feat(trace): add ContextInjectionDetector with 14 tests - #572
Open
stealthwhizz wants to merge 10 commits into
Open
feat(trace): add ContextInjectionDetector with 14 tests#572stealthwhizz wants to merge 10 commits into
stealthwhizz wants to merge 10 commits into
Conversation
Adds StepSpec dataclass and SequenceDetector base structure to finbot/ctf/detectors/primitives/. Includes config validation, get_relevant_event_types(), and stubbed private helpers for history querying, step matching, and time-window checks. check_event() and all helpers are NotImplementedError stubs pending implementation.
…gration - Add SequenceDetector to finbot/ctf/detectors/primitives/ Detects multi-step attack patterns across a session or workflow window. Supports ordered step matching, glob event_type patterns, within_n_events and within_seconds windows, and all ToolCallDetector field operators. Challenge authors configure it from YAML with no Python required. - Add composite index idx_ctf_event_session_ts_type on (session_id, timestamp, event_type) to keep session-window history queries below 10ms p95. - Export SequenceDetector from finbot/ctf/detectors/primitives/__init__.py - Add 17 unit tests covering full sequence detection, partial sequences, order enforcement, session/workflow windows, condition operators, and glob event_type matching.
- Add StepSpec TypedDict to sequence_detector.py matching the approved interface spec; export it from primitives __init__ - Add benchmark test: seeds 1,000 CTFEvent rows with composite index, runs check_event 100 times, asserts p95 < 10ms Current result: p50 ~7ms, p95 ~8ms on SQLite
…, and tests - IncrementalFraudDetector uses SequenceDetector as the matching engine; two-gate design: N below-threshold approvals in session window, then cumulative amount check fires when total >= cumulative_threshold - incremental_fraud.yaml: 300pts, ASI-08, fraud category; default config: 3 approvals each <= 9999, cumulative >= 25000 - Extend _emit_delegation_event() in orchestrator.py with context_preview field (first 500 chars of enriched context forwarded between agents) - Emit delegation.context_snapshot business event on every delegation hop making context forwarding observable and scoreable by detectors - Integration tests for IncrementalFraudDetector: full chain, 5-step sequence, session isolation, amount gates, rejection filtering - Unit tests for Delegation Audit: context capture, preview capping, event type validation, empty context handling
…_load_amounts
- sequence_detector.py: change re.search to re.fullmatch in the matches
operator so patterns must match the full value, not a substring.
re.search allowed conditions like {"matches": "approval"} to falsely
match "not_approval" or "partial_approval_pending".
- sequence_detector.py: apply all prior review fixes from PR GenAI-Security-Project#522 —
ANDed condition operators, contains case-normalisation, _CTF_COLUMNS
as module-level constant, consumed set for order_matters=False, else
clause for unknown operators.
- incremental_fraud.py: add namespace parameter to _load_amounts and
filter CTFEvent.namespace == namespace in the query. Guards against
cross-namespace amount loading after DB restores or migrations.
Detects lateral movement through agent context propagation:
- Gate 1: delegation.context_snapshot with PI score >= threshold (LLM judge)
- Gate 2: tool call in same workflow_id (receiving agent acted)
- Namespace-isolated, target_agent filter, configurable via YAML
- 14 unit tests covering all gates, filters, and edge cases
OWASP: ASI-01 (Goal Hijack), ASI-06 (Memory & Context Poisoning),
ASI-07 (Insecure Inter-Agent Communication)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds ContextInjectionDetector, which correlates a delegation.context_snapshot event whose context_preview matches known prompt-injection patterns with a subsequent tool call (within the same workflow_id) that matches the injected directive. Both signals must be present before it fires, keeping false positives low without an ML model — this is the first detector that can score multi-step lateral movement through context propagation between agents.
Test plan