{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_3135279067863972bc2286c94adfae652204c7255ae71c08ea3ff88ba150e2cd","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_3135279067863972bc2286c94adfae652204c7255ae71c08ea3ff88ba150e2cd","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"32ec5878305b651db4ef234e2c89b7f32de86c6cc349cbcd1f81cf875a6725ba","published":"Tue, 09 Jun 2026 00:00:00 -0400","receipt_hash":"32ec5878305b651db4ef234e2c89b7f32de86c6cc349cbcd1f81cf875a6725ba","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"32ec5878305b651db4ef234e2c89b7f32de86c6cc349cbcd1f81cf875a6725ba","observed_at":"2026-06-09T04:43:45.619596Z","parent_run_hash":"f2344865fd128464efd1bacba326b5a7ccea707694b8c5650dd51ae8c46ac8a1","published":"Tue, 09 Jun 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2606.08403v1 Announce Type: cross \nAbstract: Text-centered prompt-injection defenses assume that the malicious signal is visible in one of the inspected text views. We study a reproducible LLM01-style indirect prompt/content-injection failure mode where that assumption breaks: a payload caught in plain English slips past the same detector when it is transported as structured float parameters and reconstructed only as fragmented telemetry. Across 14,400 attacked real-model trials on three commercial LLM APIs from different providers, the IFS-derived float-array carrier preserves 94.3% leakage ASR under the strongest dual-layer text-classifier defense evaluated in the main matrix: a Prompt Guard 2 + TF-IDF ensemble; the same carrier-level pattern also replicates with a fine-tuned roberta-base detector. We emphasize leakage ASR because downstream systems may act on quoted or reproduced markers even when the model refuses, but Strong ASR is the stricter metric for structurally compli","title":"Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection","url":"https://arxiv.org/abs/2606.08403","vendor":"arxiv_cs_ai"},"summary":"arXiv:2606.08403v1 Announce Type: cross \nAbstract: Text-centered prompt-injection defenses assume that the malicious signal is visible in one of the inspected text views. We study a reproducible LLM01-style indirect prompt/content-injection failure mode where that assumption breaks: a payload caught in plain English slips past the same detector when it is transported as structured float parameters and reconstructed only as fragmented telemetry. Across 14,400 attacked real-model trials on three commercial LLM APIs from different providers, the IFS-derived float-array carrier preserves 94.3% leakage ASR under the strongest dual-layer text-classifier defense evaluated in the main matrix: a Prompt Guard 2 + TF-IDF ensemble; the same carrier-level pattern also replicates with a fine-tuned roberta-base detector. We emphasize leakage ASR because downstream systems may act on quoted or reproduced markers even when the model refuses, but Strong ASR is the stricter metric for structurally compli","title":"Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-06-09T04:43:45Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2606.08403"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:bfe7022ef76a3aafe8e9947f52495fb2fb43d57551c39f815c26148781930bf60a23505c87448aa25a545b5ca6c5519b2c2d425108621ce9b16ad8859565ec0b","signer":"crovia.substrate","subject":{"observed_at":"2026-06-09T04:43:45Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2606.08403"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"10d3e77de59265901cd00e89dacb79ae7f4c6fb0349a6401a4c135b0297f750c","leaf_index":224278,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"a1d1aef840a06d3ba4eb39031cfa9e78cc2720a20b35fdf63fbf78c42021634b","side":"right"},{"sibling":"3ce41ca9d8ce810d506cc816cad6687a0f941000aa74c5564af714b899df7aba","side":"left"},{"sibling":"bbb5fa6ca474e2821c9a570ed9eb2098a36a2904f5f5690fcbd012f9b4629332","side":"left"},{"sibling":"c2796d2599030c9a23a2855a5969633a40889df226deaf7553218b53f91de2f5","side":"right"},{"sibling":"17cc882716437eac1f6944fae18d269b64ba5acbe30a0692708bcf3656bafb3c","side":"left"},{"sibling":"cc5dc839fc154bb41d7f26e948014fef6bdcf986d9f6641656b9d5bb1ee81e36","side":"right"},{"sibling":"8c9ff4557f20a07dd8bab815d109622b303ec955df35139712363b2e633da7de","side":"right"},{"sibling":"6aee4d57225362b2670992e69503217771be95795abcdc0a9d9022571196aa2b","side":"right"},{"sibling":"f6fb234a4e2f067b22329eec05b093a8b38f0411de9434d5a8eb55c2f70f1a2f","side":"right"},{"sibling":"b2df6a4bb3e928f0b447931cc688ae01d2415773a2b07cfed0b1cba689078aed","side":"right"},{"sibling":"b1c9ec856caa0fd46bb47b46f18c59ebcd295d774ca17adb3b46f05d394a6a5d","side":"left"},{"sibling":"24fdc29d461691aedb6fa920758206b5bb43851f477ef7a04c34aaed84b8971b","side":"left"},{"sibling":"036922da4e1e2c46d948f070454bfad299b7406fb00735ea9d8bd1e687f5f445","side":"right"},{"sibling":"533d82482604463aa4a281b9d8b85917b383b7c5f924b2b494039524c55e8797","side":"left"},{"sibling":"b2590791b920ca2a4ed39de126d2c0b1a10d9e7e62f572f12425f214e767b6e1","side":"left"},{"sibling":"87c6b850dfec08ac35a693d9db3a3315250a68adb1cfab9b1015f212b63b15bd","side":"right"},{"sibling":"c300cf0154c136afc09b1702a0be98f4ba5b6dc5cf57e8cc714ec1eaf4196eff","side":"left"},{"sibling":"d841ad93efda0869e5eb97678f348f03f5caab4353e05ff4bf18f47fb945b822","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":224761,"merkle_root":"e9f7b49b652e869ab97ffba9c5a31356b2d0e3dc5d00bb28944adf737c46b1e7","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260609T103805Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-06-09T14:15:34Z","sig_algorithm":"ed25519","signature":"8ad8076fb12c8e486ae1d1559a9a7ba8e2ee996a9ad3d8ba7bcdbdbd88ab3a15bcb429707aca6d3e9d8b97e2ba755b3dcc77b1abb6601ccb829842719a6fb30d","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_3135279067863972bc2286c94adfae652204c7255ae71c08ea3ff88ba150e2cd"}}