Evidence-borne prompt injection in LLM-assisted textual evidence triage

Abstract

Large language models (LLMs) are increasingly used to support forensic triage and classification over natural-language evidence such as emails, SMS messages, and notes. This study presents a controlled first measurement of a new attack surface in LLM-assisted evidence triage, in which the evidence being analyzed can itself contain natural-language instructions that steer the model's forensic judgment. We define this threat as evidence-borne prompt injection, a form of indirect prompt injection in which the injection is delivered through the evidence itself, and characterize it as an interpretation-layer anti-forensic attack surface in LLM-assisted textual evidence triage. To evaluate this threat, we construct a controlled synthetic benchmark of 300 clean messaging evidence items and 9000 injection-augmented variants. The analyzer performs structured forensic triage over suspicion label, risk level, and issue type. Our results show that the GPT-4o-based analyzer achieves near-perfect suspicion-label accuracy on the clean benchmark, but outputs the attacker-targeted suspicion label in 31.3% of injected cases. The attack is highly asymmetric. False-positive injection from normal to suspicious evidence succeeds in 54.1% of cases, whereas evasion from suspicious to normal succeeds in 8.5%. We also show that a simple black-box prompt defense that treats evidence as untrusted data reduces attack success rate (ASR) from 31.3% to 0.6% without degrading clean suspicion-label accuracy. These findings show that textual evidence in LLM-assisted forensic pipelines is not only an object of analysis, but also a potential instruction carrier that can distort forensic triage outcomes.