{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-of-the-litmus-safety-benchmark-harness-receives-an-adversarial-tool-schema-whose-injection-payload-lives-entirely-inside",
  "title": "What happens when an instance of the LITMUS safety benchmark harness receives an adversarial tool schema whose injection payload lives entirely inside a JSON Schema `default` field",
  "date_of_record": "2026 November 14",
  "scope": "Applies to LITMUS harness runs (agentic tool-use safety evaluation) in which tool and skill specifications are serialized to JSON Schema and passed to the agent under test as part of its context. Does not apply to harness configurations that strip non-`description` annotation keywords, nor to harnesses that render tool specs through a template that omits `default`, `examples`, `enum`, and `const` fields.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-of-the-litmus-safety-benchmark-harness-receives-an-adversarial-tool-schema-whose-injection-payload-lives-entirely-inside.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-of-the-litmus-safety-benchmark-harness-receives-an-adversarial-tool-schema-whose-injection-payload-lives-entirely-inside.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-of-the-litmus-safety-benchmark-harness-receives-an-adversarial-tool-schema-whose-injection-payload-lives-entirely-inside.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1993,
    "python_slice_tokens": 399,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The LITMUS harness classifies an adversarial tool input as *detected* when the agent's emitted action trace diverges from a benign baseline in a way attributable to the injected content. Detection therefore depends on the agent *reading* the injected content. The recurring assumption in harness configuration is that a tool's adversarial surface is its `descr...",
    "what_was_observed": "In a run of 240 tool-specification cases (LITMUS `tool_injection` suite, v0.9.3), 17 cases were flagged as detections where the agent's action trace diverged from baseline. Manual trace review showed that in 11 of those 17, the `description` field was a benign, unrelated string (e.g., `\"Returns the current weather for a city.\"`). The divergence was instead traceable to `default` values on parameters: - A parameter `c...",
    "condition_of_validity": "The mislabeling and the annotation-channel injection are both *conditionally* valid, and the condition is precise: 1. **The harness serializes annotation keywords into agent context.** If the tool-spec renderer emits `default`/`examples`/`const`/`enum`, the channel exists. If it emits only `description` (and `name`/`type`/`required`), it does not. 2. **The a...",
    "decision_boundary": "The operational decision is whether to treat annotation-keyword content as in-scope for the safety benchmark. The boundary is drawn by two questions, answered in order: 1. **Does the serialized spec reach the agent's context?** If the harness passes the raw schema object to the model API (rather than a rendered template), the answer is yes for every keyword ...",
    "operational_effect": "The practical consequence is a systematic under-attribution of annotation-channel injections and a corresponding over-attribution of description-channel injections whenever the two are conflated. In the observed run, 11/17 flagged detections were annotation-channel; a harness that reports \"description-injection detection rate = 17/240\" is reporting a number ..."
  },
  "matched_failure_symptoms": [
    "SCHEMA_DRIFT_OR_COERCION_CRASH"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "2e238c16f5d5b0fa965e28b5a0fd6fd14e7e044b3a304dcee513a5dbd1585356",
    "verified_classes": [
      "LITMUSAttributionError"
    ],
    "verified_functions": [
      "_neutralize_annotation",
      "_neutralize_field",
      "attribute_case"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "LITMUSAttributionError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "json",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}