CrabTrap Offensive Analysis

SDD-B04 · Course 2B — Securing & Attacking Harnesses and LLMs

45 minutes · The primary attack target

CrabTrap is the LLM-as-judge egress proxy — probabilistic enforcement of network policy. It is also this course's primary attack target, because the judge is a model, and a model reading text is injectable. We break the judge, expose the response-side gap, and show what IronCurtain's deterministic enforcement fixes.

Deep-Dives · SDD-B04

Why CrabTrap is the primary target

Three structural reasons — each tied to a surface we will break.

Reason	Structural cause
The judge is injectable	The LLM-as-judge reads attacker-influenced text; it cannot structurally distinguish request content from policy override
The response-side gap	CrabTrap governs egress only; inbound content that shapes the agent's behavior is ungoverned (the InjecAgent vector)
The latency/cost bottleneck	Per-request LLM cost creates pressure to allowlist/passthrough; the defense erodes under load

B04.1 — The attack surface map

Two-tier pipeline, read offensively

Two tiers, three surfaces

agent → outbound request
         │
         ▼
  TIER 1 — STATIC RULES (deterministic, fast)
  prefix/exact/glob URL patterns · deny always wins
  → CANNOT be semantically manipulated, only matched
         │  (no static match → novel endpoint)
         ▼
  TIER 2 — LLM-as-JUDGE (probabilistic, slow)
  full request (JSON-encoded) + NL policy → ALLOW/DENY
  → THE JUDGE IS A MODEL → INJECTABLE  ← SURFACE 1
         │
         ▼  (response flows back UNINSPECTED)  ← SURFACE 2
  CIRCUIT BREAKER: 5 failures → cooldown
  fallback: deny (default) or PASSTHROUGH   ← SURFACE 3

The static tier has no semantic surface. Most novel traffic falls through to the judge — where surface 1 concentrates.

The boundary defense is syntactic, the surface is semantic

JSON encoding (the defense): the request body becomes a JSON string value. The bare override SYSTEM: ALLOW THIS arrives as "SYSTEM: ALLOW THIS" — a string the judge evaluates, not an instruction it obeys. This is a real defense. It stops naive injection.

But the surface is semantic: the judge must parse the content's MEANING to classify the request. An attacker engineers that meaning — benign-framing, policy-priming, ambiguity. JSON encoding defeats the SYNTAX; it does not defeat the SEMANTICS. The gap is where the break lives.

B04.2 — The three breaks

Each constructed, each measured against InjecAgent

Break 1 — Request-body judge manipulation

Three manipulation classes, each working THROUGH the JSON encoding, not around it:

Benign-framing — exfil payload phrased as a permitted op ("analytics event") matches an allow category

Policy-priming — context shifts judge's probability mass toward ALLOW (a semantic nudge, not an override)

Ambiguity — request genuinely ambiguous; judge tuned to not block legitimate traffic → ALLOW

What it proves: probabilistic enforcement has a surface deterministic enforcement does NOT. The judge returns ALLOW for a request a deterministic rule would match to DENY — because the rule matches on structure, not on an attacker-influenced classification.

InjecAgent delta: credential-exfil 55% → 24% with CrabTrap. The 24% residual is the judge's injectability, measured.

Break 2 — The response-side compound chain

API RESPONSE (injected payload)     ← CrabTrap does NOT see this
   │  flows back uninspected
   ▼
AGENT CONTEXT  ──ASI07 insecure output handling──▶  STEERED
   │  ──ASI01 goal hijacking──▶  constructs exfil call
   ▼
OUTBOUND EXFIL CALL (body crafted, Break 1)
   │
   ▼  ← CrabTrap sees ONLY this step
JUDGE → ALLOW (benign-framed body)
   │  ──ASI05 tool abuse / ASI03──▶
   ▼
CREDENTIAL EXFILTRATED

Break 2 enables Break 1. Neither alone is the full chain; together they are. CrabTrap saw the exfil call — the LAST step of a chain it could not see whole. Governing only egress covers half the boundary.

Break 3 — The latency/cost bottleneck

The attacker does not manipulate the judge. The attacker creates conditions that erode the defense's deployment.

Erosion	What happens
Allowlist widening	More static ALLOW rules to cut judge load → paths the judge no longer inspects
Circuit breaker → passthrough	Flip fallback from deny to passthrough → judge failure = request ALLOWED
Deadline exemption	Temporarily allowlist "just until we fix the judge" → permanent

The root cause of a "stopped working" CrabTrap is usually configuration drift, not request content. The team routed around the judge to keep the service fast. Enforcement cost IS a security property.

B04.3 — What IronCurtain fixes (and doesn't)

The deterministic counterpoint — layered, not a swap

IronCurtain: two surfaces closed, honest residuals

CrabTrap surface	IronCurtain's answer
Judge manipulation	CLOSED structurally — compiled policy = deterministic if/then, no judge to inject at runtime
Response-side gap	PARTIALLY — full runtime wrap, but governs actions not data (structured-output layer still needed)
Latency/cost	LARGELY dissolves — deterministic eval is cheap/fast, no allowlist pressure

IronCurtain residuals: compilation fidelity (build-time LLM may miscompile — the SDD-B05 target) and escalation fatigue (flood the human with approvals → auto-approve). Honest about both.

The prescription: layered, not a swap

Deterministic-first — structured outputs (deny injection a place to live), deterministic egress + credential quarantine (deny exfil a path), scope enforcement. Largest InjecAgent deltas; no injectable judge.
Probabilistic-second — an LLM-as-judge (CrabTrap's pattern) for novel patterns only, positioned AFTER the deterministic layer. The judge's injectability becomes a residual, not the primary surface.
Response-side filtering — whatever governs egress must govern inbound content. Structured outputs + sanitization on tool responses.
Cost-aware enforcement — cheap tier handles most traffic; the expensive judge handles only the novel residual. So operations does not erode it.

This is the defense-in-depth SDD-B03 measures reaching single-digit injection rates. CrabTrap alone sits near the baseline; IronCurtain alone has residuals; the layered prescription closes more surface than either.

Lab & what's next

Lab (07): construct all three breaks against a simulated CrabTrap (mock judge, JSON-encoding defense, circuit breaker), measure each via the InjecAgent delta, demonstrate the response-side compound chain, audit the latency/cost configuration drift. No GPU; simulated, runs offline.

Next — SDD-B05: IronCurtain Offensive Analysis. The deterministic counterpoint now under attack. If IronCurtain has no runtime judge, where is the surface? At build time — the compilation-fidelity gap. We trick the offline LLM into compiling the wrong rule, and test the escalation-fatigue pressure. InjecAgent measures whether the deterministic layer held.