Schema-valid judgements let attackers hijack app decisions
Reviewing Nudge the Judge: Uncovering Program Decision Hijacking in Real-World Jev Applications · Yang Luo, Tiantian Ji, Zifeng Kang et al.
Researchers show that attacker-written input can push a judgement model into returning perfectly formatted but wrong verdicts, flipping the decisions that application code acts on. Most tested open-source applications were affected, and standard prompt-injection defences barely helped, because the schema checks the shape of an answer rather than whether it is true.
A ticket arrives. A model reads it and returns a tidy verdict: urgent or not, safe or not, a risk score out of ten. The program reads that field and acts. Now suppose the ticket was written to make the model return the wrong verdict, in exactly the right format. Nothing breaks. The decision simply changes.
That is the attack in a new study of applications built on Jev, a model designed to turn open-ended text into structured judgements that code consumes directly. The researchers call it decision hijacking. I would call it prompt injection with a better aim.
The design is meant to be safe because of the schema. The developer defines the allowed outputs: a Boolean, one of a few categories, or a number compared against a threshold. Anything malformed is rejected, so the model cannot smuggle out free text. That constraint is real. It is also beside the point, because the attacker never needs a malformed answer. They need a valid one that is wrong.
The researchers built a tool to test this end to end. It finds inputs an attacker could actually reach, then rewrites them while keeping the facts and input constraints intact. It runs the program with the clean and altered input and checks whether the decision the code acts on changed. Then it follows what the program did next.
Across more than two thousand test cases, roughly four in five decisions flipped. Almost every flip led to a potentially unsafe outcome. The most common was information contamination: bad data written somewhere that later steps, or later model calls, would trust. Others included suppressed risk alerts, bypassed validation and changed access decisions. The most popular projects fared no better. What surprised me is that the purpose-built judgement model flipped more often than the general-purpose models it was compared against.
The defences are where I am least surprised. The researchers tried standard prompt-injection mitigations. The best, which wraps untrusted text in delimiters, cut the flip rate from about 79% to 69%. Paraphrasing the input made things worse. These defences assume the attacker is issuing instructions. Here the attacker is arguing a case.
The limits are clear. Everything was open source and tested locally, not against live production systems. The impact labels describe what could go wrong under the tested configurations, not measured harm. The attacker also needs a path to put text in front of the model. But an application that judges outside content exists to read exactly that kind of text.
If a model's verdict gates something that matters, treat it as untrusted input rather than a decision, and check it against something the attacker cannot write. A schema checks the shape of the answer. It cannot check whether the answer is true.
Further analysis
Problem
This paper studies Jev Program Decision Hijacking (JPDH), a novel end-to-end security risk in applications that use System One models (Jev). Jev maps open-ended semantic contexts into schema-constrained, structured judgements that are consumed directly by programme logic. An attacker who can control lower-trust external context can craft inputs that remain schema-valid yet change the model-produced judgements in ways that flip application decisions without changing code or decision logic. The paper argues that prior work focused on model-level leaks or prompt tricks, leaving reachability, program-level decision integrity and downstream security consequences in real-world Jev deployments underexplored.
Approach
The authors develop JevProbe, an automated, programme-grounded evaluation framework that traces adversarial influence from reachable attacker-controlled context surfaces through Jev judgements to downstream consequences. JevProbe has four stages: discover and validate reachable input surfaces by tracing data flows; generate application-aware adversarial context variants while preserving input constraints and task facts; detect decision hijacking via paired differential execution and interpretation of programme-consumed decisions (Boolean, categorical and thresholded numeric decisions); and assess downstream security impact by tracing behavioural divergence against application-specific safety rules. The evaluation used 1,711 candidate GitHub repositories, analysed 228 real-world Jev applications and 2,273 programme-grounded test cases. Metrics reported include Decision Flip Rate (DFR) and Unsafe Impact Rate (UIR). The authors also release JevProbeBench, a benchmark of 2,273 cases that preserves the context-to-decision chain for reproducible testing, and publish JevProbe source code and the benchmark on GitHub.
Key Findings
- High prevalence of decision flips: Across 2,273 test cases, 1,853 (81.5%) exhibited programme-consumed decision flips when attacker-controlled context was manipulated.
- Downstream security impacts are common: Of the decision flips, 1,827 (98.6%) were classified as potentially unsafe under the authors' impact-assessment protocol; information contamination accounted for 92.5% of unsafe cases.
- Effectiveness versus baselines: JevProbe improved macro-average Decision Flip Rate by 50.4 percentage points compared with the strongest adapted baseline, achieving a macro-average DFR of 79.8% on the shared subset of applications.
- Model susceptibility: The Jev judgement model (jev-1.13.0) showed higher macro-average DFR than eight general-purpose LLMs and two closed-source models under the evaluated Jev-targeted attacks; susceptibility varied by application and model.
- Defence limitations: Evaluated prompt-injection style defences offered limited protection; the largest reduction in DFR (Spotlighting-Delimit) lowered DFR from 78.7% to 68.9%, while other measures yielded smaller effects and some (paraphrasing) increased DFR.
- Popular projects affected: Even highly starred repositories were vulnerable; the eight applications with at least 10,000 GitHub stars showed a DFR of 97.5%.
Limitations
The study is limited to open-source Jev applications on GitHub and controlled local test environments; closed-source or live production systems were excluded. Model-internal defences and Jev internal parameters were not evaluated. Impact labels reflect potential unsafe outcomes observed under the evaluated revisions and configurations rather than measured real-world harm.
Implications
An attacker able to modify external inputs that reach Jev judgements can systematically flip decisions that govern routing, access control, alerting, data retention and financial choices without altering code. Such flips can suppress risk alerts, bypass validation, contaminate downstream data, change access decisions, or induce unsafe automated actions and feedback loops that persist malicious content into later contexts. Because existing prompt-injection mitigations offer limited protection in this setting, adversaries can exploit the context-to-decision boundary to achieve impactful, stealthy manipulations across many real-world Jev applications.
The paper title, authors and abstract
Nudge the Judge: Uncovering Program Decision Hijacking in Real-World Jev Applications
System One models such as Jev change how software makes decisions by mapping open-ended semantic contexts into structured judgments that directly drive program execution. However, this paradigm introduces a new security risk, which we term Jev Program Decision Hijacking (JPDH): attacker-controlled contexts can redirect program decisions through schema-valid Jev judgments. Existing evaluations focus primarily on model-level attacks or predefined injection channels, leaving attack reachability and downstream security consequences in real-world Jev applications underexplored. In this paper, we present JevProbe, the first automated framework to evaluate JPDH by tracing adversarial influence from reachable context surfaces through program-consumed decisions to downstream security consequences in real-world Jev applications. Our key insight is that application logic maps diverse Jev judgments to observable decisions, enabling systematic, program-grounded attack evaluation. Across 228 popular real-world Jev applications and 2,273 test cases, 81.5% exhibit decision flips, of which 98.6% lead to potential downstream security impacts. Compared with the strongest adapted baseline, JevProbe improves macro-average Decision Flip Rate (DFR) by 50.4 percentage points, while existing defenses offer limited protection. We further construct JevProbeBench to support systematic evaluation of JPDH in real-world Jev applications. We have responsibly disclosed our findings to Jev application maintainers, pending their responses. The source code of JevProbe and the JevProbeBench dataset are publicly available on GitHub (https://github.com/xiaoxiaohg8d/JevProbe-).
