Tag tool output with source provenance and field contracts: state-corruption attack success drops 84.7% to 2.3%

arXiv 2608.12789·high signalXBlueskyLinkedInCopy link

PIPES (Provenance-Informed, Prior-Enforced Screening) defends against state-corruption attacks, where attacker-controlled data makes false claims about the environment that slip past injection filters because they read as ordinary tool results. It screens each response unit two ways — static field contracts where a schema gives stable expectations, and source provenance metadata for open-ended content — then removes, warns, blocks, or escalates on violation. On six benchmark splits with Gemma 4 31B IT under adaptive attack, attack success fell from 84.7% to 2.3% while benign utility rose slightly (92.5% vs 90.6%).