LUCID Technical Documentation
Two separate documents. Pick one to read it in full.
01.Assets under threat
An LLM alone has very little power. It can hallucinate. But it cannot delete an account, read a secret key, or make a network call. The threat starts the moment you give the model tools. Tools are the hands it uses to act on real systems.
| Asset | What happens if lost |
|---|---|
| The database | Stolen records, forged edits, or wiped tables. |
| Infrastructure secrets | Exposed API keys and internal services. |
| Side-effect tools | Deleted accounts, reset passwords, or executed commands. |
| The API budget | Drained credits that take the service down. |
| The agent's loyalty | The agent turns against its own users. |
02.The four attacker archetypes
Most security setups assume the attacker is just an anonymous person in the chat. In practice, four different attackers target an agent.
1. Direct Abuser
An ordinary user typing in the chat. Uses roleplay, trick questions, or strange encodings to bypass rules and steal the system prompt.
2. Competitor
An organized attacker scripting the chat. Probes the model to harvest cloud keys, proprietary logic, or customer records.
3. Invisible Saboteur
Never talks to the agent directly. Plants instructions inside web pages, PDFs, or repositories that the agent reads on its own.
4. Financial DoS
Traps the agent in an endless tool loop. Burns through the API token quota and takes the service down with the bill.
03.The 19 OWASP LLM attack vectors
LUCID is built to stop nineteen concrete attacks, tested across four tiers of difficulty.
Tier 1 · Naïve baseline
| T1-01 | Direct Prompt Override | LLM01 | Told to forget its rules and prove it. |
| T1-02 | System Prompt Extraction | LLM07 | Reads its hidden prompt out loud, secret and all. |
| T1-03 | Dangerous Function Call | LLM06 | Deletes an account on command without checking. |
Tier 2 · Syntactic evasion
| T2-01 | Delimiter & Tag Injection | LLM01 | Fake system tags fence off a hidden order. |
| T2-02 | Homoglyph Substitution | LLM01 | Cyrillic look-alikes slip past the filter. |
| T2-03 | Encoding Obfuscation | LLM01 | The command hides in Base64, then runs. |
| T2-04 | Parameter Injection | LLM06 | Negative and wildcard values pass unchecked. |
| T2-05 | Cross-Lingual Evasion | LLM01 | The same order in a language filters missed. |
Tier 3 · Logic hijacking
| T3-01 | Stored / Indirect Injection | LLM01 | A trap hides inside text the agent reads on its own. |
| T3-02 | Tool-Loop DoS | LLM10 | An endless tool loop drains the budget. |
| T3-03 | Fake Backend Event | LLM01 | A forged emergency unlocks root privileges. |
| T3-04 | Confused Deputy | LLM06 | Two safe tools chain into an account reset. |
| T3-05 | Cloud SSRF Extraction | LLM06 | The fetch tool lifts cloud metadata credentials. |
Tier 4 · State of the art
| T4-01 | Markdown Exfiltration | LLM02 | The secret rides out inside an image link. |
| T4-02 | Multi-turn Crescendo | LLM01 | Friendly turns lower the guard before the real ask. |
| T4-03 | Attention Saturation | LLM01 | Filler text buries the order until rules drop out. |
| T4-04 | RAG Vector Poisoning | LLM04 | A payload planted in the database wakes on search. |
| T4-05 | Arbitrary Shell Execution | LLM06 | A fake diagnostic command runs in the shell. |
| T4-06 | Shadow Tool Poisoning | LLM03 | A new outside tool registers at runtime. |