arXiv cs.AI· Eric Yocam, Varghese Vaidyan, Paris Kalathas, Patrick Tague, Bruce DeBruhl, Yong Wang·· 2 小时前AI 评分56
arXiv 论文提出解码时来源绑定机制防御 MCP 隐写提示词注入
Agentic AI Defense: Decode-Time Provenance Binding for MCP
AI 导读
arXiv 论文针对 MCP 智能体系统面临的间接提示词注入威胁，提出解码时来源绑定机制，结合 HMAC 认证信任标签、MCP 来源账本和上下文污点追踪。在含三种隐写载体和 24 个自适应载荷的真实 MCP 测试床中，未防护管线攻击成功率 100%，关键词与正则防御各放行 62.5%，该机制将攻击成功率降至 0%，审计式可信提升机制使合法任务完成率从 67% 升至 100%。
正文 · 原文
Abstract:Agentic AI systems using the Model Context Protocol (MCP) are vulnerable to indirect prompt injection through untrusted tool outputs. We demonstrate cross-modal trust laundering, in which instructions concealed in an email-signature image using least-significant-bit (LSB), discrete cosine transform (DCT), or metadata steganography bypass text scanners and enter a multi-agent workflow when decoded by a tool. To counter this threat, we propose decode-time provenance binding, which combines HMAC-authenticated trust labels with an MCP-maintained provenance ledger and context-taint tracking. The mechanism labels decoded content as untrusted and blocks critical tool calls influenced by that content, even when a compromised agent substitutes a valid trusted label. We evaluate the approach using a real MCP testbed with three steganographic carriers and 24 adaptive payloads. The undefended pipeline exhibits 100% attack success, while keyword and regex defenses each permit 62.5% of attacks. Our mechanism blocks all attacks (0% success), including adversarial label substitution across mediated agent boundaries. A four-component ablation validates the roles of decode marking, cryptographic authentication, lineage tracking, and sink enforcement. An audited trusted-promotion mechanism increases legitimate-task completion from 67% to 100% without compromising protection. The approach provides carrier-independent containment within fully mediated MCP execution environments. Code and data are publicly available.
| Comments: | 12 pages, 5 figures, 13 tables, 2 algorithms. Code and data available at this https URL |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA) |
| ACM classes: | D.4.6; K.6.5; I.2.11 |
| Cite as: | arXiv:2610.31974 [cs.CR] |
| (or arXiv:2610.31974v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.31974 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Eric Yocam [view email]
[v1]
Thu, 22 Oct 2026 22:27:13 UTC (528 KB)
来源：arXiv cs.AI · arxiv.org