What if the evidence carries instructions?
The model may believe them, but it cannot act on them. Cyberdroid AI Investigation keeps authority in policy and deterministic software, so manipulation can mislead a case but cannot widen a query, add a recipient or approve a task.
Controls
A hostile log.
A planted line can steer the model's reasoning, not its reach. Every query stays read-only.
A forged request.
A claim of authority grants nothing. Your policy decides.
A smuggled command.
Prose maps to a fixed list of intents. Privileged operations are out of reach.
A redirected reply.
Recipients are checked twice. Unattributable replies are quarantined.
A forged approval.
A draft marked approved grants nothing. A separate signer approves.
Limits
Persuasion
No model is immune to persuasion. A persuaded model can still reach a wrong conclusion, so a critic step tests each verdict and a person reviews each case.
Evasion
Behavior that changes slowly can enter a baseline. Findings also compare each entity with its neighbors, and known-threat detection needs no baseline.
Verify
Attempts leave a trace.
Refusals
A refused claim of authority is recorded with its operation id and reason.
Quarantine
A reply that cannot be attributed to an authorized requester is quarantined, not sent.
Standards
Naming a clause is not a claim of certification.
OWASP
LLM01:2025 is prompt injection, and the 2026 agentic list opens with agent goal hijack. The five controls follow both.
EU
Article 15 of the EU AI Act names adversarial examples and model evasion among the threats high-risk systems resist. Limits states where our design stops.
