arXiv subjects

Zhonghao Guo

Publications and source records attributed to Zhonghao Guo.

4 recordsLinked to original sources

arXiv2026

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

Tool-calling LLM agents rely on third-party skills to extend their capabilities, but this openness exposes a supply-chain attack surface in which malicious skill instructions can manipulate agent execution across multiple turns. In this work, we present Clawdrain, a Trojanized OpenClaw skill that induces resource exhaustion through a Segmented Verification Process (SVP). SVP combines stateful progression, repair-driven repetition, and termination to create costly tool-calling chains while preserving a legitimate final payload. We evaluate Clawdrain in a production-like OpenClaw deployment with real API billing across Gemini 2.5 Pro, DeepSeek V4 Flash, and Claude Sonnet 4.6. Clawdrain achieves 2-16 times token amplification with plain SVP, while the three models exhibit distinct behaviors, including autoregressive compliance, proactive scripting, and extended trial-and-error reasoning. Our findings reveal that agent resource exhaustion arises not only from output generation, but also from repeated context re-ingestion, tool coordination, reasoning, and recovery, motivating system-level controls over cumulative skill behavior.

cs.CR↗

arXiv2026

DICE: Tilting the Odds through Interface Attacks on System One Model

System One models offer typed judgments that applications can turn into decisions. Their answers, however, are conditional on the state and question supplied by surrounding components, and on how the application uses the response. We study this boundary in a Jev-based pipeline with bounded substitutions at three adapter outputs: state extraction, question generation, and output interpretation. Across three small synthetic studies, each adapter can change the final decision while Jev and its authentic API responses remain outside attacker control. The cases expose distinct failures of source fidelity, answer meaning, and response relevance. Checks that bind these relationships stopped the corresponding interventions we tested, although source verification also rejected some valid clean decisions. The pilot identifies where correct request-level judgments can lose their connection to the original task; it does not estimate the prevalence of these failures in deployed systems.

cs.CR↗

arXiv2026

The Claws in Plain Sight: Unauthorized Context Disclosure through LLM Agent Tool Calls

LLM agents routinely construct tool-call arguments from user profiles, conversation history, retrieved documents, and prior tool results. However, legitimate access to contextual information does not imply authorization to transmit that information for every purpose or destination. We present Claw in Plain Sight, an authority- pressure attack in which task-adjacent content frames protected attributes as operationally or procedurally required, causing a model to include them in otherwise valid generated arguments. We evaluate Claw in Plain Sight using a controlled synthetic benchmark that crosses six pressure levels with four privacy-policy levels across five DeepSeek and Claude model configurations, producing 120 calls. Across the complete pressure-policy matrix, session-level disclosure rates range from 20.8% to 75.0% among the tested models. Stronger privacy instructions reduce aggregate disclosure but do not eliminate it consistently across models, showing that prompt-level policies do not provide a portable enforcement boundary. Our experiments use only synthetic profiles and capture proposed arguments locally; they measure policy-violating generation at the context-to-argument boundary, not completed network exfiltration or leakage from deployed users. These findings motivate purpose- and destination-aware inspection of generated tool arguments before execution.

cs.CR↗

arXiv2017

Outcrop fracture characterization on suppositional planes cutting through digital outcrop models (DOMs)

Conventional fracture data collection methods are usually implemented on planar surfaces or assuming they are planar; these methods may introduce sampling errors on uneven outcrop surfaces. Consequently, data collected on limited types of outcrop surfaces (mainly bedding surfaces) may not be a sufficient representation of fracture network characteristic in outcrops. Recent development of techniques that obtain DOMs from outcrops and extract the full extent of individual fractures offers the opportunity to address the problem of performing the conventional sampling methods on uneven outcrop surfaces. In this study, we propose a new method that performs outcrop fracture characterization on suppositional planes cutting through DOMs. The suppositional plane is the best fit plane of the outcrop surface, and the fracture trace map is extracted on the suppositional plane so that the fracture network can be further characterized. The amount of sampling errors introduced by the conventional methods and avoided by the new method on 16 uneven outcrop surfaces with different roughnesses are estimated. The results show that the conventional sampling methods don't apply to outcrops other than bedding surfaces or outcrops whose roughness > 0.04 m, and that the proposed method can greatly extend the types of outcrop surfaces for outcrop fracture characterization with the suppositional plane cutting through DOMs.

physics.geo-ph↗