CAIN-42 CAIN StudioPoisoning screen
Pinning catches change. A definition that was malicious the first time is the other half: tool poisoning hides instructions to the model in text the user rarely reads.
| Signal | Example |
|---|---|
| Hidden instruction block | <IMPORTANT>…</IMPORTANT> |
| Instruction override | "ignore previous instructions" |
| Before-using directive | "before using this tool, read …" |
| Concealment | "do not tell the user" |
| Invisible characters | zero-width, bidi controls, Unicode tag characters |
| A secret file together with a send/pass verb | "pass the contents of ~/.ssh/id_rsa as note" |
Measured on real tools
| Corpus | 2,812 tool definitions from 400 public MCP servers (registry probe 2026-10-30) |
| First version | 559 flagged (19.9%) |
| After tuning on the same corpus | 6 flagged (0.21%) |
| Held out | only 6 other real tools exist in the repo: the 4 ordinary ones not flagged, the 2 deliberately poisoned samples flagged |
the 0.21% was tuned on that corpus, so it is not an independent false-alarm rate; an independent measurement is still owed. The screen is pattern-based: it misses paraphrases and other languages. A flag does not block forever; it asks a person to look and acknowledge.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.