Conjunctive Poisoning in AI Supply-Chain Applications

2026-08-16

AI Summary

This study addresses the vulnerability of text artifacts to tampering during AI deployment and the insufficiency of existing defenses by revealing joint poisoning risks involving prompt wrappers and metadata. To mitigate these threats, we propose TIF-BAH, a middleware defense framework that integrates joint gated attack modeling, static analysis, and SigStore signing to establish a lightweight runtime behavior verification mechanism ensuring inference integrity. Evaluations across 15 LLM and VLM systems demonstrate that this approach effectively defends against interaction-layer vulnerabilities while generating verifiable behavioral proofs. By bridging critical gaps left by traditional weight- and prompt-level protections, TIF-BAH significantly enhances security throughout the AI supply chain, offering a robust solution for safeguarding model integrity in real-world deployment scenarios.

Abstract

Large Language and Vision-Language Models are increasingly deployed through inference pipelines that include prompt wrappers (e.g., templates and post-processing scripts) and configuration metadata (e.g., JSON/YAML files) that together shape model outputs. While model weights and binaries are routinely verified, these textual deployment artifacts remain weakly protected despite directly influencing runtime behavior. We show that a malicious developer can pair a benign-looking wrapper with crafted metadata to deterministically alter post-generation behavior without modifying model weights, training data, or inference backend. We study this behavior through a controlled conjunctive-gate implementation, where activation depends on both an embedded wrapper marker and cryptographically bound metadata. We evaluate the attack across fifteen open- and closed-source LLM/VLM deployments, and assess prompt and system level defenses including static metadata inspection, wrapper scanners, PromptShield, and SigStore-based artifact signing. To mitigate this risk, we introduce TIF-BAH, a lightweight middleware defense that verifies wrapper integrity and records behavioral attestations during inference. Our results reveal that wrapper-metadata interactions form an under-protected execution layer in modern AI deployments, exposing a deployment-time behavioral risk that is not captured by model-weight or prompt-level defenses. Code is available at https://github.com/N-H-Arif/llm_temp.

Problem

• AI Supply-Chain Security
• Conjunctive Poisoning
• Deployment Artifacts
• Runtime Behavior Manipulation
• Large Language Models

Innovation

• Conjunctive Poisoning
• AI Supply-Chain Security
• TIF-BAH
• Wrapper-Metadata Interaction
• Behavioral Attestation