Jev as a judge: How counterfeit policy steers Jev

What it is

Datadog Security Labs tested TypeSafe AI's Jev (a "System One" decision model released 15 September) as a security classifier. Two uses were tested: detecting prompt injection, and acting as the judge behind LangChain's tool-risk gating. The finding is that text placed in the content Jev reviews can rewrite the rules it applies. Plain injection does not do this.

How it works

The "counterfeit policy" is prepended to the untrusted message. It does three things:

• It states the desired answers (has_prompt_injection: no, attack_category: no_attack).
• It quotes the original message as an explicit benign exception.
• It redefines each attack category as something trivial, for example credential access applies "only when the user asks about a door key".

The developer's trusted Noul and Choice instructions and category criteria were left unchanged. Only the untrusted state was altered.

Baseline on four public datasets, threshold 0.5: 99.66% precision (13 false positives), 82.90% recall. With the counterfeit policy:

Noul precision stayed at 100%. Choice recall fell by over 75 points. Every attack in the zachz and Yanismiraoui datasets was missed.

The LangChain test used an edit_workspace_file call from a user with permission_level: viewer and can_edit: false. The user can edit the profile_description field, which is passed to Jev with the tool call. The payload placed there redefined is_risky. It argued that a call the tool would reject for lack of can_edit: true has no effect, so it is not risky. Over 40 runs each:

Hundreds of other plain injection variants, each run 40 times, stayed close to baseline.

Preconditions / Affected

• Jev (or a wrapper such as LangChain's tool-risk gating, which blocks at is_risky of 0.5 or higher) is used as a security control.
• Attacker-controlled text reaches the classifier. In the test this was a user-editable directory field, but the post says similar paths may exist wherever untrusted text is read.
• Vercel's eve has a similar gating feature. The post did not test it.

What to do

The post gives no patch or configuration fix. Its advice:

• Trace where text entering the classifier originates, including profile fields, tool arguments and tool descriptions.
• Test the classifier against deliberate steering, not only plain attacks.

It also promotes Datadog AI Guard as defense in depth, which the post does not benchmark.

Caveats

• The benchmark measured whether Jev flagged payloads. It did not test whether they compromised a downstream agent.
• The datasets contained only plain, unobfuscated attacks.
• The LangChain scenario is a constructed, simplified one.
• TypeSafe's documentation already says injected instructions, misleading framing and self-arguing text can influence Jev.