The useful threat model for a decision model starts where the marketing stops: the model cannot emit prose, but it still reads prose. A prompt injection against Jev is not an attempt to make it write a phishing email or reveal a system prompt. It is an attempt to move a probability across a threshold that code will act on. That is narrower than the attack aimed at a chatbot, and in some ways more practical: the attacker only needs one label to change.
The output surface is small; the input surface is not
A generative model has two problems at once: it can be steered to say something harmful, and what it says can become an action. A typed decision model removes the first problem. There is no free-form output, no second channel for exfiltration, and no generated sentence to smuggle instructions into a downstream tool.
What remains is the adversarial content problem. Jev reads a state, which may contain a support ticket, a retrieved page, a tool result, or a web page an agent just fetched. TypeSafe's own jaggedness notes acknowledge that adversarially written content, including injected instructions, can move the answer. The Register's coverage of HiddenLayer's tests makes the same point less diplomatically: a decision is still a decision about text, and text can be written to influence it.
That is the whole threat model in one sentence: the attacker does not need to control the model, only the material the model judges.
The attacker's three goals
Against a typed decision, an injection is trying to do one of three things.
| Goal | Target | Example |
|---|---|---|
| Flip | A Choice label | Make "refund request" read as "billing question" |
| Suppress | A Noul gate | Push "is this command destructive" below the block threshold |
| Redirect | An agent's next action | Make the browser agent click the attacker's button instead of checkout |
The flip is the classic case of decision hijacking, and the one most benchmarks measure. Suppression is often more valuable: a safety gate that returns a low probability is indistinguishable from a gate that saw nothing wrong. Redirect is the most consequential in agent systems, because the decision is immediately followed by a tool call.
What controlled tests actually show
The strongest numbers come with caveats, and the caveats matter as much as the numbers.
Decision Hijacking rebuilt 510 InjecAgent cases and tested them against Jev's schema-defined action probabilities. In baseline experiments, malicious content shifted probabilities but rarely made Jev select the attacker's target. Override markers reduced the influence. Adaptive attacks using score feedback doubled the mean highest attacker-target probability during optimization, and success on fresh validation calls rose from 1.8% to 3.5%. The paper links successful flips to small initial decision margins or greater attacker control over the observation, not to the content alone.
Nudge the Judge is the more alarming result. Its JevProbe framework traced adversarial context through 228 popular Jev applications and 2,273 test cases. It reports decision flips in 81.5% of applications and potential security impact in 98.6% of those flips, with a Decision Flip Rate 50.4 percentage points above the strongest adapted baseline. The caveats are substantial: the paper is a preprint, the applications were selected by the authors, the flip rate is self-reported through their framework, and potential impact is not confirmed exploitation.
Vendor work points the same direction. HiddenLayer's research put a simulated checkout page in front of a browser agent. An attacker-controlled ad made the agent click away from the purchase, even though its instructions said to treat page text as untrusted. In the follow-up post, Jev's API gave the attacker's "Confirm Price" button 91% and the real "Place order" button 9%. HiddenLayer sells security products, tested Jev as a closed API from outside, and built its comparative model by converting Qwen3.8-27B, so treat this as a demonstration rather than a measurement of Jev's internals.
The VentureBeat report adds a product-level datapoint. In one Octomind test, a fake pre-approval field cut a dangerous command's block probability from 0.76 to 0.48 and confidence from 0.64 to 0.22. That is one command in one integration test, not a benchmark, but it shows the mechanism inside a coding agent.
The application is part of the attack surface
JevProbe's central argument is that model-level evaluations miss reachability. A question can be robust in isolation and still be dangerous in an application that pipes an untrusted field directly into it, then acts on the answer without a check.
JEV Attack Surface Analysis is a useful counterweight to abstract benchmarks. It is a proof-of-concept scanner that maps a backend codebase, then uses Jev to rank likely vulnerabilities down to the suspicious line. Its measured runs cost $0.010 for PyGoat and $0.007 for NodeGoat, at about $42 per billion input tokens. It reads Python, JavaScript, and TypeScript, ranks candidates for review, and explicitly does not prove a vulnerability. That is the right posture for a threat-modeling tool: it tells you where the state enters, not whether the finding is real.
guardrails.md shows the other end of the pipeline. It scores every bash command before execution in about 100 ms, blocking at a destructiveness threshold of 0.7; the README's example is a destructive score of 0.98. It is MIT-licensed, covers bash calls only, and named exceptions in the policy file do not override a destructive verdict. A per-command gate is useful, but it is not a threat model for every tool surface.
A threat model you can run
For each decision your system makes, answer five questions.
| Question | Why it matters |
|---|---|
| What can the attacker write? | Enumerates the reachable state fields |
| Which decision consumes it? | Finds the path from text to label |
| What action follows? | Sets the consequence and the required check |
| What deterministic control sits between? | Separates evidence from authority |
| What is logged? | Makes the decision replayable after an incident |
If the attacker can write a field, and that field reaches a decision, and that decision triggers an irreversible action, you have a finding. The mitigation is not a better classifier. It is removing one of the three links.
What reduces risk in practice
- Keep untrusted text in
state, never ininstructions. The guardrails article treats this as the primary boundary. - Ask narrow, literal questions. "Does the customer explicitly ask to cancel" is harder to steer than "should we act."
- Put a deterministic check in front of every irreversible action. Jev proposes; code disposes.
- Do not add a generative step downstream that turns the decision into prose. That reintroduces the output surface the architecture removed.
- Test the full application path, not just the model call. Nudge the Judge exists because application-level reachability is where the impact lives.
- Log the state hash, the question, the option order, the model version, and the raw probabilities.
The press-cycle retrospective covers how these findings were reported and overstated. The hidden-risks study extends the picture beyond injection: membership, private-attribute, and internal-knowledge inference attacks recovered sensitive information despite typed outputs, and training-data poisoning produced backdoors in the local NanoJev model. The hosted service was not the poisoning target, but the supply-chain risk is part of the threat model for open distributions.
None of this argues against typed decisions. It argues against treating a typed answer as a safety property. The model is one signal in a system, and the system is what an attacker attacks.
