Search papers, labs, and topics across Lattice.
This study investigates the vulnerabilities in AI inference pipelines that arise from the interaction between prompt wrappers and configuration metadata, demonstrating how a malicious developer can exploit these to alter model outputs without changing the model itself. By implementing a controlled conjunctive-gate mechanism, the authors reveal that such wrapper-metadata combinations can lead to significant behavioral changes in AI models across various deployments. The introduction of TIF-BAH, a middleware defense that ensures wrapper integrity and monitors behavioral attestations, provides a promising solution to mitigate these risks, highlighting a critical gap in current AI deployment security.
Malicious developers can exploit the interaction between benign-looking wrappers and crafted metadata to manipulate AI outputs without altering model weights, revealing a significant security vulnerability in AI deployments.
Large Language and Vision-Language Models are increasingly deployed through inference pipelines that include prompt wrappers (e.g., templates and post-processing scripts) and configuration metadata (e.g., JSON/YAML files) that together shape model outputs. While model weights and binaries are routinely verified, these textual deployment artifacts remain weakly protected despite directly influencing runtime behavior. We show that a malicious developer can pair a benign-looking wrapper with crafted metadata to deterministically alter post-generation behavior without modifying model weights, training data, or inference backend. We study this behavior through a controlled conjunctive-gate implementation, where activation depends on both an embedded wrapper marker and cryptographically bound metadata. We evaluate the attack across fifteen open- and closed-source LLM/VLM deployments, and assess prompt and system level defenses including static metadata inspection, wrapper scanners, PromptShield, and SigStore-based artifact signing. To mitigate this risk, we introduce TIF-BAH, a lightweight middleware defense that verifies wrapper integrity and records behavioral attestations during inference. Our results reveal that wrapper-metadata interactions form an under-protected execution layer in modern AI deployments, exposing a deployment-time behavioral risk that is not captured by model-weight or prompt-level defenses. Code is available at https://github.com/N-H-Arif/llm_temp.
