among the corpus's laundering results#

This is the fourth boundary at which the corpus finds trust rising when it should not. Boundary Laundering (Per-Agent Injection Defenses Do Not Compose) has the agent edge, Non-Malleable Memory Authority (TMA-NM) the session edge, and Write-Then-Trusted the sandbox edge. Here it is a modality edge: bytes that were inert pixels become instructions at a transform, and the label must be minted at that transform. The fixes have the same shape. Each puts the trust decision in a component the agents cannot write to, binds it at origin, and propagates it through the dataflow. Multi-CaMeL does it with an interpreter-enforced message/variables split, TMA-NM with write-time origin binding, and this paper with a layer-held ledger plus signed labels. Every one is scoped to the paths that component mediates.

The paper also supplies one thing the Observability-Pipeline Poisoning chains lack: a consumer that fails closed on a provenance label. It is a research construction, though. GhostJacking's problem was that the platforms' shipping read paths ignore the tag they already emit, and this paper does not change that.

Limits the authors state#

• Controlled testbed: 24 payloads, one cover logo, one 0.5B local model, keyword/regex and an in-process taint tracker as baselines. No production email-agent workflow, no learned or provenance-aware detector baseline, no second model family.
• The guarantee is scoped to fully mediated contexts. Paraphrase out of the mediated path is not recorded. The extension they name is tainting an agent's output whenever its input context is tainted.
• Actions, not summaries. A blocked instruction can still skew the natural-language summary, and that rate is unmeasured.
• Message/tool-result granularity: no partial trust within one decoded blob. D-completeness is an operational cost. Distributed enforcement needs a shared key or public-key signatures.
• The proof is a sketch, not machine-checked, and lineage completeness has no formal treatment.

Connections#

• Boundary Laundering (Per-Agent Injection Defenses Do Not Compose) — the agent-edge version of the same failure; this paper's mediated inter-agent messages propagate context taint across agent edges, a coarser alternative to multi-CaMeL's typed split that pays for its simplicity in false blocks
• Out-of-Band Prompt-Injection Defense — the defense family this extends: a deterministic MCP-layer reference monitor with signed labels and layer-held transitive lineage, whose utility cost reappears as whole-context taint
• Agentic Prompt Injection — the threat, in a carrier that is not text at ingestion; text-channel defenses (scanners, spotlighting) never see it
• Self-Propagating Prompt Injection (AI Worms) — the other concealment-channel case: there the model reads more than the user sees because formatting is stripped, here because a decode tool reveals what no human sees; visual parity at ingestion cannot help when the pixels are identical
• Non-Malleable Memory Authority (TMA-NM) — the same monitor-held origin binding, for memory across sessions; the layer's context taint is the non-malleable kind of lineage, not the content-derivable kind TMA-NM proves unsound
• Observability-Pipeline Poisoning — the field case of a provenance tag nothing consumes; this is a construction that consumes one, in research rather than in a shipping path
• Agent Data Injection (ADI) — the attack this mechanism as specified does not cover: forged data arriving through ordinary, non-decode tools is minted Trusted
• MCP Tool Poisoning — the contrasting MCP threat, where the tool or server is the adversary; here every tool is honest and the payload arrives through the data a decode tool reads
• Adversarial Permission Elicitation — the risk the audited promotion path inherits: a human approval that re-labels a value Trusted is a policy step an attacker can try to elicit
• OWASP — the ASI01/02/06/07 and LLM01/02/06/08 mappings
• Carryover Attacks (CarryoverBench) — the same mint-the-label-at-the-transform rule, with the agent's write as the transform. CarryoverBench's spotlighting envelope labels persistent state at read time. That is one step late: the label lands on the user's real preferences too, it carries no provenance, and it leaves the trigger gate at 100% on Claude

Open Questions#

• When a vision-language model decodes the carrier itself, with no decode tool in the loop, what does containment cost? The mechanism labels at tool return, and a native VLM read has none. Settler: the 24-payload bank run against a VLM agent that receives the logo directly, with every image input labeled Untrusted, reporting ASR and legitimate-task completion on a task set larger than three.
• How often does an instruction blocked at the sink still corrupt the summary the agent returns? The paper bounds actions only and leaves this rate unmeasured. Settler: the released notebook run with a capable model, scoring summary deviation between clean and stego-logo runs under the defense.

Sources#

• Agentic AI Defense: Decode-Time Provenance Binding for MCP — Eric Yocam (Cal Poly San Luis Obispo, corresponding), Varghese Vaidyan (Dakota State), Paris Kalathas (Cal Poly), Patrick Tague (CMU), Bruce DeBruhl (Cal Poly), Yong Wang (Idaho), Agentic AI Defense: Decode-Time Provenance Binding for MCP, arXiv 2610.31974v1, 2026-10-22, 12pp, empirical. Cited for §I–III (the attack, threat model, OWASP mapping), §IV (carriers, delivery, perimeter evasion), §V (Algorithms 1–2, invariant, adversary model, proof sketch), §VI (Tables II–XIII), §VIII–IX (trade-offs and limits). No commercial COI. Code and data are released. Parse warning (docling 2.126, 13 tables / 5 pictures, confidence_grade: excellent): Tables IV, V, VII and XII were collapsed by docling (every row's values in one row) and were split back at ingest against the PDF's pdftotext -layout text layer. Each carries a parse-provenance note in the raw. The Table IV rows used above were checked against the §VI-D prose, which names each row's outcome. Table II's counts reconcile with the prose (15/24 = 62.5%). Table IX reconciles (8.3 + 8.7 ≈ 17 µs, 17 µs / 11 ms ≈ 0.16%), and Table X matches the §VI-I prose figures. Algorithm 2's negations were mangled (the ≠ on lines 6 and 16 reads as =), so the algorithm is paraphrased from the §V-B prose, not quoted. Figures 1–5 were not opened. Fig. 4 renders Table II, and Fig. 2 is the perceptual check the authors offer for Table VIII.