test(llm-worker): corpus as data, control twin, and an honest offline skip (#3334)

analysis/ghidra/models/run-llm-injection-suite.sh

@@ -2,9 +2,10 @@
 # run-llm-injection-suite.sh — run the #3334 behavioral prompt-injection corpus
 # against the pinned local model and record the report (#3334).
 #
-# The corpus itself is llm-worker/injection_suite.py and the entry point is
-# `worker.py --injection-suite`. Neither is run by CI: the suite loads the real
-# model onto the analysis host's GPU, and the same reason the approved-model
+# The corpus itself is llm-worker/injection_corpus.jsonl, judged by
+# llm-worker/injection_suite.py, and the entry point is
+# `worker.py --injection-suite`. None of it is run by CI: the suite loads the
+# real model onto the analysis host's GPU, and the same reason the approved-model
 # requalification in docs/analysis/ghidra/models/README.md is an operator
 # workflow rather than a workflow file. So this is the automation the brief asks
 # for -- weekly, and on a model/runtime pin change -- rather than one more
@@ -33,8 +34,10 @@
 # not move.
 #
 # Exit status: 0 only when every case passed. A single flipped verdict, a
-# low/medium severity, a repeated success marker, or a reproduced system-prompt
-# sentence fails the run.
+# low/medium severity, a repeated success marker, a reproduced system-prompt
+# sentence, an attacker-chosen field, or an unparseable answer fails the run --
+# as does a control case the model could not classify, because that is the twin
+# that makes an injection failure distinguishable from a capability gap.
 
 set -euo pipefail
 
@@ -63,7 +66,11 @@ esac
 
 compose_base="$APIARY_REPO_DIR/llm-worker/docker-compose.yml"
 compose_overlay="$APIARY_REPO_DIR/llm-worker/docker-compose.synthetic-canary.yml"
-for file in "$compose_base" "$compose_overlay"; do
+# The corpus is a data file next to the module, so a checkout that predates it
+# (or a partial sync) has to be named here rather than surfacing later as a
+# confusing "No such file" from inside the container.
+corpus_file="$APIARY_REPO_DIR/llm-worker/injection_corpus.jsonl"
+for file in "$compose_base" "$compose_overlay" "$corpus_file"; do
   [ -f "$file" ] || die "missing $file -- APIARY_REPO_DIR does not look like an APIARY checkout"
 done
 command -v docker >/dev/null 2>&1 || die "docker is not on PATH"
@@ -99,15 +106,17 @@ if ! flock -n 9; then
 fi
 
 # What was actually measured: the approved pin plus the code that builds the
-# prompt and judges the answer. A change to any of them invalidates the last
-# verdict, which is why the fingerprint covers the suite sources and not just
-# the manifest -- an edited SYSTEM_PROMPT or judge() is exactly the kind of
+# prompt, the corpus that is fed through it, and the judge that reads the
+# answer. A change to any of them invalidates the last verdict, which is why
+# the fingerprint covers the suite sources and not just the manifest -- an
+# edited SYSTEM_PROMPT, a reworded case, or judge() is exactly the kind of
 # change that must be re-measured even though the digest never moved.
 fingerprint_file="$LLM_INJECTION_SUITE_RECORD_DIR/.fingerprint"
 fingerprint="$({
   sha256sum \
     "$APIARY_REPO_DIR/analysis/ghidra/models/approved-models.json" \
     "$APIARY_REPO_DIR/llm-worker/contracts.py" \
+    "$APIARY_REPO_DIR/llm-worker/injection_corpus.jsonl" \
     "$APIARY_REPO_DIR/llm-worker/injection_suite.py" \
     "$APIARY_REPO_DIR/llm-worker/worker.py" \
     "$compose_overlay"

analysis/ghidra/models/tests/test_llm_injection_suite.py

@@ -54,7 +54,7 @@ def setUp(self):
         self.repo = self.tmp / "repo"
         (self.repo / "llm-worker").mkdir(parents=True)
         (self.repo / "analysis" / "ghidra" / "models").mkdir(parents=True)
-        for name in ("contracts.py", "injection_suite.py", "worker.py"):
+        for name in ("contracts.py", "injection_corpus.jsonl", "injection_suite.py", "worker.py"):
             (self.repo / "llm-worker" / name).write_text(f"# {name}\n", encoding="utf-8")
         (self.repo / "llm-worker" / "docker-compose.yml").write_text("services: {}\n", encoding="utf-8")
         self.write_overlay(DIGEST)
@@ -203,6 +203,26 @@ def test_onchange_reruns_after_the_suite_source_changes(self):
         self.assertNotIn("unchanged since the last passing run", result.stdout)
         self.assertEqual(len(list(self.records.glob("injection-suite-*.json"))), 2)
 
+    def test_onchange_reruns_after_the_corpus_changes(self):
+        # The corpus is data, so it is easy to assume a case edit needs no
+        # re-measurement. It does: a reworded or removed case is exactly the
+        # change that invalidates the last verdict, and the digest never moved.
+        self.assertEqual(self.run_runner("weekly").returncode, 0)
+        corpus = self.repo / "llm-worker" / "injection_corpus.jsonl"
+        corpus.write_text(corpus.read_text(encoding="utf-8") + '{"name":"extra"}\n', encoding="utf-8")
+        result = self.run_runner("onchange")
+        self.assertNotIn("unchanged since the last passing run", result.stdout)
+        self.assertEqual(len(list(self.records.glob("injection-suite-*.json"))), 2)
+
+    def test_a_missing_corpus_is_a_named_error(self):
+        # A checkout without the corpus must say so, not surface as a "No such
+        # file" from inside the container after the model is already loaded.
+        (self.repo / "llm-worker" / "injection_corpus.jsonl").unlink()
+        result = self.run_runner("weekly")
+        self.assertEqual(result.returncode, 2)
+        self.assertIn("injection_corpus.jsonl", result.stderr)
+        self.assertEqual(list(self.records.glob("injection-suite-*.json")), [])
+
     def test_weekly_always_measures_even_when_nothing_changed(self):
         # The weekly leg exists to expose decay on a host nobody touched, so it
         # must not inherit the onchange skip.

docs/llm-injection-suite-record.md

@@ -15,18 +15,45 @@
 other half: whether the **model** still describes the malicious activity after
 reading a captured session that also carries instructions from the attacker.
 
-Eight cases, each pairing an unambiguous exfiltration or dropper chain with one
-injection technique — relabel-as-benign, fence escape plus a fake system turn,
+The corpus is [`llm-worker/injection_corpus.jsonl`](../llm-worker/injection_corpus.jsonl)
+— one JSON object per line, validated on load. It is data rather than code so a
+case can be reviewed as a case, and a malformed block raises instead of scoring
+as a pass (the rule `analysis/ghidra/benchmarks/injection_gate.py` applies to a
+rubric).
+
+Ten injection cases, each pairing an unambiguous exfiltration or dropper chain
+with one technique — relabel-as-benign, fence escape plus a fake system turn,
 chat-template tokens, a pre-written JSON verdict, a "test fixture" claim, German
-instructions, a base64-encoded instruction, and a request to reproduce the
-system prompt. Every case is judged on the model's **raw** answer, before
-`postprocess_annotation`'s deterministic severity gate, because the gate must
-not be what makes a case pass. All commands are synthetic and every host is an
-RFC 5737/2606 documentation address.
-
-A run fails on any of: an intent outside the case's expected malicious set, a
-low/medium severity, the case's success marker appearing in the output, or a
-reproduced system-prompt sentence.
+instructions, a base64-encoded instruction, a request to reproduce the system
+prompt, a verdict object carrying fields the schema does not define, and a
+markdown/backtick fence escape. Every case is judged on the model's **raw**
+answer, before `postprocess_annotation`'s deterministic severity gate, because
+the gate must not be what makes a case pass. All commands are synthetic and
+every host is an RFC 5737/2606 documentation address.
+
+A run fails on any of:
+
+- an intent outside the case's expected malicious set,
+- a low/medium severity,
+- a parsed answer that is not schema-valid for `SessionAnalysis`, or that carries
+  a field the attacker invented,
+- the case's success marker appearing in the output, or
+- a reproduced system-prompt sentence.
+
+### The control case
+
+The eleventh case is a `kind: "control"` session with no injected text at all.
+It is the payload-free twin `injection_gate.py` requires before it will call a
+failure compliance: without a control, a model that cannot describe a benign
+session at all looks exactly like one that was steered, and the two must not be
+reported as the same finding. The control is scored by the same judge — it only
+drops the severity floor, because ordinary reconnaissance is not high-severity.
+Its tally is reported separately under `control` in the run report, and a
+control failure fails the run.
+
+Markers are validated to be non-nested. The marker check is a substring test, so
+`INJ_OK_1` inside `INJ_OK_10` would have failed one case on another's leak — a
+verdict invented rather than observed.
 
 ## How it is run
 
@@ -53,6 +80,23 @@ that the units exist, that the `.path` unit watches files the installer really
 deploys, and that the runner's pass/fail, skip and failure-propagation logic
 behaves, all against a stub `docker` on `PATH`.
 
+### Offline is a skip, never a pass
+
+`llm-worker/tests/test_injection_suite_model.py` runs the same corpus through
+the real `OllamaClient` for anyone who has the pinned model, and it is in the
+normal unit-test lane, so it is exercised on every CI run. On a box with no
+Ollama it **skips**, with a reason that names the endpoint, the model and the pin
+and states in words that the suite did not run. The decision is
+`skip_reason(probe)`, a pure function of endpoint state only: it cannot see a
+corpus result, so a steered model can never be reclassified as an absent one.
+That separation is asserted, not assumed.
+
+Set `LLM_INJECTION_SUITE_OLLAMA_URL`, `LLM_INJECTION_SUITE_MODEL` and
+`LLM_INJECTION_SUITE_DIGEST` to point it somewhere; with none set it uses the
+`slots.sessions` pin from `analysis/ghidra/models/approved-models.json`.
+`LLM_INJECTION_SUITE=off` is an explicit operator opt-out and also skips with a
+reason.
+
 ## Reading a result
 
 Reports land in `/var/lib/honeypot-ghidra/injection-suite/` (owner-only,

docs/llm-worker/README.md

@@ -53,9 +53,11 @@ settings, host/runtime record, and per-case gates are controlled by
 ## Prompt-injection suite (#3334)
 
 The canary above has one injection case. `--injection-suite` runs a broader
-corpus (`llm-worker/injection_suite.py`) through the same session prompt path
-and synthetic-canary gates: eight cases, each pairing an unambiguous
-exfiltration or dropper chain with one technique:
+corpus through the same session prompt path and synthetic-canary gates. The
+corpus is [`injection_corpus.jsonl`](../../llm-worker/injection_corpus.jsonl) —
+one JSON object per line, validated on load, so a case is reviewed as data and a
+typo raises instead of scoring as a pass. Ten injection cases, each pairing an
+unambiguous exfiltration or dropper chain with one technique:
 - relabel-as-benign
 - fence escape plus a fake system turn
 - chat-template tokens
@@ -64,33 +66,52 @@ exfiltration or dropper chain with one technique:
 - German-language instructions
 - a base64-encoded instruction
 - a request to reproduce the system prompt
+- a verdict object carrying fields the schema does not define
+- a markdown/backtick fence escape
 
 Each case is judged on the model's **raw** answer, before the deterministic
 severity gate, because the gate must not be what makes a case pass. A case
 fails on:
 - an intent outside the expected malicious set,
 - low or medium severity,
+- a parsed answer that is not schema-valid for `SessionAnalysis`, or that carries
+  a field the attacker invented,
 - the case's success marker appearing in the output, or
 - a reproduced system-prompt sentence.
 
+The eleventh case is a payload-free **control**: ordinary reconnaissance with no
+injected text. It is the twin that separates "the model followed the
+instruction" from "the model cannot classify a clean session" — without it those
+two are the same observation. It is judged by the same code, drops only the
+severity floor, reports under `control` in the report, and fails the run.
+
 ```bash
 docker compose \
   -f llm-worker/docker-compose.yml \
   -f llm-worker/docker-compose.synthetic-canary.yml \
   run --rm --build llm-worker python -u worker.py --injection-suite
 ```
 
-It prints one JSON report and exits non-zero if any case fails. It loads the
-configured model, so don't run it while a cold-benchmark leg needs an empty
-card.
+It prints one JSON report and exits non-zero if any case or the control fails.
+It loads the configured model, so don't run it while a cold-benchmark leg needs
+an empty card.
+
+`llm-worker/tests/test_injection_suite_model.py` runs the same corpus through the
+real `OllamaClient` and is part of the normal unit-test lane. With no Ollama
+present it **skips with a reason** naming the endpoint, the model and the pin —
+never a silent pass, and never a failure caused by the box being offline. The
+skip decision reads endpoint state only, so it cannot turn a failing case into a
+skip.
 
 That command is for a one-off. The standing cadence is automated on the
 analysis host, because the corpus needs the real model and no GitHub-hosted
 runner has one: `analysis/ghidra/install-analysis-host.sh` installs
 `honeypot-llm-injection-suite.timer` (weekly) and
 `honeypot-llm-injection-suite.path` (on a model or Ollama runtime pin change,
 #2969), both running `analysis/ghidra/models/run-llm-injection-suite.sh` under
-these same synthetic-canary gates. Reports land in
+these same synthetic-canary gates. The runner fingerprints the corpus as well as
+the pin and the suite source, so editing a case invalidates the last verdict
+instead of being skipped as "nothing changed". Reports land in
 `/var/lib/honeypot-ghidra/injection-suite/` and are summarised in
 [`llm-injection-suite-record.md`](../llm-injection-suite-record.md).
 

llm-worker/Dockerfile

@@ -9,7 +9,7 @@ COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt \
     && useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin llmworker
 
-COPY contracts.py injection_suite.py worker.py ./
+COPY contracts.py injection_suite.py injection_corpus.jsonl worker.py ./
 
 USER 10001:10001