Poisoned into Action: Context Attacks on Typed Decision Workflows

Key points

• Typed decision interfaces restrict models to predefined actions, yet schema-valid choices can still trigger policy-violating state changes.1
• Evaluating context poisoning thus requires connecting model decisions to execution outcomes while accounting for legitimate automation retained by defenses.1
• We evaluate it with 1,659 fresh calls to Jev-1.13.0 across 20 development tasks in two synthetic workflows, using three repetitions per condition.1
• Correcting its empty-scope behavior restores twelve clean decisions without additional model calls.1

Sources (1)

• [1]Poisoned into Action: Context Attacks on Typed Decision Workflows
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 11, 11:19 AM

  We introduce an execution-aware protocol tracing poisoned evidence through retrieval, model choice, automated action, and persisted state.

  Typed decision interfaces restrict models to predefined actions, yet schema-valid choices can still trigger policy-violating state changes.

Extractive summary: sentences quoted from the sources.