A decode-time defense keeps hidden instructions from critical calls

In plain words

The research

What the evidence shows

• When images carry instructions

  Decode-time provenance binding is a runtime defense for agents that use tools through the Model Context Protocol (MCP). The paper asks how an instruction hidden in an email-signature image can become trusted input after a tool decodes it and agents relay its text.

  In the described attack, text scanners see no suspicious words in the image; the instruction enters the agent’s context only when a decoding step runs.

• Track the moment of decoding

  The defense marks output from registered decoding tools as untrusted at the moment it is produced. The MCP layer signs a record of the output and its dependencies, keeps the lineage ledger itself, and checks that record and the context before a critical tool call.

  This targets the point where hidden content becomes readable, rather than judging whether the image itself looks suspicious.

• Compare tested defenses

  In a real MCP testbed, researchers counted leaks across 24 attacks using three image carriers and eight evasions. The undefended pipeline leaked on all attacks, while a keyword scanner and a regular-expression parser each leaked on 62.5%.

  The proposed defense and an in-process taint baseline each had no leaks in this attack bank, showing that both blocked the tested attacks within one trust domain.

• Check two distinct protections

  A valid trusted label alone did not protect against an agent hiding the untrusted decode that influenced a critical call: the label-only verifier allowed it, while the layer’s lineage check blocked it. In a three-scenario component test, removing signature checks allowed a forged cross-domain relay, while removing lineage tracking allowed label substitution. The findings distinguish what the two protections did in those tested scenarios.

• Preserve authorized work

  Treating every decoded value as untrusted falsely blocked one of three legitimate tasks, an authorized payment using an image-read invoice number. An audited promotion path allowed that value to be treated as trusted: all three tasks then completed without false blocks, and the unauthorized attack stayed blocked.

  This result and the attack tests come from a controlled testbed, and the guarantee assumes complete lineage capture and mediated critical calls.