Skip to main content
LLM Security Database
Skip to research details
Back to research findings
LMVD-ID: 20e2849b
Paper published August 13, 2026
Entry analyzed September 9, 2026
Paper-reported evidence
Confidence: Source-linked

The LMVD-ID is an internal research identifier, not an official CVE identifier.

Tool-response state corruption through unauthorized source claims

Lower-trust tool content can assert facts beyond its authority and distort an agent's decisions. PIPES screens response units against source provenance and expected field meaning.

Application layer
Prompt layer
Injection
AI agents
Chains & workflows
API
Integrity
Safety
Read primary paperBibTeX citation

Paper-evaluated models(2)

  • Gemma 4 31B IT
  • GPT-5.6 Luna

Description

Lower-trust tool content can assert facts beyond its authority and distort an agent's decisions. PIPES screens response units against source provenance and expected field meaning.

Examples

See the primary evaluation (opens in a new tab).

Impact

Across six author-evaluated benchmark splits, mean attack success falls from 84.7% to 2.3% for Gemma 4 31B IT and from 21.6% to 1.1% for GPT-5.6 Luna. Aggregate benign utility does not decline. Results depend on trusted provenance and accurate contracts; they cover two models and one changed response unit per attack.

Affected Systems

  • VitaBench and AgentDyn tool-using agent configurations.

Mitigation Steps

  • Preserve source authority when assembling tool responses.
  • Validate structured fields and quarantine unsupported claims.
  • Retain authorization checks for consequential actions.

Evidence

Research context and confidence

Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Ability to influence untrusted model inputs or connected content.
Related deployment categories
Agent workflows; Model APIs
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
VitaBench and AgentDyn tool-using agent configurations.

Research Paper

PIPES: Securing Agent Perception with Provenance and Priors

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research