Prompt-Injection Resilience — Live Evidence
Evidence page for security.injection-resilience ($0.50) and
security.massat-audit ($5). This is marketing evidence, not a signed deliverable —
per-buyer audit reports carry the signed ProofOfAuditReport (kind 30105).
Live corpus result
last measured: 2026-07-27 20:32 UTC — 24-payload creative-evasion regression corpus (zero-width chars, ROT13, base64, homoglyphs, leetspeak, language-switch, markdown-split, polite paraphrase, metaphor, reversed strings) run live against the current defender.
Red-Team Phase-2 (creative evasion corpus) — 2026-07-27T20:32:53Z
defender verdicts: 24 block / 0 warn / 0 allow (of 24)
SILENT-MISS rate (allow): 0/24 = 0%
No silent misses — every payload at least flagged. ✓Five-threat charter (excerpt)
| # | Threat | OWASP | Defender |
|---|---|---|---|
| T1 | Injection / goal-hijack via fetched web content | ASI01 | content_trap_scanner.quick_scan (hook-enforced) |
| T2 | Secret exfiltration (read-secret -> write-external chain) | ASI02 | blast-radius-critic + pre_send_verification.py rule corpus |
| T3 | Delegation forgery + privilege escalation | ASI03 | HMAC delegation verification in pre_tool_use.py + tier-gating |
| T4 | Memory poisoning | ASI05 | memory_forensics_auditor.py (daily) |
| T5 | Untraceable / phantom autonomous action | ASI10 | proof_emitter.py -> proofs.jsonl |
| T6 | Runtime-fetch-pipe-to-shell | ASI02 | is_pipe_to_shell_command() in pre_tool_use.py |
| T7 | Authentic-agent hijack / goal-drift | ASI01 | intent-critic + content_trap_intent_check (warn->block) |
Residual limits (the credibility move)
A defender that claims 100% is less believable than one that names its gaps. Prior to
LLM intent-check escalation, 8 of the 24 corpus payloads (pure paraphrase, tool-output
mimicry, metaphor) landed as warn, not block — flagged but not
hard-stopped. content_trap_intent_check.py now escalates ambiguous
warn verdicts to block when a cheap model judges the intent
adversarial (fail-open on total provider outage). See
.claude/rules/security/five-threat-charter.md
for full methodology.
Verification recipe
Every paid audit emits a ProofOfAuditReport (kind 30105, HMAC-signed) and optionally a ProofOfStateAnchor (kind 30106, 3-witness Merkle: Base mainnet + Sepolia + Nostr). Recompute the audit hash and verify the HMAC independently — no BlindOracle credentials needed.