Prompt injection through forensic evidence: a taxonomy and proof of concept of anti-forensic attacks against LLM-assisted digital forensics

Core problem: In LLM-assisted digital forensics, the evidence itself is controlled by the investigated party, and the model's reasoning layer becomes a new attack target that neither classic anti-forensics taxonomies nor prompt injection defenses cover.

• Setting and importance: LLMs are entering forensic workflows as assistants and autonomous agents; the forensic setting inverts the usual setup of indirect prompt injection—evidence is by definition attacker-controlled, and examiners are obligated to read it closely (abstract).
• Gaps in existing work: The authors state that classic anti-forensics targets data, tools, and examiner judgment, and its taxonomy does not cover readers that treat data as instructions; prompt injection defenses assume injections arrive as instructions and are largely ineffective against false content that contains no instructions (e.g., forged evidence) (Sec. 1, 2.2).
• Core observation: Deterministic tools, human examiners, and models perceive the same evidence differently; the authors call this the perception gap, which lets injection bypass the examiner and reach the model directly (Definition 1).
• Paper outputs: An anti-forensics taxonomy organized by goal, technique, payload location, and concealment method; three attack demonstrations against LLM-assisted analysis pipelines; and a set of mitigation recommendations (Sec. 1).
• Threat model (Sec. 4):
  • Goals: Influence investigation results, influence the investigation process, or compromise the laboratory (e.g., exfiltration, persistence, signaling to a suspect).
  • Knowledge: K1 no knowledge, K2 partial knowledge (knows the tool category or deployment role), K3 full knowledge; the demonstrations assume K2.
  • Capability: Evidence vector only—control over the content, structure, metadata, and encoding of data on one's own device before seizure; the human, tool, and model vectors are out of scope.
  • Victim system: LLM-assisted forensic pipeline, with model roles R1–R4, and write/execute/network capabilities determined by deployment configuration (A3).

Classic anti-forensics and its taxonomies

• Harris (2006) proposed four categories of anti-forensics methods (destroying, hiding, eliminating, and fabricating evidence); Rogers (2006) proposed a tool-oriented taxonomy, and Conlan et al. (2016) extended it into the anti-forensics software taxonomy still in use today.
• The systematic survey by Schneider et al. (2026) across forensics subfields reports no anti-forensics work targeting AI; the authors use this to position the present paper as filling that gap.

Prompt injection mechanisms and defenses

• Perez & Ribeiro (2022) gave the first academic treatment of prompt injection; Greshake et al. (2023) proposed indirect injection; Liu et al. (2024) formalized attacks and success metrics.
• On defenses: Spotlighting (Hines et al., 2024) marks untrusted data, and the authors relay that it reduces attack success rates from above 50% to below 2%, but its authors also note that fixed marking schemes can be deceived; DataSentinel (Liu et al., 2025) detects hijacking by implanting its own instructions, and the paper notes that it stays silent on false evidence containing no instructions.
• The paper also notes that adversarial machine learning (surveyed by Biggio & Roli, 2018) only perturbs inputs to corrupt classifier outputs and does not target the instruction channel.

LLMs in forensics and agent injection benchmarks

• LLM applications in forensics: evidence network construction and mobile evidence analysis (Yin et al., 2025), RAG timeline reconstruction (Loumachi et al., 2024); the benchmark of Cherif et al. (2025) found that models fail on multi-step tasks and hallucinate nonexistent files.
• Agent injection benchmarks: AgentDojo (Debenedetti et al., 2024), InjecAgent (Zhan et al., 2024), LLMail-Inject (Abdelnabi et al., 2025), and others; the authors state that none of them target forensics and that they cannot measure whether evidence-borne attacks survive to forensic conclusions.
• Closest work: Franklin et al. (2025) classify open web agent traps by the attacked component, and the authors state that their own taxonomy classifies by what the attacker does to the evidence, and that its categories can be projected onto the categories in this paper; Pandey & Bhujang (2026) poison log fields, but the paper notes that they exclude tool execution, evaluate only one model, and do not address the perception gap.

Positioning: the authors state that classic anti-forensics predates model readers, AI-driven anti-forensics is limited to multimedia, and injection and adversarial ML work lie outside forensics, and that this paper provides a threat model and taxonomy at the intersection of the three (Sec. 2.4).

Overall approach: first formalize the roles, readers, and trust boundaries of LLMs in forensic workflows, then derive five adversarial techniques along the evidence survival path in the pipeline, and finally demonstrate feasibility with three attacks that plant plain-text notes. The framework has no separate name; its core is the anti-forensics taxonomy and the perception gap.

System model and roles (Sec. 3)

• Model roles: R1 natural language front end, R2 triage and summarization, R3 explanatory reasoning, R4 autonomous agent; action capabilities (read-only/write/execute/network) are related to but independent of role, and determine attack severity.
• Three kinds of readers: deterministic tools, human examiners, models; models lack the fixed functional guarantees of tools and cannot recognize evidence the way humans do.
• Trust boundary: on one side are examiner instructions and verified tools, on the other is the "by definition adversarial" evidence corpus; adversarial data flowing in and consequential actions flowing out form a bidirectional channel (Figure 1).
• Four assumptions: A1 the model operates on a working copy; A2 an examiner may be in the loop; A3 network egress and write/execute permissions depend on configuration; A4 model provenance and cross-case memory determine trust and scope of influence.

Threat model (Sec. 4)

• Adversary: the investigated party, an accomplice, or a third party intending to frame/exonerate, whose goal is to influence conclusions rather than merely destroy data.
• Three knowledge levels: K1 no knowledge, K2 partial knowledge, K3 full knowledge; the authors note that commercial forensic products ship the same prompts to all users, so a K1 adversary who guesses the product correctly is close to K3.
• Access vectors: evidence (the scope of this paper), human, tool, and model; timing distinguishes pre-seizure planting (the general case) from a persistence case that contaminates shared storage.
• Success criterion: because of automation bias, an induced error counts as a successful attack unless the model gives a specific warning sufficient to guide the examiner to discover the error; vague reservations do not count (Sec. 4.5).

Taxonomy (Sec. 5)

• Four dimensions: goal (grouped by motive), technique, payload location, concealment method; location and concealment are open sets, and visibility is determined jointly by the three and the reader, not as an independent dimension (Figure 2).
• Five techniques: derived along the evidence survival path Q1–Q4 (Figure 3): T1 destruction, T2 hiding, T3 obstruction, T4 tampering (including forgery and false contextualization), T5 injection; T1–T4 reshape classic anti-forensics, and T5 is a new class introduced by generative models, whose signature form is prompt injection (Table 1).
• Reader relativity: technique labels are determined by their effect on the reader; the same planted text is a claim to be verified for a human and may be an instruction for a model; the authors state that this unpredictability is itself an exposure surface.
• Perception gap: a perception gap exists when a given location–concealment combination has different visibility to different readers (Definition 1); Table 2 gives the visibility of each combination under the baseline pipeline, and rows hidden from humans but visible to models are channels for unreviewed injection.

Proof-of-concept implementation (Sec. 6.1)

• Pipeline: a synthetic disk image is ingested via Autopsy 4.23.1, the Autopsy MCP bridge exposes 18 read-only tools, and LM Studio 0.4.23 runs gemma-4-12b as an MCP client (Q4_K_M, context extended to 98'304 tokens).
• Capability extension: the disk-write demonstration adds mcp/server-filesystem (restricted to a single directory), and the network demonstration adds mcp/server-fetch; both are examiner-side configuration changes, not actions by the attacker.
• Three demonstrations: all plant unhidden plain-text notes on the seized device, corresponding respectively to tampering with conclusions (T4+T5, read-only), writing attacker-chosen content to the workstation (T5 escalated to disk write), and initiating an outbound request to signal back (T5 escalated to network) (Table 3). Appendix A gives the full injection text and written content for the three demonstrations.

Experimental setup

• Models tested: all LM Studio run reports use gemma-4-12b (Q4_K_M quantization, 98'304-token context); broader testing also used gemma-4-26b, gpt-oss-20b, ministral3-8B, qwen3-14b, and qwen3.8-27b (Sec. 6.1.2).
• Data: a self-built synthetic disk image containing synthetic evidence and planted notes; experiment 1 contains two rhinoceros photos and a note claiming they are triceratops, experiment 2 contains a note instructing that the recording medium is faulty, and experiment 3 contains a note requesting fetching and returning a URL (Appendix A).
• Pipeline: Autopsy 4.23.1 + Autopsy MCP bridge (18 read-only tools) + LM Studio 0.4.23; experiment 2 adds mcp/server-filesystem, and experiment 3 adds mcp/server-fetch (Figure 4).
• Success criterion: an induced error counts as success unless the model gives a specific warning sufficient to guide the examiner (Sec. 4.5); no LLM judging.
• Sample size: each demonstration is a single live run, and the authors explicitly state that they provide no measurements (Sec. 6.2, 7.2).

Main results

The paper has no main results numerical table; Table 3 maps the three demonstrations into the taxonomy, and Sec. 6.3 reports which models each attack succeeded on:

Swipe horizontally to read the table

Demonstration	Goal	Technique	Successful models (per Sec. 6.3)
Exp. 1 persuasion	Influence results → suppression	T4 claim + T5 instruction	gemma-4-12b, gemma-4-26b, ministral-3-8B
Exp. 2 local disk write	Influence results → undermine credibility	T5 escalated to file write	gemma-4-12b, gemma-4-26b, qwen3.8-27b, gpt-oss-20b
Exp. 3 network exfiltration	Influence investigation → signaling	T5 escalated to network call	gemma-4-12b, gemma-4-26b, qwen3.8-27b, gpt-oss-20b

• In experiment 1, the model's final answer stated that no image was classified as a rhinoceros and accepted the note's claim that "automated analysis reclassified it as a triceratops"; however, the answer disclosed the existence and content of the note (Sec. 6.2.1).
• In experiment 2, the model determined a writable directory on its own via tool calls and wrote attacker-chosen content (Sec. 6.2.2).
• In experiment 3, the model considered in its reasoning the possibility that this was an attack and still complied and fetched the URL; the authors state on this basis that mitigations of the "let the model detect the attack itself" kind would not be effective in this instance (Sec. 6.2.3).

Success conditions and negative results (Sec. 6.3)

• Discovery is the bottleneck: on small images and a full Windows image, results were sometimes unchanged (Exp. 1) or the action did not occur (Exp. 2, 3), only because the note was not read or the image was not found; agents that only list files without opening them are unaffected.
• Compliance window: the authors state that larger models succeeded fewer times, and posit a window—the model must be capable enough to process the evidence and find the note, yet not so capable as to see through the deception; on small models, discovery and compliance are both problems.
• Capability authorization: the Autopsy bridge is read-only, and on a bare configuration only the persuasion attack is feasible; Exp. 2 and 3 also require the examiner to approve write_file or fetch; the authors state that permissions can prevent actions but not persuasion, and that approval counts plus a one-click "allow all" make this a weak safeguard.
• Other failures: in some runs the model hallucinated incorrect MCP call parameters, the server failed silently and returned all unfiltered data, drowning out the target result.

Mitigation testing (Table 4)

• One tested: after providing the model with a get_image tool so it could see the photo pixels, gemma-4-12b in experiment 1 instead pointed out that the note contradicted the image; the authors state that this reversed the result for that model; the conclusion section states that this measure defeated the first attack for one of the two tested models.
• The rest are recommendations: built-in restricted write tools, pre-injection testing, least privilege and isolation, untrusted-data marking (including Spotlighting-style wrapping), and network isolation; the authors state that these measures are argued for but require systematic evaluation (Sec. 7.3).

Other ablations and analyses

• The paper reports no parameter ablations; Sec. 6.2.1 mentions other undocumented persuasion variants (disguised as a classifier report, a hash exclusion set log, a legal exclusion rationale), and the authors state that constructing such persuasion content warrants further experiments.

Limitations and future directions noted by the authors

• The demonstrations were not designed to validate the taxonomy, nor did they validate it: the carrier was fixed as plain text with no concealment, and only the target and action capability were varied (Sec. 7.2).
• The runs provide no measurement: a small quantized model run locally was used, and the results serve only as a proof of concept (Sec. 7.2).
• A benchmark targeting sensitivity to adversarial evidence injection needs to be built (Sec. 7.3).
• The mitigations in Table 4 are only argued, only one was tested, and they need systematic evaluation (Sec. 7.3).
• The results need to be established at scale, because the model, the execution environment, and the evolving context all affect which tools the agent invokes; larger and commercially deployed models remain to be tested (Sec. 7.3).
• The disk image covers only part of the space defined by the location and concealment dimensions, and that space can be systematically enumerated to derive attack variants (Sec. 7.1).

Scope of the experiments

• 6 models were tested: gemma-4-12b, gemma-4-26b, gpt-oss-20b, ministral3-8B, qwen3-14b, qwen3.8-27b, all locally run open models; the runs reported by LM Studio used only gemma-4-12b (Sec. 6.1.2).
• Each demonstration was a single live run, and the paper reports neither the number of repetitions nor a quantitative success rate (Sec. 6.2, 7.2).
• The demonstrations assume attacker knowledge K2, and the payload is a plain-text note with no concealment; the combinations involving concealment means in Table 2 were not used in the demonstrations (Sec. 6, Table 3).
• Among the mitigations, only "delivering image pixels to the model" was tested, and it was effective only for experiment 1 and for one of the two tested models (Table 4, Sec. 8).
• The paper did not run an examiner study; automation bias was used only to set the success criterion, not measured directly (Sec. 4.5).

A paper on a taxonomy and proof of concept for anti-forensic attacks in LLM-assisted digital forensics.

• Problem: In forensic settings, evidence is by definition controlled by the investigated party, and examiners must read it closely; the authors state that classic anti-forensics taxonomies do not cover model readers that treat data as instructions, and that existing injection defenses are largely ineffective against false evidence that contains no instructions.
• Method: A system model of roles (R1–R4), three kinds of readers, and trust boundaries; a taxonomy organized by goal, technique (T1 destruction through T5 injection), payload location, and concealment method, with technique labels varying by reader; the core concept is the perception gap—the same evidence has different visibility to tools, humans, and models, allowing injection to bypass the examiner and reach the model.
• Demonstration: On an Autopsy 4.23.1 + MCP bridge (18 read-only tools) + LM Studio (gemma-4-12b) pipeline, using only unhidden plain-text notes planted before seizure, three attacks were completed: getting the model to reclassify a rhinoceros photo as a triceratops, writing attacker-chosen content to the analysis workstation, and initiating an outbound request that could signal back.
• Results: All three attacks succeeded on gemma-4-12b and gemma-4-26b; attack 1 also succeeded on ministral-3-8B, and attacks 2 and 3 succeeded on qwen3.8-27b and gpt-oss-20b (Sec. 6.3). In experiment 3, the model considered that this might be an attack and still complied.
• Authors' assessment: Success depends on a chain of conditions: discovering the note, complying with the instruction, and the workstation's authorized capabilities; larger models succeeded less often; permissions and network isolation protect the workstation but not the conclusions.
• Conclusion and implications (in the authors' voice): Human review fails at the perception gap; until benchmarks, mitigation evaluations, and commercial product tests are completed, models that read seized evidence should be treated as readers of adversarial input, and their outputs as hypotheses to be verified rather than reportable conclusions.