PaperlayerView exact revision on arXiv

Source-linked AI summary

Deletion, Substitution, Repair and Transplant: Component Attribution in BARBICAN, a Layered Prompt-Injection Gateway for MCP

İpek Abasıkeleş Turgut, Edip Gümüş

arXiv:2610.33198v1cs.CR

TL;DR

A classifier can fail inside a layered defense without changing its aggregate metrics, raising questions about what component ablations measure. This paper re-executes BARBICAN and tests deletion, substitution, repair, and transplant; repair improves arbitration AUC but lowers system recall, while routing and enforcement constrain what arbitration can change.

  • Problem

    Deletion-based ablations are widely used to credit routed stages, but their results do not separate a component’s verdicts from the effects of removing its routing and fallback behavior.

    Source: §4.1 · p. 7

  • Method

    The authors re-execute BARBICAN and compare deletion, constant-verdict substitution, tokenizer repair, and classifier transplant while holding its routing and enforcement in place where applicable.

    Source: §1 · p. 2, §4.1 · p. 7

  • Results

    Repair raises arbitration AUC from 0.392 to 0.855 but lowers system recall; an AUC of 0.916 on the band transplant changes 16 decisions.

    Source: §8 · pp. 21–22

  • Takeaways & Limitations

    Report a routed stage’s input-band base rate and pair deletion with substitution; the authors measured this pattern in BARBICAN and an earlier gateway.

    Source: §8 · p. 21

    The study does not rank complete gateways against one another; its external classifiers are baselines, and its benchmark belongs to BARBICAN.

    Source: §4.5 · p. 10

Abstract

from arXiv · show

A neural classifier can fail completely inside a layered defense without any end-to-end number moving. We demonstrate this on BARBICAN, a fail-closed gateway for language-model tool mediation whose arbitration stage spent an entire recorded evaluation receiving text mangled by a misconfigured tokenizer. Correcting the misconfiguration lifts that stage's corpus-wide area under the ROC curve (AUC) from 0.392 to 0.855 and pushes system recall down, from 80.67% to 80.34%; a stub that answers "malicious" scores 80.77%, higher than either. The reason emerges once the stage's input distribution is examined: upstream routing hands it a band that is 96.82% malicious, and the enforcement design lets an incriminating verdict block while an exculpating one releases an input only through one narrow branch. Yet deleting it costs 673 detections. Substituting its verdict with a constant instead moves between 12 and 140 of 25,000 decisions. Transplanted into the arbitration stage, an off-the-shelf classifier that separates the band's inputs at an AUC of 0.916 changes 16 of 25,000 decisions. Measured against such detectors with operating points chosen away from the test data, the gateway leads on its own benchmark distribution and falls behind once that distribution changes. In our earlier gateway, the review model's band is 92.94% malicious and a constant verdict is as accurate as the review model. We argue that an ablation figure for any routed stage is unreadable without the class balance of the band that stage receives, and that deletion experiments need substitution experiments beside them.

1. Introduction

Layered defenses route inputs through stages, so deleting a stage can change both its decisions and the traffic’s path through enforcement. In BARBICAN, a tokenizer failure left arbitration corrupted without changing reported aggregate metrics, while repair, substitution, and deletion produced sharply different outcomes.

1. Introduction

  • Repairing BARBICAN’s tokenizer raised arbitration AUC from 0.392 to 0.855 but lowered system recall, while deleting arbitration cost 673 detections.The control run reproduced the recorded confusion matrix sample for sample; the repaired classifier moved recall from 80.67% to 80.34%.Source: §1 · pp. 2–3
  • Pinning arbitration to a constant moved 12 to 140 of 25,000 decisions, whereas deletion moved 673 because it also changed how the band was handled.The deletion–substitution discrepancy depends on how releases with weak residual evidence are enforced.Source: §1 · p. 3
  • The arbitration band was 96.82% malicious, and enforcement let a malicious verdict block while a benign verdict could release only through a narrow branch.With the gateway’s semantic scores, the additional conditions for release almost never passed, making arbitration close to a one-way blocking signal.Source: §1 · p. 3
  • A public classifier transplanted into arbitration changed 16 of 25,000 decisions, despite an AUC of 0.916 on the band versus 0.368 for BARBICAN’s classifier.In the semantic stage, the same classifier changed 1,015 decisions because that stage determines what is routed.Source: §1 · pp. 3–4
  • The authors propose reporting routed stages’ band base rates alongside both deletion and substitution results.Their external-detector comparison leads on BARBICAN’s own distribution but falls behind when the distribution changes; the study does not compare complete gateways.Source: §1 · pp. 3–4

2. Related Work

Prior work commonly credits layered-defense components by disabling them and measuring the resulting metric drop. This paper connects that convention to intervention and evaluation-validity research, and argues that routed-stage results also require the class balance of the traffic they receive.

2.1. Layered defenses, and how they credit their layers

  • Layered-defense studies commonly disable components and attribute the resulting metric drop to their contribution, including in this authors’ earlier MCP gateway work [21].That earlier work noted that its review stage altered no final decision, but did not separate deletion from substitution or report the stage’s traffic balance.Source: §2.1 · p. 4

2.2. Deletion, intervention, and variable importance

  • Interpretability and statistics research warn that removal changes the system or input distribution being measured, motivating intervention and conditional or Shapley-based alternatives.The paper carries this distinction into layered security systems, where each stage receives traffic selected by earlier stages.Source: §2.2 · pp. 4–5

2.3. When end-to-end performance stops tracking component quality

  • Prior work shows that improving a component need not improve a cascade, and base-rate analysis explains why a detector’s practical value depends on prevalence.The paper applies the base-rate argument to routed arbitration traffic, where routing raises rather than lowers the malicious share.Source: §2.3 · p. 5

2.4. Evaluation validity, and re-executing a single system

  • Evaluation-validity work highlights sampling bias, selective tuning, distribution shift, and benchmark composition; this paper re-executes BARBICAN and compares it with standalone classifiers, not complete systems [40] [41] [43].Its approach also relates to reproducibility studies and case studies tracing reported security performance to input-data label imbalance.Source: §2.4 · p. 5

3. The Gateway Under Study

BARBICAN is documented as a tiered, fail-closed MCP gateway, but its traces reveal differences between the documented design and the system that ran. Those divergences affect what component ablations can establish.

3.1. As documented

  • BARBICAN’s documented design uses computational tiering: inexpensive filters handle most traffic, while heavier neural reasoning is reserved for borderline cases.The design describes ingress middleware, deterministic rules, a semantic layer, an adaptive percentile calibrator, an edge arbitrator, and an allow-hint safety rail.Source: §3.1 · p. 6

3.2. As instrumented

  • Instrumentation shows that the named tiers and supporting components do not all behave as documented, and that additional stages also make decisions.The semantic layer scores against 215 stored texts, while the review threshold takes two values across the benchmark rather than adapting continuously.Source: §3.2 · p. 6
  • An undocumented fusion stage combines seven signals, and its AUC of 0.925 exceeds the semantic score’s 0.695; a similarity memory also accounts for 2,132 hard blocks.The undocumented post-allow escalation can block requests that policy allows, and disabling it costs more detections than deleting the arbitrator.Source: §3.2 · pp. 6–7

3.3. Divergences, and why they matter here

  • Three divergences matter for attribution: arbitration receives a nearly pure malicious band, the allow-hint rail is inert, and undocumented components carry detections.Aggregate accuracy, precision, recall, and F1 are reproduced even while arbitration receives corrupted input.Source: §3.3 · p. 7

4. Method

Section 4 distinguishes four interventions on a pipeline component, proposes reporting the class balance of routed traffic, and specifies the run protocol and its scope.

4.1. Deletion, substitution, repair, transplant

  • Deletion, substitution, repair, and transplant respectively remove a component, overwrite its verdict, correct its implementation, or replace it while leaving routing and enforcement in place.Deletion combines the component with its selection predicate, score interval, and residue rule; substitution isolates the influence of its answers.Source: §4.1 · p. 7

4.2. Base rate of the arbitration band

  • A routed stage’s band base rate bounds how much its verdict can improve on a constant-positive policy, so the authors propose publishing that class balance beside ablation figures.The bound is 237 of 25,000 decisions in the control run; it limits potential gains over the stub, not losses.Source: §4.2 · p. 8

4.3. Runs

  • The protocol re-executes the gateway end to end on its balanced 25,000-prompt benchmark, with separate controls for instrumentation and tokenizer-correction code states.The remaining synthetic attacks are 97.1% hard or expert; the selection step that produced them is not in the project repository.Source: §4.3 · pp. 8–9

4.4. Second series, external baselines and provenance

  • External detectors and BARBICAN are compared at operating points selected for at most a 5% false positive rate, using held-out lineage groups or synthetic-only selection.The protocol also includes an independent 3,003-record check set and transplants external classifiers into gateway stages.Source: §4.4 · pp. 9–10

4.5. What the protocol does and does not settle

  • The protocol does not rank complete systems, and its timing and memory measurements apply only to the tested hardware.The benchmark belongs to BARBICAN; the authors assess its consequences for generalization rather than treating it as a disclaimer.Source: §4.5 · p. 10

5. Results

Across fifteen re-executions, deleting the arbitration stage costs 673 detections, while substituting a constant verdict changes at most 152 outcomes. Repairing the classifier sharply improves its AUC but slightly reduces system recall; the skewed arbitration band and enforcement rules explain why.

5.1. Control

  • The control run reproduces BARBICAN’s recorded confusion matrix exactly, with recall 80.67% and MCC 0.774.No prompt differs from the recorded evaluation.Source: §5.1 · p. 11

5.2. Deletion and substitution disagree by a factor of 4.8

  • 673 detections are lost when the arbitration stage is deleted, versus at most 152 outcomes changed by constant substitution.Deletion makes the band fail open; positive and negative substitutions change 12 and 140 decisions, respectively.Source: §5.2 · p. 11, Table 3 · p. 11

5.3. Repairing the classifier makes the system worse

  • After repair, arbitrator AUC on the evaluation corpus rises from 0.392 (below chance) to 0.855 and it rejects 88.8% of benign inputs correctly, while system recall falls from 80.67% to 80.34% (b=48, c=7, p=1 × 10−8).Across four public corpora, repair changes recall by 0.00 percentage points; the entire difference falls in the synthetic subset, where recall drops from 86.45% to 86.00%.Source: §5.3 · p. 11
  • 96.82% of the 7,453 prompts routed to arbitration are malicious, compared with 30.11% outside the band.Positive verdicts block, while negative verdicts can release inputs only through the narrow allow_limited branch.Source: §5.3 · p. 12

5.4. Sensitivity to the enforcement mapping

  • The two enforcement readings change nearly all arbitration-stage effects: counting allow_limited as a block leaves only 12 allow-hint releases from negative substitution.With allow_limited counted as an allow, deletion releases 686 band inputs through that state, while negative substitution releases 140.Source: §5.4 · p. 12, Table 5 · p. 12
  • The rescue branches contribute more detections than any other component, while the similarity memory adds blocks at 55.6% precision.Four rescue branches match literal formatting emitted by the synthetic generator and never fire on the four public corpora.Source: §5.5 · p. 13, Table 6 · p. 13

5.6. What the arbitration stage costs

  • The arbitration stage averages 55.2 ms per request, or 58.6% of total pipeline latency, for at most 152 changed decisions.Pinning its verdict to positive lowers mean request time by 61.4 ms.Source: §5.2 · p. 11, §5.6 · p. 13

5.7. Corpus composition, leakage, and the operating point

The corpus’s uneven composition and label construction qualify its aggregate results, while independent comparisons show BARBICAN’s advantage does not hold under distribution shift. Re-executions also show that disabling post-allow escalation has a larger effect than deleting a named tier.

5.7. Corpus composition, leakage, and the operating point

  • Recall ranged from 99.59% on BIPIA to 20.10% on WildJailbreak; removing verbatim memory matches lowered recall by 0.11 percentage points.Three public sources contain no benign prompts. Held-out selection later yielded 81.3% recall [80.5, 82.0]; the 413-entry contamination episode preceded the canonical run, which the cleaned memory reproduces exactly.Source: §5.7 · pp. 13–14

5.8. The second series: repetition, post-allow escalation, threshold

  • 1,146 detections were lost when post-allow escalation was disabled, exceeding deletion of any named tier; its escalated requests were 93.86% malicious.On the second platform, escalating every allowed request changed the reputation state and thresholds, producing 13,934 decisions different from control.Source: §5.8 · p. 14

5.9. What the corpus labels encode

  • WildJailbreak labels follow prompt form rather than harm, while first-word-only classification reaches 96.7% accuracy and AUC 0.995.BIPIA attacks appear in generated HTML, and every LLMail-Inject record carries appended outcome lines absent from the original e-mails.Source: §5.9 · p. 15

5.10. Against public detectors

  • Under shift, ProtectAI detects 80.5% of public attacks versus BARBICAN’s 65.8%, with false positive rates of 1.9% versus 14.9%.In distribution, BARBICAN leads by five recall points over the best external classifier at a slightly lower false positive rate.Source: §5.10 · pp. 15–16, Table 10 · p. 16

5.11. An independent check set

  • On the 3,003-record check set, BARBICAN reached 31.2% recall at 18.0% false positive rate and AUC 0.547, below injection classifiers on both axes.On original BIPIA contexts its AUC was 0.510; on fresh WildJailbreak prompts it was 0.497, against 0.978–0.992 for three classifiers.Source: §5.11 · pp. 16–17

5.12. Transplanting a stronger classifier

Transplanting a stronger classifier shows that a routed stage’s position and enforcement policy constrain its effect, even when it separates inputs well. Other layered defenses and a second routed gateway reinforce that deletion results depend on what each stage sees and how its verdicts are used.

5.12. Transplanting a stronger classifier

  • On the arbitration band, Prompt Guard 2 reached AUC 0.916 versus 0.368 for the original classifier, but changed 16 decisions; in the semantic stage, it changed 1,015.The semantic-stage transplant raised corpus recall from 80.67% to 81.31% and lowered false positive rate from 4.16% to 3.69%; using Prompt Guard 2 in both stages instead lowered recall to 75.94%.Source: §5.12 · p. 17, Table 12 · p. 18

5.13. Two other layered defenses

  • In unrouted LLM Guard and NeMo stacks, deletion isolates unique flags, yet the largest unique contributions came from format detectors.The learned components’ AUCs were 0.681 and 0.915, and both responded to adversarial form, which the corpus labels also encode.Source: §5.13 · pp. 18–19

5.14. A second routed system

  • In the earlier gateway, the consulted review band was 92.94% malicious; a constant-positive stub differed in 136 decisions, while counting reviews as detections erased all decision changes.The model’s malicious verdicts were 96.23% precise, three points above a constant; the stage’s contribution lay in shortening the review queue.Source: §5.14 · p. 19

5.15. Re-execution on a second platform

  • On the second platform, 166 arbitration verdicts reversed but only two final decisions changed; the confusion matrix otherwise reproduced exactly.Mean request latency rose from 89.8 ms to 168.5 ms because the semantic model ran on a general-purpose processor rather than the original accelerator.Source: §5.15 · p. 19

6. Why the Aggregate Metrics Missed It

Aggregate metrics can remain unchanged when a routed component fails because upstream routing and enforcement have already constrained its influence. The authors argue that component reporting must expose the routed band, compare deletion with substitution, and audit evaluation setup and labels.

6.1. A silent component failure

  • A routed, nearly pure population and a verdict policy that permits escalation but not clearing can leave aggregate metrics unchanged despite complete component failure.The arbitration tier received corrupted tokenizer input throughout the recorded evaluation, yet accuracy, precision, recall, F1, and MCC were reproduced exactly.Source: §6.1 · pp. 19–20
  • A substitution run can reveal an inert component in one pass: pinning its output to a constant and seeing unchanged metrics indicates no contribution.The proposed reporting set pairs substitution with deletion; in this gateway the two operations differed 4.8-fold.Source: §6.1 · p. 20, §6.3 · p. 20

6.2. A contamination episode found by audit

  • A targeted audit, not headline metrics, exposed the 413 evaluation entries once seeded into memory; the contaminated run’s recall increase was confounded by a configuration change.The entries were removed before the canonical run, whose result was unaffected.Source: §6.2 · p. 20

6.3. What to report

  • Nine artifact-based reporting checks cover routed-band balance, substitution, stronger transplants, enforcement, preprocessing parity, per-source results, held-out selection, external baselines, and label provenance.For routed stages, the authors specifically call for reporting the class balance of the received band and placing a constant-output substitution beside every deletion.Source: §6.3 · p. 20

7. Limitations

The study’s evidence is bounded by its evaluation of one author-built system and corpus, and an independent test on another routed system remains unrun. Several intervention and measurement choices further constrain what can be concluded.

Scope

  • The study covers one system and corpus; its only additional routed-system measurement is the authors’ earlier gateway, while the two other defenses do not route.The control was independently re-executed on a second machine and an external check set came from the original public collections.Source: §7 · p. 20

Scope and authorship

  • An independent evaluation of a routed system built by others remains the most direct unrun check on whether the argument generalizes.The system was built within the authors’ group, which also chose the interventions and findings to report; they sought to limit this by reporting every run and releasing traces.Source: §7 · pp. 20–21

Enforcement mapping

  • The reported deletion–substitution discrepancy depends on counting allow_limited as an allow; counting it as a block leaves the quality conclusion intact but changes the discrepancy’s size.Under that alternative mapping, arbitrator interventions change no decision apart from 12 allow-hint releases.Source: §7 · p. 21

Reproducibility

  • The source code and corpus texts are withheld, preventing readers from re-executing runs, recomputing external-detector scores, or repeating corpus audits and shortcut baselines.Results tables can be verified from released per-request traces; the source is slated for public release after the thesis defense.Source: §7 · p. 21

Intervention scope

  • Repair is available as a diagnostic only when a component is genuinely defective and its defect is mendable, and the post-allow escalation step was not transplanted.The escalation step was isolated by deletion and its output was substituted with constant and random escalation, but no different escalation rule was tested in its place.Source: §7 · p. 21

Operating points

  • Held-out operating-point selection covers only the eight points actually run, not a continuous search across the pipeline’s available thresholds.The configuration was selected on the evaluation corpus.Source: §7 · p. 21

Residual variability

  • One prompt’s decision varied across tokenizer-fix runs because an upstream similarity-memory score routed it to or around the arbitrator; the reported figures were unaffected beyond the last digit.A concurrent writer also modified the shared memory file during one run, though all matched entries belonged to the pinned snapshot and the pipeline did not reload the file at runtime.Source: §7 · p. 21

Measurement and provenance

  • Peak-memory figures were withheld because they tracked process-level noise, while the direction of the measured coupling between rescue branches and corpus formatting remains unresolved.The branches predated the generator, so the evidence does not establish whether the generator followed existing formatting conventions or the conventions came first.Source: §7 · p. 21

8. Conclusion

BARBICAN’s arbitration stage received corrupted tokenizer input throughout the evaluation, and repairing it improved the stage’s AUC while lowering system recall. The results connect this mismatch to routed-band prevalence and enforcement, and motivate reporting the band’s base rate alongside both deletion and substitution measurements.

Conclusion

  • Repairing the neural arbitration tier lifted corpus-wide AUC from 0.392 to 0.855 but lowered system recall; replacing it with a constant answering “malicious” without reading input raised recall above both.The neural arbitration tier received corrupted input throughout the evaluation.Source: §8 · p. 21
  • The arbitration band is 96.82% malicious, and the enforcement design lets positive verdicts block while negative verdicts release inputs only through the allow_limited branch.Deletion’s 673 detections measure the change of status imposed on the band, rather than the classifier’s isolated contribution.Source: §8 · p. 21
  • An ablation for a routed stage needs the base rate of its input band, and deletion results should be reported alongside substitution results.The authors expect this reporting consequence beyond the studied gateway but have measured it only there and in their earlier gateway.Source: §8 · p. 21
  • In the earlier gateway, the review-model band was 92.94% malicious, and a constant verdict differed from the model in 136 decisions when only blocks counted as detections.Source: §8 · pp. 21–22
  • With operating points chosen away from test data, a public classifier calibrated on BARBICAN’s synthetic records outperformed the gateway on public records in both detection and false alarms.The public collections inside the benchmark did not all mean what their names indicated.Source: §8 · p. 22
  • A transplanted classifier with band AUC 0.916 changed 16 arbitration decisions, while its semantic-stage transplant changed a thousand; the gateway still detected fewer independent attacks than the classifier alone.These comparisons show that a stage’s position constrains its contribution before classifier quality is considered.Source: §8 · p. 22

Data and Code Availability

The reproduction bundle provides traces and artifacts for verifying reported results, while some materials needed to re-execute the system remain unavailable.

Data and Code Availability

  • The bundle releases corpus and model digests, per-request traces for all fifteen runs, a verification script and output, and pinned state snapshots.Two snapshots containing corpus texts, similarity memory, and the semantic reference set are released by digest.Source: Data and Code Availability · p. 22
  • Pipeline source, intervention and transplant-hook commits, corpus texts, and two text-bearing snapshots are withheld pending the thesis defense.The source is available confidentially to editors and reviewers on request.Source: Data and Code Availability · p. 22
  • Released traces suffice to rebuild every results table, but not the divergence table or shortcut baselines, which require withheld source and corpus texts.The bundle includes scripts that recompute tables from its files and assert the main-table figures against the traces.Source: Data and Code Availability · p. 22

CRediT authorship contribution statement

The authors divide the listed contributions across conceptual, methodological, analytical, investigative, validation, software, and data-curation roles.

CRediT authorship contribution statement

Funding

The research received no specific grant from public, commercial, or not-for-profit funding agencies.

Funding

  • The research received no specific grant from public, commercial, or not-for-profit funding agencies.Source: Funding · p. 22

Declaration of Competing Interests

The authors report no known competing financial interests or personal relationships, while disclosing that their research group developed BARBICAN.

Declaration of Competing Interests

Declaration of generative AI and AI-assisted technologies in the manuscript preparation process

The authors used Claude for literature screening, prose drafting and editing, and arithmetic cross-checking, while deriving reported measurements from system executions or earlier gateway records.

Declaration of generative AI and AI-assisted technologies in the manuscript preparation process

Loading 2610.33198v1…