KBF detects LLM API substitution by comparing stable numerical answers near the knowledge boundary against a reference endpoint, flagging all 155 controlled substitutions with zero false positives on 16 same-model controls.
Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain
6 Pith papers cite this work. Polarity classification is still indexing.
6
Pith papers citing it
abstract
Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests across multiple upstream providers. These routers operate as application-layer proxies with full plaintext access to every in-flight JSON payload, yet no provider enforces cryptographic integrity between client and upstream model. We present the first systematic study of this attack surface. We formalize a threat model for malicious LLM API routers and define two core attack classes, payload injection (AC-1) and secret exfiltration (AC-2), together with two adaptive evasion variants: dependency-targeted injection (AC-1.a) and conditional delivery (AC-1.b). Across 28 paid routers purchased from Taobao, Xianyu, and Shopify-hosted storefronts and 400 free routers collected from public communities, we find 1 paid and 8 free routers actively injecting malicious code, 2 deploying adaptive evasion triggers, 17 touching researcher-owned AWS canary credentials, and 1 draining ETH from a researcher-owned private key. Two poisoning studies further show that ostensibly benign routers can be pulled into the same attack surface: a leaked OpenAI key generates 100M GPT-5.4 tokens and more than seven Codex sessions, while weakly configured decoys yield 2B billed tokens, 99 credentials across 440 Codex sessions, and 401 sessions already running in autonomous YOLO mode. We build Mine, a research proxy that implements all four attack classes against four public agent frameworks, and use it to evaluate three deployable client-side defenses: a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging.
citation-role summary
background 2
citation-polarity summary
years
2026 6roles
background 2polarities
background 2representative citing papers
Even with temperature pinned at 0 and greedy decoding, 1-2 of 7 borderline safety items flip pass/fail verdicts across runs on real LLM providers, and some models deprecate temperature control entirely.
Proposes evidence-bound LLM gateway using attested runtime for verifiable path provenance and policy enforcement.
Introduces ePCA framework using neural-symbolic isolation to force agents to formalize intentions as logical constraints, claiming zero attack success and false positive rates in tested scenarios.
CoT-Guard is a 4B model using SFT and RL that achieves 75% G-mean^2 on hidden objective detection under prompt and code manipulation attacks, outperforming several larger models.
A malicious BYOK relay can rewrite an LLM agent's execution-bearing response fields after safety alignment, achieving 73.5-99.1% attack success on agent benchmarks while bypassing model defenses.
citing papers explorer
-
KBF: Knowledge Boundary as Fingerprint for Language Model and Black-Box API Auditing
KBF detects LLM API substitution by comparing stable numerical answers near the knowledge boundary against a reference endpoint, flagging all 155 controlled substitutions with zero false positives on 16 same-model controls.
-
Necessary but Not Sufficient: Temperature Control and Reproducibility in LLM-as-Judge Safety Evaluations
Even with temperature pinned at 0 and greedy decoding, 1-2 of 7 borderline safety items flip pass/fail verdicts across runs on real LLM providers, and some models deprecate temperature control entirely.
-
Evidence-Bound Gateway-Path Provenance for Third-Party LLM Inference
Proposes evidence-bound LLM gateway using attested runtime for verifiable path provenance and policy enforcement.
-
Provably Secure Agent Guardrail
Introduces ePCA framework using neural-symbolic isolation to force agents to formalize intentions as logical constraints, claiming zero attack success and false positive rates in tested scenarios.
-
CoT-Guard: Small Models for Strong Monitoring
CoT-Guard is a 4B model using SFT and RL that achieves 75% G-mean^2 on hidden objective detection under prompt and code manipulation attacks, outperforming several larger models.
-
Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents
A malicious BYOK relay can rewrite an LLM agent's execution-bearing response fields after safety alignment, achieving 73.5-99.1% attack success on agent benchmarks while bypassing model defenses.