Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations

What it is

A paper by Breitinger, Gruber, Hargreaves, Hilgert, Michelet and Scanlon (arXiv 2610.29747v1, 21 October 2026). It treats the LLM in a forensic pipeline as a new target for anti-forensics. The seized evidence is attacker-controlled, and the examiner must read all of it. The fetched text ends partway through the threat model (Sec. 4). The five technique names, the three proof-of-concept attacks and the mitigations are not in it, so this document does not cover them.

How it works

The paper separates three "readers" of evidence: deterministic tools, the human examiner and the model. Each perceives the same content differently, which the authors call the perception gap. Their examples are white-on-white text, which the model reads in extracted text but the examiner does not see, and text rendered as pixels, which a text-only model misses but the examiner sees. The model also often reasons over tool output, and the examiner may see the case only through the model's output.

The paper describes two attack types. One alters what the evidence says, such as a false claim, and carries no instruction. The other embeds an instruction that only the model follows. The paper says current defences miss the first type. DataSentinel, for example, stays silent when no instruction is present.

Preconditions / Affected

Severity depends on the deployment, not on the model. The paper defines four roles:

• R1: natural-language front-end to forensic tools.
• R2: triage and summarisation.
• R3: interpretation, such as timelines and entity linking.
• R4: autonomous agent with tool calling.

Action capability cuts across the roles: read-only, write, delete, execute or network. Four deployment assumptions bound the attack:

• A1: the model works on a working copy. This protects the source but does not stop an agent with network access from exfiltrating derived case data.
• A2: whether a human is in the loop.
• A3: write, execute and egress permissions.
• A4: model provenance and any cross-case memory, which decide whether the effect outlives the case.

Adversary knowledge runs from K1 (none) to K3 (product, model, prompts and workflow known). Commercial forensic products ship the same prompts and workflows to every user, so an attacker can study them offline. A K1 attacker who guesses the product gets close to K3. The page limits this by requiring the version to match.

flowchart TD
    E[Adversarial evidence] --> M[Model reads it]
    M --> C{Action capability?}
    C -->|Read-only| I[Corrupted inference or report]
    C -->|Write, execute, network| A[Action on examiner environment]
    A --> X[Exfiltration, persistence, canary]

What to do

The fetched text gives no mitigations. It implies a review of each deployment's write, execute and network permissions, since these decide whether an injection stays a wrong conclusion or becomes an action on the workstation. It also implies treating the report stage as in scope, because a payload that survives into the report is as damaging as one that corrupts the analysis.

Caveats

• The paper cites a measurement for spotlighting: attack success fell from over 50% to below 2% (Hines et al., 2024). Its authors note a fixed marking scheme can be spoofed once known.
• Thornton (2026) found planted "already audited" comments did not significantly change verdicts for eight code-review models. Content manipulation is therefore not always effective.
• The authors say the three demonstrated attacks are viable only under specific circumstances.