Injected text can flip Jev's decisions: what a new preprint found

A decision model can return an answer in a perfectly valid format and still get it wrong if someone steers it there. A preprint by seven authors from Chinese research institutions, published on arXiv on 13 October 2026, examines how often a program decision in real applications built on Jev can be flipped just by changing text that reaches the model from outside. The attacker does not change the application code, the internal questions or the model itself. S49 This is a preprint that has not yet gone through peer review. Anyone who sends reviews, customer messages or feed texts to Jev is directly affected by the topic.

What the authors call decision hijacking

The authors named the phenomenon Jev Program Decision Hijacking. The attacker modifies some of the lower-trust external fields that end up in a question for Jev. The model then returns an answer that formally matches the schema, meaning a valid yes/no value, category, score or confidence, but the program acts on it differently than it should have. S49 Under the threat model, the attacker only knows the public behaviour of the application and the content they control. They need neither the source code nor the internal instructions. S49

How the research was done

The authors collected 1,711 unique candidate repositories from GitHub. They inspected the 356 with the most stars and flagged 228 of them as potentially vulnerable. S49 To find attacks, they built a tool called JevProbe. It traces in the code where the data passed to a Jev call comes from, checks that outside text really gets there, and then tries variants of injected content. The variants were generated by the Qwen3-32B model and used, for example, a fabricated approval, fake tool output or a reframed scenario. S49 The target version was jev-1.13.0. The experiments ran in an isolated local environment, without live systems and without real user data. S49

Eight out of ten attempts succeeded

Of 2,273 tested cases, the decision flipped in 1,853, or 81.5%. S49 As many as 202 of 228 applications had a flip rate of at least 80%, and for 16 applications it was 100%. S49 The authors classified 98.6% of the flipped decisions as potentially unsafe. The largest group, 92.5% of them, was information contamination. S49 They were assisted in assessing the impact by the language model Gemma-3-27B-IT, which they themselves list among the limitations. S49

The case of the TradingAgents application shows why a confidence threshold alone is not enough. When judging the trustworthiness of financial information, confidence dropped after the attack from 0.65 to 0.27, below the 0.5 gate, and the application rejected the information instead of accepting it. S49 The attack thus moved exactly the value the code relied on to decide.

Other models and the defences tried

The authors also ran the same attacks against other models, plugged into the applications through an adapter in place of Jev. In the comparison set of ten applications, Jev had a flip rate of 79.8%, while the other tested models ranged from 50.7% to 66.8%. S49 The authors point out that the adapter does not match each model's native configuration. S49

Existing defences helped little. Without a defence, 78.7% of decisions in this set flipped. The most effective method tried, which wraps external text in delimiters (Spotlighting-Delimit), lowered the rate to 68.9%, a drop of 9.8 percentage points. Rewording the input with a paraphrase, by contrast, slightly raised the rate to 79.8%. S49 For Jev without a defence, the preprint gives slightly different values in two places, 78.7% and 79.8%. S49 The authors did not test defences inside the model, because neither Jev's architecture nor its parameters are public. S49

Limits of the study

Only open source applications from GitHub were studied, and the results apply to specific revisions and configurations at the time of the experiments. S49 The cases described do not include online shops or reviews. The authors list categories such as financial decision-making, enforcement of access rules, content processing, service control, agent routing and externally visible actions. S49 They reported the findings to the application maintainers and had not yet received responses at the time of publication. They released the tool's code and the dataset on GitHub. S49 JEV.sk did not measure any of this.

What this means for a Slovak online shop

The TypeSafe documentation advises keeping program control in code, matching confidence thresholds to the risk of each specific action, and sending uncertain cases to a person or a more expensive model. S50 However, this page does not address attacks through input or untrusted text. S50

JEV.sk's own suggestion: an online shop often sends text written by an outsider into state, such as a review, a message about a return claim, an order note or a description from a supplier feed. Such text should be treated as potentially hostile. A Jev decision about it should not on its own trigger a refund, the publication of a review containing a link, or a price change. Since the TradingAgents case shows that an attack also moves confidence, a threshold is not enough as the only safeguard. Leave sensitive steps to rules in code and to a person. Clearly delimit external text, even though according to the preprint this helps only partially, and add injected inputs such as "approved by the security team" to your test set. The guide security and privacy offers a broader view of the risks, and confidence and calibration describes how to choose thresholds.