Speakers: Bogdan Stelee, Arnav Garg · Source: DEF CON 34 talk page
📄 Download this note as Markdown
Overview
Finding one prompt injection isn’t the end goal; checking how many variants still bypass your safeguarding layers is the new target. This talk introduces MPG, an XPIA mutation framework that generates adversarial payload variants and tests them across agentic AI systems to expose hidden vulnerability surfaces and emerging data exfiltration risks.
Notes
Convergent Search
- TAP, PAIR, GPTFuzzer — find a successful jailbreak
Mutated Prompt Generator (MPG) Framework
- Input: unconfirmed UPIA/IPIA seed playlist. Output: map of residual exploitable surface.
- Goals: breach the variant space, gate mutation by token-segment classification, score outcomes by subtree viability
Use Cases
- Attack surface exploration and edge-case discovery — was a mitigation actually enough, or are there uncovered edge cases?
- Usable defensively, before release or as patch validation on an AI feature
Indirect Prompt Injection (IPIA)
- Tokens are segmented to hide malicious prompt instructions
- Semantically-aware mutation classifies attack vs. benign operations, then mutates each appropriately, sequenced so the attack instructions land in the right place
- The framework includes an evaluation layer, then an execution layer to measure breadth and viability
Tool
- Built a Playwright browser tool to carry out the above steps
- Initial prompt should be blocked if patched; mutations are then tested and evaluated pass/fail
- Subtree viability algorithm checks how many times a bypass succeeds once one is found
Filed Under: #defcon34