First-hand information for everyone
LLM‑assisted digital forensics makes the model’s internal reasoning a new target for attackers. The authors report a perception gap: deterministic tools, the human examiner, and the model can read the same evidence but interpret it differently. That gap can let manipulations reach the model unseen by the examiner (F1).
The paper proposes a faceted taxonomy for anti‑forensic attacks carried through adversarial evidence. An attack is described by four attacker choices: objective, technique, payload location, and concealment method (F2, F3). The taxonomy defines five techniques: destruction, hiding, obstruction, modification (fabrication or misleading claims), and injection (content that acts on the reader, e.g., prompt injection) (F4).
The authors model how LLMs are used in workflows. They list four LLM roles of increasing autonomy (from a natural‑language front end to an autonomous agent) and four deployment assumptions (working copy vs originals, human‑in‑loop optionality, configuration‑dependent permissions for write/network/execute, and model provenance/cross‑case memory) that bound what an attack can reach (F5).
The demonstrations used synthetic disk images with planted plain‑text notes. The pipeline combined the Autopsy forensic platform (with an MCP bridge exposing read‑only tools), LM Studio running a local quantised model (reported runs used gemma‑4‑12b), and optional MCP servers that provided filesystem write and network fetch capabilities (F6).
They present three proof‑of‑concept attacks driven only by text planted on seized devices: (1) persuasion — changing a reported conclusion, (2) local disk write — writing attacker‑chosen content to the analyst’s workstation, and (3) network callback — causing outbound network traffic (F7).
In the reported runs, all three attacks succeeded on gemma‑4‑12b and gemma‑4‑26b; the persuasion attack also succeeded on ministral‑3‑8B; and the local write and network callback succeeded on qwen3.8‑27b and gpt‑oss‑20b (F8). These successes carry heavy caveats: each depended on a chain of conditions, including the model discovering and reading the planted note, the model’s capability and reasoning mode, and the workstation’s approved capabilities; outcomes varied across images and configurations (F8, F11, F12).
On mitigations, the paper cites a prior measure, Spotlight, which marks untrusted data so the model can separate evidence from developer instructions (F9). The reported evaluation reduced attack success from over 50% to below 2%, though the Spotlight authors note a fixed marking scheme can itself be spoofed (F9). The authors also propose practical mitigations observed during experiments: scoped least‑privilege write tools, delivering image pixels to the model (a get_image tool reversed one demonstrated attack for one model), pre‑emptive injection tests, wrapping or marking untrusted data, and network isolation (F10).
Significance and limits: the work shows LLMs add a new manipulation surface — what the model reasons about and, where permitted, what it does after reading evidence — which extends classical anti‑forensic categories (F1, F2). The demonstrations are proofs of concept: the reported runs used a local quantised model and planted plain text with no concealment, and the paper does not report scaled benchmarks or a broad empirical validation of the taxonomy (F11). Attack success depends on deployment and operational conditions (discovery of the planted text, model settings, and approved capabilities) that the authors list as bounding assumptions (F12). They also note human review is not a guaranteed safeguard because of automation bias and the perception gap; the study did not include examiner behaviour measurements (F13).