PatternsProgram decision hijackingContext attacks

Decision hijacking

An attack that steers a typed decision through attacker-controlled context — tool output, retrieved text, or an option name — while every request and response stays schema-valid.

All 172 terms

Category: Patterns
Also known as: Program decision hijacking, Context attacks
Related terms: 4
Directory entries: 5
Docs: —
Added: 2026-10-14

Definition

Because Jev consumes program context and returns typed answers, an attacker does not need the model to emit text: a poisoned tool result, a retrieved passage, or a crafted option label can flip the decision while the schema stays intact. One automated framework traced this across 228 real Jev applications and found 81.5% showed decision flips, 98.6% with potential security impact, and the tested defenses helped little.

The published attacks split into context channels and interface channels: a sentence asking only why someone might make a harmful request bypassed 9% of moderation blocks, option-name swaps flip answers without touching definitions, and interface attacks tilt probabilities without any payload in the state. Mitigation starts with treating every context surface as untrusted input and testing flips with your real option lists, not generic prompts.

Tagssecurityguardrailspatterns

Related terms

Definitions that connect to this one.

Adversarial contentJev treats state as data, not as hostile input; injected instructions can move answers, so write precise criteria and test edge cases.Evaluation & Training GuardrailScreening messages going into or out of an LLM app with hazard Nouls and severity Scores, then thresholding the probabilities.Patterns Fail openWhen Jev is down or slow, the gate allows the action, including rules that would otherwise block it.Ecosystem Literal readingJev answers the question you wrote, not the one you meant; scoping words, negations, and implied conditions are read at face value.Evaluation & Training

From the Jev directory

Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions (arXiv 2609.28613)

An evaluation of prompt injection against Jev's typed probabilistic decisions using 510 reconstructed InjecAgent cases. Malicious content shifts action probabilities but rarely flips Jev to the attacker's target; score-feedback attacks raise fresh-run success from 1.8% to 3.5%.

Jev Practices & PatternsArticle#community#research#arxiv

Community

Nudge the Judge: Uncovering Program Decision Hijacking in Real-World Jev Applications (arXiv 2610.18612)

An automated framework that traces adversarial context through Jev-backed program decisions to downstream effects. Across 228 real-world Jev applications and 2,273 test cases, 81.5% show decision flips, 98.6% with potential security impact, and Decision Flip Rate beats the strongest baseline by 50.4 points.

Jev Benchmarks & EvaluationsArticle#community#research#arxiv

Community

xiaoxiaohg8d/JevProbe-Python

Same Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety Classifiers (arXiv 2610.17820)

A controlled adversarial comparison of Jev against five GPT and GLM judges and two local classifiers under identical payloads and policies. Jev is the most robust on input moderation and the fastest overall, but detects only 62% of phishing emails and flags the most benign requests.

Jev Benchmarks & EvaluationsArticle#community#research#arxiv

Community

JevOut: Natural Context Can Flip Decision Models (arXiv 2609.30243)

JevOut shows short background context additions can flip correct decisions in four systems including Jev across seven datasets. Within 64 accepted evaluations per decision, additions redirect 61.4%-73.2% of initially correct decisions toward a wrong option fixed in advance.

Jev Practices & PatternsArticle#community#research#arxiv

Community

xzx34/JevOutPython

Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use (arXiv 2610.04985)

A systematic study of Jev's security and privacy implications using the official API and NanoJev, a local model with controllable training data. It adapts prompt injection, adversarial suffixes, and poisoned training data, runs inference attacks against typed outputs, and maps dual uses.

Jev Practices & PatternsArticle#community#research#arxiv

Community

shihe98/Security_Privacy_JevPython

From the Jev community

Posts from builders shipping with Jev right now.

Follow @typesafeai