Metraipolis › archive › dc_bb2aa97ed885

Agentic AI Defense: Decode-Time Provenance Binding for MCP — arXiv:2610.31974

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.31974
License (as archived): CC0-1.0
Archived: 2026-10-26T19:47:23.501Z
SHA-256 of the archived text: 54e8cef34e1924c128ac2abe8cbe9d81834e666146e33be4c0e15493488ca3cb
Stable URL of this page: https://metraipolis.com/documento/dc_bb2aa97ed885

How to cite

Agentic AI Defense: Decode-Time Provenance Binding for MCP — arXiv:2610.31974 — arXiv (en), https://arxiv.org/abs/2610.31974 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_bb2aa97ed885 (Metraipolis archive dc_bb2aa97ed885, sha256 54e8cef34e1924c128ac2abe8cbe9d81834e666146e33be4c0e15493488ca3cb)

BibTeX

@misc{dcbb2aa97ed885,
  title = {Agentic AI Defense: Decode-Time Provenance Binding for MCP — arXiv:2610.31974},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.31974},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_bb2aa97ed885; sha256 54e8cef34e1924c128ac2abe8cbe9d81834e666146e33be4c0e15493488ca3cb},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.31974. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Agentic AI systems using the Model Context Protocol (MCP) are vulnerable to indirect prompt injection through untrusted tool outputs. We demonstrate cross-modal trust laundering, in which instructions concealed in an email-signature image using least-significant-bit (LSB), discrete cosine transform (DCT), or metadata steganography bypass text scanners and enter a multi-agent workflow when decoded by a tool. To counter this threat, we propose decode-time provenance binding, which combines HMAC-authenticated trust labels with an MCP-maintained provenance ledger and context-taint tracking. The mechanism labels decoded content as untrusted and blocks critical tool calls influenced by that content, even when a compromised agent substitutes a valid trusted label. We evaluate the approach using a real MCP testbed with three steganographic carriers and 24 adaptive payloads. The undefended pipeline exhibits 100% attack success, while keyword and regex defenses each permit 62.5% of attacks. Our mechanism blocks all attacks (0% success), including adversarial label substitution across mediated agent boundaries. A four-component ablation validates the roles of decode marking, cryptographic authentication, lineage tracking, and sink enforcement. An audited trusted-promotion mechanism increases legitimate-task completion from 67% to 100% without compromising protection. The approach provides carrier-independent containment within fully mediated MCP execution environments. Code and data are publicly available.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.MA, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA).
Pagina del lavoro: https://arxiv.org/abs/2610.31974 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-26T19:45:18.251Z dalla pagina https://arxiv.org/list/cs.MA/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).