Text on an evidence device can control an AI forensic tool

A team of researchers shows a new attack on digital forensics, the work to find evidence on devices. Tools with a large language model now help the examiner, but the attacker controls the evidence. The team made 3 attacks on an analysis pipeline. They change a result, write content of the attacker to the workstation of the analyst, and cause outbound network traffic.

How it works

The attacker puts text in the evidence. The examiner must read the evidence carefully, and the text goes to the model. The team found a perception gap: the tools, the person and the model see the evidence in different ways.

The results

The team also made a taxonomy, a list of attacks in groups. Each attack has an objective, a method, a payload location and a concealment method. All 3 attacks caused their effect in a proof of concept with only text on the device.

What is not known

The team gave no attack rates and did not name the models. It gives mitigations, but the summary does not show them. No other group tested the results.

Insight: The reader of the evidence cannot avoid the attack

In a public challenge, attacks got through production defenses: 58% for GPT-4o and 47% for GPT-5 mini. The usual rule is to keep untrusted text from the model. In forensics the untrusted text is the work, and this reads as a first move for the attacker. Add checks that do not use the model only.