PaperlayerView exact revision on arXiv

Source-linked AI summary

Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2

Yedidel Louck, Amit Dvir, Ariel Stulman

arXiv:2609.11757v1cs.CR

TL;DR

AP2 signs transaction artifacts without constraining the decision that produced them, so merchant text can steer agents into valid but unauthorized choices. The paper characterizes three Whisper attacks, introduces A-VIP’s protocol-layer bindings, and finds attack success rates of 90%, 56%, and 73.3%; A-VIP blocks the first two structurally and surfaces the third for confirmation. The release includes A-VIP, machine-checked invariants, and a 1,544-scenario benchmark.

  • Problem

    AP2 signatures validate completed transactions but do not constrain whether merchant-influenced decisions match the user’s request.

  • Method

    A-VIP treats signed intent as a capability grant, binding credential lookups and cart lines to authorized session and listing context while flagging unauthorized spending.

  • Results

    90%, 56%, and 73.3%: Vault, Branded, and Selection Whisper succeed on the evaluated Flash-Lite models, while A-VIP blocks the first two without false positives and surfaces the third for confirmation.

  • Takeaways & Limitations

    Protocol owners should enforce authorization at the protocol layer because resistance does not generally track vendor, price tier, or model capability.

  • Takeaways & Limitations

    AP2-WhisperBench is a public development and regression set rather than a held-out test set, so visible-set rates are not generalization claims.

Abstract

from arXiv · show

Software agents are beginning to shop and pay on a person's behalf. Agent payment protocols such as AP2 produce cryptographically valid signatures for completed purchases, yet do not constrain the decisions that lead to them. Consequently, ordinary product-description text can steer a shopping agent into forming a cart that passes every protocol check but no longer matches the user's request. In this paper, we show that this vulnerability enables three related attacks. In the first attack, the agent is steered into fetching another user's payment credentials. In the second, it assembles a cryptographically valid cart whose contents do not match what the user was shown. In the third, a single factual claim about stock or product lineage moves the agent from the cheaper displayed item to a more expensive one, while the resulting cart remains fully consistent with the listing. In experiments using the Gemini Flash-Lite models that AP2's sample agents specify by default, the three attacks succeeded at rates of 90%, 56%, and 73.3%, respectively. The same vulnerability appears across seventeen Google models, three unrelated agent frameworks, two cross-vendor anchors, and Google's own consumer assistant. To address this attack vector, we introduce A-VIP (AP2 Verified-Intent Protection), a protocol-layer defense that treats the signed intent as a capability grant rather than judging the merchant's description. The defense binds every credential lookup to the session that requested it and every cart line to the listing seen, while flagging unauthorized spending. The first two attacks leave structural traces that these bindings block with zero false positives. The third attack leaves no trace, so A-VIP surfaces unauthorized spending for user confirmation. Finally, we release the A-VIP code, machine-checked invariants, and AP2-WhisperBench, a suite of 1,544 evaluation scenarios.

1 Introduction

AP2 signs the transaction artifacts but does not constrain the decision that produced them, allowing merchant text to steer valid purchases away from user intent. The paper characterizes three attack families, evaluates their prevalence, and introduces A-VIP plus a benchmark and proofs.

  • Problem: AP2 signatures verify that a transaction was authorized and unaltered, but they do not record whether the purchased product matched the user’s request.A single merchant-controlled sentence can change the agent’s purchase while leaving every protocol check satisfied.
  • Attack characterization and evaluation: 90%, 56%, and 73.3%: Vault, Branded, and Selection Whisper succeed on AP2’s pinned Flash-Lite models, respectively.The attacks also span seventeen Google builds, three agent frameworks, two cross-vendor anchors, and the flagship consumer assistant.
  • Defense: A-VIP treats the signed intent as a capability grant, binding credential lookups and cart lines while surfacing unauthorized spending.Structural discrepancies are blocked at zero false-positive cost; Selection Whisper is surfaced for confirmation because its cart remains structurally consistent.
  • Resources: The paper releases AP2-WhisperBench, a reasoning-layer regression suite containing 1,544 scenarios, alongside A-VIP and machine-checked invariants.The suite evaluates reasoning-layer families by reading rather than substring matching.

2 Background

AP2 authorizes purchases through signed intent, cart, and payment mandates, with runtime context bound by a single-use nonce. Its containment remains incomplete because constraints may be empty and credential discovery occurs before the mandate chain can bind it.

  • AP2 mandate chain: AP2 forms an auditable chain from a signed user intent through a merchant-signed cart to a wallet-signed payment mandate.The mandates are W3C Verifiable Credentials signed with ECDSA P-256, and the payment alias is obtained through get_payment_methods(user_email).
  • Runtime containment: ZTRV binds mandate context with a single-use nonce, preventing replay of an earlier mandate in a new transaction.This runtime binding does not constrain the semantic decision produced from merchant content.
  • Containment limits: AP2’s constraints are deployment-time properties rather than protocol-level guarantees, and the human-present sample agent leaves its constraint fields empty.The SDK tests record that an empty constraint list produces no violations.
  • Containment limits: Credential discovery occurs before any cart exists, so closed-mandate verification cannot bind a preceding get_payment_methods call.Disclosure of a third party’s aliases into the agent’s context differs from credential theft after release to a merchant.

3 Related Work

Prior work authenticates parties, binds artifacts, or detects injection at other pipeline positions, but leaves a gap for reasoning-layer attacks that manipulate agent decisions. This paper quantifies that gap and places its defense at the protocol boundary.

  • Closest prior systems: AP2-related mechanisms such as Verifiable Intent and ZTRV authenticate or bind artifacts but do not inspect merchant-provided content.ZTRV reports about 3.8 ms overhead and explicitly leaves semantic injection beyond execution-layer verification.
  • Prior AP2 attacks: Prior AP2 work tested one Vault example and one Branded example on Gemini-2.5-Flash, without a benign baseline or defense evaluation.This paper recasts Vault around a malicious merchant, expands Branded to five subtypes, and tests the full cryptographic pipeline.
  • Research gap: The remaining research gap is quantitative characterization of AP2’s reasoning-layer attack surface and a defense against it.Whisper attacks depend on model reasoning, unlike structural platform flaws that can be remedied directly in protocols.
  • Defense positions: Defense positions trade off deployability, latency, prevention, and protocol specificity: model-internal checks require partner control, output checks add inference cost, and audits cannot prevent charges.Only input-side defenses avoid per-request model inference, but prior work leaves that position undefended.
  • A-VIP positioning: A-VIP’s primary defense binds signed objects outside the model, while its content scanner provides secondary semantic inspection without fine-tuning or prompt rewriting.Its credential-path design also keeps credentials outside the agent’s reachable context.

4 Threat Model

The threat model assumes honest users, shopping agents, credential providers, and payment service providers, while allowing authenticated merchants to control returned free text and cart contents. It defines three attack goals and distinguishes structural traces from decisions that remain consistent with displayed offers.

  • Attack goals: Three attack goals corrupt different transaction components: Vault targets credential lookup, Branded targets cart construction, and Selection targets product choice through a factual premise.Branded includes price inflation, add-ons, competitor demotion, and payment redirection; Selection promotes a costlier displayed product.
  • Assumptions and attacker capability: The attacker controls merchant free-text fields, item ordering, and signed-cart contents, but not the user’s intent, wallet, model weights, or credentials-provider response.Compromised credential providers and dishonest payment service providers are outside the modeled threat.
  • Adaptive attacker: An adaptive attacker may inspect A-VIP’s source and generate paraphrases that avoid regular-expression triggers while preserving directive meaning.This attacker-moves-second setting tests robustness against trigger-evasion paraphrases.
  • Defense-relevant evidence: Structural traces distinguish the families: Vault leaves evidence in the request stream and Branded in the signed cart, whereas Selection leaves no discrepancy because its chosen product and price were displayed.The defense therefore closes the first two families and surfaces Selection as unrequested spending.

5 The A-VIP defense

A-VIP treats the signed Intent as a capability grant and binds each payment step to authorized session, listing, merchant, and mandate structure. Structural checks block attacks that create discrepancies, while spending confirmation covers selections that remain structurally consistent.

  • A-VIP uses binding as its primary defense, keeping each transfer of value within the signed Intent’s authorization scope.Content inspection is secondary because authorization boundaries are unaffected by paraphrasing.
  • A-VIP’s structural binding blocks the two forgery families with zero false positives, reports structurally consistent Selection attacks, adds at most a few hundred milliseconds, and makes no per-request model calls.The protocol-layer defense is designed to avoid per-call language-model cost and merchant re-onboarding.
  • 5.1 The credential lookup: remove the identifier from reach: DDFC replaces agent-selected user identifiers with session-bound, single-use tokens, preventing credential substitution and providing machine-checked replay and audience binding.The token is bound to the cart hash, redeeming merchant, nonce, and expiry.
  • 5.2 The cart: bind it to what was displayed: Structural controls bind cart lines to recorded listings, payees to authorized merchants, quantities and currencies to the Intent, and totals to line sums.Display binding uses a snapshot recorded when products are shown, so later listing changes do not alter the bound values.
  • 5.3 The spending rule: Selection Whisper remains structurally valid, so A-VIP asks for confirmation when an uncapped Intent would select the more expensive matching product.With a budget in the Intent, no additional confirmation is required.
  • 5.4 Content inspection, and its limit: Content inspection combines keyword and similarity scanning with semantic verification, but category-level requests make Intent-to-cart similarity too low for reliable thresholding.The verifier is calibrated only on benign requests naming a specific product, so structural binding remains primary.

6 AP2-WhisperBench

AP2-WhisperBench is an AP2-specific benchmark covering attack families and benign controls with provenance-rich traces and explicit judges. Its evaluation uses fixed reference code, configurable model routing, manual validation for Selection scoring, and a public release supporting reproducibility.

  • AP2-WhisperBench targets AP2-specific attacks that generic indirect-prompt-injection benchmarks do not cover.
  • The core suite contains 1,440 scenarios: 390 attacks across Vault, Branded, and Selection Whisper, plus 1,050 benign controls.An additional branded-factual configuration adds 104 scenarios.
  • The benchmark holds the defense fixed while refining attack phrasings only against the undefended baseline, and releases provenance tags for every scenario.
  • Benign controls span six merchant and product edge categories, with at least 150 scenarios per category and Wilson 95% confidence half-width below five percentage points overall.
  • Evaluation runs the byte-identical upstream AP2 v0.2.0 reference deployment while routing model traffic through OpenRouter and recording complete agent-tool traces.Each trace includes a manifest identifying the victim, attacker, product, Intent brand, and price ceiling.
  • Vault and Branded attacks use trace and signed-cart judges, whereas Selection scenarios use a clause-anchoring reader validated by manual review and independent annotation.Substring matching was rejected because factual responses and refusals can repeat product names.
  • The released benchmark includes full provenance, a synthetic Vault fixture, and Croissant metadata, with reruns supported by checkpointed results.Running the 1,440 core scenarios across eight models cost $7.35.

7 Evaluation

Evaluation shows that Whisper attacks remain effective across models, frameworks, delivery paths, and the consumer assistant, with factual premises often escaping instruction-focused resistance.

  • 7.2 Three families, three things merchant text corrupts: 90% of preview-default trials leaked another user’s payment alias, while Branded Whisper altered signed carts in 56% of trials.Vault success was measured from wallet tool calls; Branded success required an undisplayed line, changed price, or incorrect cart total.
  • 7.2 Three families, three things merchant text corrupts: 73.3% of GA-successor trials followed a factual product-selection claim, compared with 23.3% on the preview model.Selection was scored by reading the recommendation, and the GA successor was more susceptible than the preview model.
  • 7.3 No model and no framework escapes: Across seventeen Google builds, Selection Whisper succeeded at rates from 23.3% to 73.3%, and none fully resisted it.Claude-opus-5 was substantially lower at 1.2%, with manual review indicating verification or refusal of the injected stock claim.
  • 7.3 No model and no framework escapes: Higher capability did not reliably predict resistance: gemini-2.5-pro reached 61.9% and gemini-3.1-pro-preview reached 67.1%.The results indicate that deliberative reasoning and higher capability alone do not reliably prevent Selection Whisper.
  • 7.4 From instruction to fact, the escalation is measurable: The factual premise succeeded in 85% of trials across five Gemini builds and 71.8% across twenty-seven builds from six organizations.The cross-organization estimate includes a Wilson interval of [68.7, 74.7], while the scenario sets for the instruction and factual comparisons differed.
  • 7.5 The consumer assistant: pasted versus fetched delivery: Fetched merchant text changed the consumer assistant’s recommendation in twelve of twelve trials, whereas the same sentence pasted into chat was rejected in all eight trials.A control page without the added sentence never changed the recommendation, isolating the effect to the fetched sentence.

8 Discussion

The results show that model choice alone cannot reliably prevent these attacks, so protocol owners must enforce controls at content ingestion and signed-object validation. A-VIP blocks structurally detectable attacks without false positives, while Selection Whisper requires confirmation when spending is unauthorized.

  • Model choice provides no general guarantee, because resistance does not track vendor, price tier, or capability.
  • A-VIP validates signed structure rather than interpreting text, producing no false positives on the two forged attack families.Selection Whisper leaves structural fields consistent, so it is handled through additional-spending confirmation rather than structural rejection.
  • The evaluation uses small per-cell samples for consumer-product rates, with some reasoning-tier and cross-vendor observations based on single trials.
  • Content inspection has a 12% strict false-positive rate on the diversity stress test, whereas the binding has none.
  • A user-approved spending bound removes unnecessary confirmation without reducing coverage.

9 Conclusion

AP2 signs the transaction but not the decision behind it, allowing merchant text to produce valid signatures over manipulated choices. The paper concludes that protocol-layer bindings are needed because partner models are outside the protocol owner's control.

  • Resistance does not track vendor, price tier, or capability across the evaluated models and systems.The three attack rates on the reference line are 90%, 56%, and 73.3%, while only one of two cross-vendor comparisons resists.
  • A-VIP binds credentials, carts, and spending to user authorization at the protocol layer.It blocks the two forged families without false positives and requires confirmation for Selection Whisper when the Intent lacks a spending bound.

10 Ethics Considerations

The paper reports disclosure, staged release, synthetic targets, and safeguards intended to limit harm while making the attacks and defense reproducible. It states that the benchmark adds measurement and a deployable defense without extending adversary capability beyond prior literature.

  • The Vault Whisper chain was disclosed to the protocol vendor's vulnerability reward program under a standard 90-day window.
  • AP2-WhisperBench releases attack classes and deterministic judges, while adaptive paraphrases were delayed until the disclosure window closed.No released artifact targets a live merchant, live wallet, or deployment beyond the local reference stack.
  • All experiments use a synthetic vault of 51 fictional users, with no real personally identifying information or financial credentials.No human subjects or protected data were involved, and Institutional Review Board exemption was confirmed before data collection.
  • The paper adds quantitative characterization, cross-vendor measurement, and a deployable defense without extending adversary capability beyond the existing literature.The release supplies maintainers with a security regression that AP2-specific benchmarking previously lacked.
  • The full benchmark execution used about $7.35 of cloud inference, two hours of laptop CPU time, and 0.03 kilowatt-hours of energy.

11 Open Science

The paper releases the defense, benchmark, specifications, scripts, raw outputs, and reproducibility infrastructure. It also clarifies that the public benchmark is a development and regression set rather than a held-out test set.

  • The released artifacts include A-VIP, AP2-WhisperBench, experiment scripts, the machine-checked specification, and raw responses.The defense includes credential binding, structural mandate controls, and secondary content-inspection components.
  • AP2-WhisperBench is a standalone dataset, while the defense, harness, specification, and raw responses are available in the code repository.
  • The benchmark is a development and regression set, not a held-out test set, because its public scenarios and labels permit overfitting.Immutable phrasing-round tags identify the exact evaluation round, with future held-back rounds planned as models train against the set.
  • Stored response ledgers allow tables to be reproduced by rescoring raw outputs without provider access or cost.
  • The benign corpus is reconstructible from released record identifiers, digests, strata, split assignments, and build scripts.
  • The AP2 stack uses a pinned upstream commit and import-hook model routing, while non-provider measurements run on a consumer CPU without an accelerator.
  • The appendix reports Wilson 95% intervals over finished replies, preventing token caps from depressing reasoning-model rates.
  • The credential-leak matrix holds the whisper and judge fixed while replacing a generic shopping-agent prompt with the AP2 sample at n=20 per cell.The design measures organizational spread under identical conditions.

C Scanner throughput and per-channel cost

The scanner’s structural and embedding gates add low per-gate latency, while embedding dominates scanner-side cost and throughput scaling. The full defense path remains lightweight relative to language-model calls, though end-to-end cost grows with merchant responses.

  • Measurement setting: The capacity measurements come from a single Intel i7-13700H without an accelerator.
  • Per-channel latency: 15.6 ms mean embedding-gate latency dominates the scanner path, versus 0.21 ms for regex and 0.04 ms for structural checks.Embedding p99 is 67.9 ms; regex and structural p99 values are 0.49 ms and 0.12 ms.
  • Scanner throughput: 10,328 scans per second aggregate throughput is reached at eight workers, while per-worker throughput falls to 1,291 scans per second.Scaling efficiency is 0.67 with about 3.6 GB total resident memory.
  • Per-channel cost: 54% of mean per-call scanner cost comes from the embedding gate, compared with 32% for regex and 6% for structural checks.The measured mean contributions are 0.213 ms, 0.118 ms, and 0.024 ms, respectively.
  • End-to-end cost: A structural binding pass costs 0.04 ms median, while scanning merchant responses adds 15.6 ms per response to a transaction.DDFC token issue and redemption add a signature and consume-once nonce cost on the order of 3.8 ms.

D TLA+ machine-checked DDFC proof

DDFC binds credential redemption to session, audience, cart mandate, and single-use constraints, with its safety properties machine-checked in TLA+. The resulting invariants prevent credential leakage and constrain replay and merchant diversion, while migration leaves legacy-path exposure until retirement.

  • DDFC invariants: I1-I4 encode no identifier leak, audience binding, cart-mandate binding, and single-use time-bounded redemption constraints.The token carries session, cart-hash, audience, nonce, and expiration fields.
  • Safety result: Theorem 1 states that no Vault Whisper landing in the agent context can leak a third-party payment alias into the agent or merchant control.The proof removes user-email lookup, requires session identifiers, and blocks merchant relays through audience checking.
  • Machine checking: TLC verifies VaultWhisperResistance over a finite attacker configuration with three users, two sessions, three merchant DIDs, two cart hashes, four nonces, and a three-tick TTL.The finite state space is checked in under one minute on a laptop, while cryptographic primitive integrity is abstracted.
  • Residual surfaces: DDFC bounds replay to 300 seconds and prevents stolen tokens from being diverted to another merchant, but residual exposure remains in agent-process memory.The paper recommends pairing these guarantees with memory protection and redemption anomaly detection.
  • Deployment boundary: DDFC requires cooperative changes at both the Credentials Provider and Merchant PSP, so phased migration retains Vault Whisper exposure on legacy-path merchants.The residual surface is the union of unmigrated merchants and attacks missed by the scanner until the legacy endpoint is retired.
  • Scanner composition: Adding scanner channels preserves BLOCK decisions and can only increase attack recall; the empirical false-positive rate remained 0% after structural-channel addition.The monotonicity follows from max-severity composition with BLOCK above FLAG above PASS.

H Semantic verifier thresholds and per-edge calibration

The semantic verifier uses benign-only calibration and layered scanner thresholds, but its linguistic gate is secondary because legitimate carts can also have low intent-to-cart similarity. Calibration tests show multilingual coverage and a broad zero-false-positive operating region, while stress tests expose overfiring and untested encodings.

  • Cross-lingual calibration: All seven tested languages pass Channel A, with French lowest at cosine 0.483, still 1.6× the FLAG threshold.The canonical English intent is compared with translations in Spanish, French, German, Italian, Portuguese, and Hebrew.
  • Threshold calibration: The deployed Channel A BLOCK threshold of 0.20 lies within a range with exactly 0% strict false-positive rate from 0.10 through 0.28.The rate becomes 0.2% at 0.30 and rises sharply only beyond 0.32.
  • Numeric probes: Five of six numeric cart attacks are blocked on the numeric axis alone, while a bundle addition is caught by the cart-item-count guard.A +10% price drift passes by design because it protects against rounding noise; +50% and +200% drifts, doubled quantity, and five-times quantity are blocked.
  • Operating point: A-VIP’s structural components have no fitted threshold or model dependence, whereas the content scanner is the only learned layer and source of nonzero benign false positives.Table 11 summarizes each component’s closed attack family, true-positive coverage, and benign cost.
  • Defense comparison: On the shared surrogate slice, A-VIP reaches TPR-any 1.00 and TPR-blk 0.96, exceeding the reported surrogate ranges of roughly 0.79–0.87 and 0.29–0.75.The surrogate comparison is deployment-side rather than a head-to-head evaluation of retrained models.
  • Scope boundary: Compound encodings such as gzip-in-base64 and double URL-encoding were not tested and would require iterative decoding and rescanning.The paper treats this as an engineering extension to the documented hardenings.
  • Stress testing: A 50-sample synthetic stress test produced 12% strict FPR and 6% friction FPR, with overfiring concentrated in three identified patterns.
Loading 2609.11757v1…