CommunityJev Practices & Patterns
Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions (arXiv 2609.28613)
An evaluation of prompt injection against Jev's typed probabilistic decisions using 510 reconstructed InjecAgent cases. Malicious content shifts action probabilities but rarely flips Jev to the attacker's target; score-feedback attacks raise fresh-run success from 1.8% to 3.5%.
- Format
- Article
- Published by
- Community
- Last verified
- Oct 2026
Highlights
- Rebuilds 510 InjecAgent cases to test injection against Jev's schema-defined action probabilities.
- Malicious content shifted action probabilities but rarely made Jev select the attacker's target.
- Override markers reduced the influence of malicious content, while contextual-relatedness claims had small effects.
- Adaptive attacks using score feedback doubled the mean highest attacker-target probability during optimization.
- Success on fresh validation calls rose from 1.8% to 3.5%, linked to small decision margins or attacker control.
Watch out
arXiv preprint posted September 23, 2026 (cs.CR, cs.AI) by Tiantong Wu and Wei Yang Bryan Lim. Results come from 510 reconstructed InjecAgent cases against one non-generative decision model; adaptive gains are measured on fresh validation calls, and the abstract reports no defenses tested beyond override markers.
Questions about this entry
Short answers drawn from the linked project or page.
Most prompt-injection studies focus on generative agents, leaving unclear how injection affects models with schema-defined outputs; the paper examines that gap in Jev.
The authors rebuilt 510 cases from InjecAgent to test how malicious content influences Jev's action probabilities and its choices among allowed actions.
Malicious content shifts action probabilities but rarely causes Jev to select the attacker's target, according to the baseline experiments in the paper.
Override markers reduced the influence of malicious content, while claims of contextual relatedness had only small effects on Jev's typed decisions.
Adaptive attacks using score feedback doubled the mean highest attacker-target probability during optimization, and success on fresh validation calls rose from 1.8% to 3.5%.
Exploratory analysis links successes to small initial decision margins or greater attacker control over the observation, rather than to the content alone.
Schema-defined outputs change but do not eliminate prompt-injection risk, so the authors argue evaluations should measure how untrusted content influences choices within the allowed action set.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsHacker News: Show HN: Agent Chaperone screens tool calls and results with Jev before the agent sees them.
sepehrsafari5 pointsShow HN: Agent Chaperone – Screen AI agent tool calls and results with JevRead the thread on Hacker NewsX: Secret detection with Jev, tested
More Jev resources like this
0GitHub stars
A systematic study of Jev's security and privacy implications using the official API and NanoJev, a local model with controllable training data. It adapts prompt injection, adversarial suffixes, and poisoned training data, runs inference attacks against typed outputs, and maps dual uses.
Jev Practices & PatternsArticle#community#research#arxiv
Community
shihe98/Security_Privacy_JevPython
shihe98/Security_Privacy_JevPythonJevOut shows short background context additions can flip correct decisions in four systems including Jev across seven datasets. Within 64 accepted evaluations per decision, additions redirect 61.4%-73.2% of initially correct decisions toward a wrong option fixed in advance.
Jev Practices & PatternsArticle#community#research#arxiv
Community
xzx34/JevOutPython
xzx34/JevOutPython2GitHub stars
An automated framework that traces adversarial context through Jev-backed program decisions to downstream effects. Across 228 real-world Jev applications and 2,273 test cases, 81.5% show decision flips, 98.6% with potential security impact, and Decision Flip Rate beats the strongest baseline by 50.4 points.
Jev Benchmarks & EvaluationsArticle#community#research#arxiv
Community
xiaoxiaohg8d/JevProbe-Python
xiaoxiaohg8d/JevProbe-PythonA controlled adversarial comparison of Jev against five GPT and GLM judges and two local classifiers under identical payloads and policies. Jev is the most robust on input moderation and the fastest overall, but detects only 62% of phishing emails and flags the most benign requests.
Jev Benchmarks & EvaluationsArticle#community#research#arxiv
Community
A position and case-study paper on using System One decision models like Jev and the open-source Laya as decision layers in LLM-driven penetration-testing harnesses. It names four decision points, runs an exploratory 13-vulnerability NeuroSploit comparison, and proposes Rave, an unevaluated model.
Jev Practices & PatternsArticle#community#research#arxiv
Community
A paired, self-audited evaluation of an open-weight (Laya) and a hosted (Jev) System-1 decision model on 11 agent decision points: 7,283 base cases plus 6,640 robustness variants. Jev is significantly more accurate on 9 of 11 decision points, by 10.8 to 46.0 points.
Jev Benchmarks & EvaluationsArticle#community#research#arxiv
Community
David-DL-Space/sys1-evalJavaScript
David-DL-Space/sys1-evalJavaScriptFrom the Jev guides
Original write-ups on what this entry is for.
A decision model cannot be talked into generating text, but the label is still a target. Why narrow, literal questions resist injection and why keeping the act in code is the real backstop.
Jev Practices & Patterns#guardrails#security#prompt-injection
Read article
More than eighty preprints now evaluate, attack, and reproduce the typed-decision class. The broadest board, the coherence gap, the rejection bottleneck, and the attacks that still work.
Jev Practices & Patterns#research#evaluation#calibration
Read article
A Choice can only pick from its options. How rejection options, candidate coverage, and escalation bands keep a narrow taxonomy honest under inputs it never anticipated.
Jev Practices & Patterns#rejection#confidence#patterns
Read article
From the Jev community
Posts from builders shipping with Jev right now.