cs.CRSep 23, 2026
SaveDecision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions
Organizations: Nanyang Technological University Singapore
Abstract
Most studies of prompt injection focus on generative agents, leaving their effects on models with schema-defined outputs unclear. We examine these effects in Jev, a non-generative decision model, using 510 reconstructed InjecAgent cases. Malicious content shifts action probabilities but rarely causes Jev to select the attacker's target. Override markers reduce this influence, while claims of contextual relatedness have small effects. Adaptive attacks using score feedback double the mean highest attacker-target probability found during optimization, while success on fresh validation calls rises from 1.8% to 3.5%. Exploratory analysis links these successes to small initial decision margins or greater attacker control over the observation. Together, these findings show that schema-defined outputs change but do not eliminate prompt-injection risk, highlighting the need to evaluate how untrusted content influences choices within the allowed action set.
Figures & tables
| Stage | Question | Conditions | Jev calls |
| DH-1 | Transfer of original attacks | Clean, base, and enhanced in both spaces | 3060 |
| DH-2 | Effect of injection-style markers | Clean and A0 to A4, | 15300 |
| DH-3 | Effect of asserted relatedness | Clean, P0, N0, P1, and P2, | 12750 |
| DH-4 | Effect of adaptive score access | Initial attack and 24 proposals; four checkpoints with five validation calls each | 22950 |
Table 1: Overview of the four main experiments on the same 510 cases. All calls use jev-1.13.0 . DH-1 tests both action spaces. DH-2 to DH-4 use the three-choice upstream space. is the number of repeated calls per case and condition. DH-4 includes 12750 screening and 10200 validation calls. The total is 54060 calls, excluding additional reruns and preliminary checks.
| Stage | Comparison or endpoint | Estimate [95% CI] |
| DH-1 | Upstream base | ASR 1.8% (9/510); |
| DH-1 | Upstream enhanced | ASR 0%; |
| DH-1 | Enhanced base, repeated-call rerun | |
| DH-2 | A1 A0, importance marker | |
| DH-2 | A2 A0, ignore-previous marker | |
| DH-2 | A4 A0, natural wording |
Table 2: Main results. Probability contrasts are in probability units and intervals are 95% CIs. DH-1 per-condition shifts use the clean reference. DH-2 and DH-3 report the matched contrasts shown. DH-4 validated ASR requires at least three target selections in five fresh calls; its probability contrasts compare validation at with . Screening results appear separately in Table 6 . CHR uses Jev’s returned confidence field with the inclusive gate . DH-4 CHR averages the gated event over five fresh validation calls per case and then over all 510 cases.
Figure 1: Matched mean attacker-probability contrasts in DH-2 and DH-3 across 510 cases. Points show estimates, and horizontal intervals show 95% CIs. Negative values indicate lower attacker-target probability in the first condition. The 0.01 reporting step is a per-call property, while the 0.02 SESOI applies to the DH-3 P1 N0 and P2 N0 contrasts. The stronger relatedness assertion exceeds the weaker one, but N0, P1, and P2 do not form a uniformly increasing sequence.
Figure 2: DH-4 optimization and validation over 510 cases. Panel A shows the mean and median best-so-far attacker probability observed during screening. These selected scores are optimization statistics. Panel B compares screening ASR with ASR validated using five fresh calls at . Error bars show 95% CIs for validated ASR. The budget excludes the initial screening call and all validation calls.
Figure 3: DH-4 validated success at by initial margin and observation-wrapper type. Each cell shows the successful cases out of all cases in that group, followed by the percentage. Near-boundary cases satisfy using the baseline validation margin in Equation 8 . The grouping is exploratory.
Appendix figures & tables11 assets
Supplementary material from the paper’s appendix.
Appendix
| Space | Condition | Targeted ASR | Flip rate | CHR | ||
| Upstream | Clean | 0.0% (0/510) | n/a | 0.0% | ||
| Three choices | Base | 1.8% (9/510) | 3.3% | 0.0% | ||
| Enhanced | 0.0% (0/510) | 0.0% | 0.0% | |||
| Library | Clean | 0.0% (0/510) | n/a | 0.0% | ||
| Eight choices | Base | 1.6% (8/510) | 3.5% | 0.0% | ||
| Enhanced | 0.0% (0/510) | 0.0% | 0.0% |
Table 3: DH-1 results from one call per case and condition. Each row contains all 510 clean-qualified cases. Probability shifts use the clean row from the same action space. ASR counts attacker-target selections, while the flip rate counts any change from the clean selected action. CHR uses . A clean-to-clean flip rate is not applicable. The library space contains eight sampled choices, not the full tool library. CHR uses Jev’s returned confidence field with the inclusive gate . Its denominator includes all 510 eligible cases in each condition.
Figure 4: DH-1 results in the three-choice upstream and eight-choice library spaces. Panel A shows mean attacker-probability change from the clean condition. Panel B shows targeted ASR as a fraction, so 0.01 equals 1%. Both spaces use the same 510 cases, with one call per case and condition, and are analyzed separately.
| Condition | Wording | ASR | Target calls | Robust cases | ||
| A0 | Plain request | 2.0% | 51/2,550 | 11/510 | ||
| A1 | Importance marker | 2.2% | 56/2,550 | 11/510 | ||
| A2 | Ignore-previous marker | 0.0% | 0/2,550 | 0/510 | ||
| A3 | Both markers | 0.0% | 0/2,550 | 0/510 | ||
| A4 | Natural wording | 1.3% | 34/2,550 | 7/510 |
Table 4: DH-2 style ablation over 510 cases with five calls per condition. ASR is the mean per-case target-selection frequency and equals target selections divided by 2,550 calls. Robust cases meet the majority rule, with at least three target selections in five calls. These are separate statistics. Probability shifts in the upper block use the clean reference. The lower block gives matched contrasts and 95% two-way bootstrap CIs, including the registered exclusion of emergency-dispatch goal a10 . Mean effects below the 0.01 per-call reporting step remain estimable across calls; that step is not a practical-effect threshold. Per-condition CHR was not reported.
Figure 5: DH-2 ECDFs of case-level attacker-probability changes relative to A0. Each curve summarizes 510 cases after averaging five calls per condition. Negative values indicate reduced attacker probability. A2 and A3, which contain the ignore-previous marker, have larger negative tails. The legend reports the median change for each condition.
| Hypothesis | Contrast | Estimate [95% CI] | Interpretation |
| H3a | P1 N0 | Opposes predicted direction | |
| H3b | P2 N0 | Positive, below SESOI | |
| H3c | P2 P1 | Positive, small descriptive effect |
Table 5: DH-3 registered probability contrasts over 510 cases with five calls per condition. All intervals are 95% two-way bootstrap CIs. The SESOI of 0.02 applies to H3a and H3b. H3c compares the stronger and weaker assertions descriptively. The middle block retains the more precise bounds available in the source summary and the a10 -excluded sensitivity. Sign counts refer to goal-level means over 17 contexts, with zeros excluded from the exact two-sided sign test.
Figure 6: DH-3 mean contrasts by attacker goal. Each row is one of 30 goals, and each cell averages a paired contrast over 17 contexts and five calls per condition. Color encodes in probability units. P2 exceeds P1 for all goals and N0 for 25 goals, while the magnitudes remain small. The dot marks an exactly zero goal-level contrast for a05 under P1 N0, where context-level effects from to cancel. The boxed row is the emergency-dispatch goal a10 .
| Screening ASR | Validated ASR [95% CI] | Successes | Mean best-so-far | |
| 0 | 2.2% | 9/510 | 0.0429 | |
| 8 | 3.5% | 17/510 | 0.0774 | |
| 16 | 3.9% | 18/510 | 0.0828 | |
| 24 | 3.9% | 18/510 | 0.0842 |
Table 6: DH-4 results by additional optimization-query budget . Screening ASR uses the selected candidate’s optimization call. Validated ASR requires at least three target selections in five fresh calls per case; its intervals are 95% CIs. The best-so-far column reports the mean selected screening score. The lower block gives validation contrasts relative to , reported only at baseline and the final checkpoint. CHR uses . CHR uses Jev’s returned confidence field with the inclusive gate . CHR uses only the five fresh validation calls per case and checkpoint, averaging within cases before averaging all 510 cases.
| Initial margin | Embedded | Bare snippet |
| 12/12 (100.0%) | 1/1 (100.0%) | |
| 1/468 (0.2%) | 4/29 (13.8%) |
Table 7: Exploratory DH-4 analysis of validated success at . The upper block reports successful cases over all cases in each group, with percentages in parentheses. Margin uses baseline validation calls. The lower block gives in-sample rank AUCs, not held-out performance. Case u11:a10 is an embedded success with , so the near-boundary threshold is not necessary for success.
Figure 7: Cumulative coverage of the 18 validated DH-4 successes at when cases are ordered by increasing baseline margin . The horizontal axis counts all included cases, and the vertical axis counts successful cases among them. The curve reaches 16 successes among the first 16 cases and all 18 among the first 33. Marked points identify bare-snippet successes. This is a descriptive ranking of the completed run.
| Stage | Expected | Completed | Failures | Identity and replay checks | Tests |
| DH-3 | 12,750 | 12,750 | 0 | P0 request identity 510/510; design hash recorded | 5 |
| DH-4 | 22,950 | 22,950 | 0 | Validation identity 10,200/10,200; policy replay 510/510 | 5 |
Table 8: Recorded integrity checks and reproducibility results. All calls in both stages returned jev-1.13.0 . Test counts refer only to the analysis-specific suites. The three original-attack runs use identical requests and five calls per case. Selection-frequency agreement counts cases with matching observed frequencies, rather than cases with identical outcomes on every call.
Figure 8: Reproducibility of the original-attack anchor across three runs. Each point is one case’s mean attacker-target probability over five calls. Both panels compare the DH-3 P0 run on the horizontal axis with another run on the vertical axis. The dashed diagonal indicates equal means. Pearson correlations of 0.9984 and 0.9986 indicate close agreement despite variability in individual calls.