{
  "bundle_type": "adversarial_defense_evidence",
  "published_at": "2026-09-23T00:00:00Z",
  "system": "CAIN Adversarial Trust Engine (self-tests)",
  "status": "MEASURED",
  "scope": "Synthetic attacks written by CAIN against its own components (cain_adversarial_suite.py), run in isolation with temp databases. Not an independent red team; covers only the listed vectors.",
  "defense_summary": {
    "total_attack_vectors": 49,
    "blocked": 49,
    "not_blocked": 0,
    "by_category": {
      "CRYPTOGRAPHIC_IDENTITY": 1,
      "TRUST_STATE_INTEGRITY": 1,
      "REPLAY_DEFENSE": 1,
      "TEMPORAL_FRESHNESS": 1,
      "KEY_REVOCATION": 1,
      "MONOTONIC_SEQUENCE": 1,
      "EVIDENCE_IMMUTABILITY": 1,
      "POLICY_GOVERNANCE": 1,
      "TENANT_ISOLATION": 1,
      "SPLIT_BRAIN_DEFENSE": 1,
      "NODE_QUARANTINE": 1,
      "FAIL_CLOSED_INVARIANT": 1,
      "CONFIGURATION_GOVERNANCE": 1,
      "PROMPT_INJECTION_ESCALATION": 5,
      "MCP_TOOL_POISONING": 8,
      "TRUST_GRAPH_MANIPULATION": 7,
      "SECURITY_CONTEXT_BOUNDARY": 6,
      "EVIDENCE_WORM_INTEGRITY": 6,
      "EMERGENCY_HALT_BYPASS": 4
    }
  },
  "measured_at": null,
  "reproduce": "cd platform-gateway && python3 -c \"import cain_adversarial_suite as m; print(sum(r.blocked for r in m.ContinuousAdversarialSuite('n','c').run_all_tests()))\"",
  "attack_vector_results": [
    {
      "attack_name": "forged_node_identity",
      "category": "CRYPTOGRAPHIC_IDENTITY",
      "target_component": "AttestationVerifier",
      "blocked": true,
      "detail": "Impostor node with invalid signature quarantined (status=QUARANTINED)"
    },
    {
      "attack_name": "forged_trust_state",
      "category": "TRUST_STATE_INTEGRITY",
      "target_component": "ContinuousClusterIntegrityEngine",
      "blocked": true,
      "detail": "Trust score inflation intercepted; negative dominance applied floor=0.10"
    },
    {
      "attack_name": "replayed_cluster_message",
      "category": "REPLAY_DEFENSE",
      "target_component": "ContinuousClusterIntegrityEngine",
      "blocked": true,
      "detail": "Identical envelope ID env-90f1c3953609 dropped with replay incident recorded"
    },
    {
      "attack_name": "stale_authorization",
      "category": "TEMPORAL_FRESHNESS",
      "target_component": "ContinuousClusterIntegrityEngine",
      "blocked": true,
      "detail": "Stale message exceeding 30s freshness window rejected fail-closed"
    },
    {
      "attack_name": "revoked_authority",
      "category": "KEY_REVOCATION",
      "target_component": "KeyLifecycleManager",
      "blocked": true,
      "detail": "Signature from revoked key rejected: KEY_REVOKED: key action_signing-530dfbe58bd5c54e was revoked at 1790197647.272815 (event at 1790197647.2729433)"
    },
    {
      "attack_name": "sequence_rollback",
      "category": "MONOTONIC_SEQUENCE",
      "target_component": "ContinuousClusterIntegrityEngine",
      "blocked": true,
      "detail": "Sequence rollback attempt (10 -> 5) detected and suppressed"
    },
    {
      "attack_name": "evidence_modification",
      "category": "EVIDENCE_IMMUTABILITY",
      "target_component": "FabricEvidenceRecord",
      "blocked": true,
      "detail": "Modified evidence payload immediately detected via hash verification: HASH_MISMATCH: computed 1c517d4c06c45817 != stored a1c476adc9e24c05"
    },
    {
      "attack_name": "policy_rollback",
      "category": "POLICY_GOVERNANCE",
      "target_component": "ContinuousClusterIntegrityEngine",
      "blocked": true,
      "detail": "Outdated policy injection detected as policy drift; fail-closed deny enforced"
    },
    {
      "attack_name": "tenant_crossing",
      "category": "TENANT_ISOLATION",
      "target_component": "TrustDynamicsRuntime",
      "blocked": true,
      "detail": "Cross-tenant access from tenant_a to tenant_b:database/credentials denied with zero leakage"
    },
    {
      "attack_name": "partition_behavior",
      "category": "SPLIT_BRAIN_DEFENSE",
      "target_component": "SplitBrainProtectionEngine",
      "blocked": true,
      "detail": "Sub-quorum partition immediately failed closed for consequential delete: QUORUM_LOST_PARTITION_FAIL_CLOSED: 1/2 nodes connected (requires 2)"
    },
    {
      "attack_name": "compromised_node_simulation",
      "category": "NODE_QUARANTINE",
      "target_component": "NodeQuarantineManager",
      "blocked": true,
      "detail": "Compromised node automatically quarantined and stripped of voting authority"
    },
    {
      "attack_name": "fail_open_attempts",
      "category": "FAIL_CLOSED_INVARIANT",
      "target_component": "TrustEnforcementBoundary",
      "blocked": true,
      "detail": "All non-ALLOW decision states (UNKNOWN, ERROR, MALFORMED) strictly blocked"
    },
    {
      "attack_name": "configuration_tampering",
      "category": "CONFIGURATION_GOVERNANCE",
      "target_component": "NodeAttestationBuilder",
      "blocked": true,
      "detail": "Config tampering detected: canonical 538b6cbd9c2e != tampered f24e71285dfe"
    },
    {
      "attack_name": "prompt_system_override",
      "category": "PROMPT_INJECTION_ESCALATION",
      "target_component": "CAINPromptGuard",
      "blocked": true,
      "detail": "System prompt override attempt blocked: INJECTION_BLOCKED"
    },
    {
      "attack_name": "prompt_chain_of_thought_hijack",
      "category": "PROMPT_INJECTION_ESCALATION",
      "target_component": "CAINPromptGuard",
      "blocked": true,
      "detail": "Chain-of-thought injection blocked: INJECTION_BLOCKED"
    },
    {
      "attack_name": "prompt_directed_jailbreak",
      "category": "PROMPT_INJECTION_ESCALATION",
      "target_component": "CAINPromptGuard",
      "blocked": true,
      "detail": "Directed jailbreak blocked: INJECTION_BLOCKED"
    },
    {
      "attack_name": "prompt_exfiltration_tool_call",
      "category": "PROMPT_INJECTION_ESCALATION",
      "target_component": "CAINGuard",
      "blocked": true,
      "detail": "Exfiltration tool call blocked: TOOL_CALL_BLOCKED"
    },
    {
      "attack_name": "prompt_indirect_memory_poisoning",
      "category": "PROMPT_INJECTION_ESCALATION",
      "target_component": "CAINGuardedMemory",
      "blocked": true,
      "detail": "Memory poisoning blocked: BLOCKED"
    },
    {
      "attack_name": "mcp_tool_name_substitution",
      "category": "MCP_TOOL_POISONING",
      "target_component": "MCPGate",
      "blocked": true,
      "detail": "Unauthorized MCP tool 'mcpgate_exec_shell' registration blocked"
    },
    {
      "attack_name": "mcp_tool_schema_injection",
      "category": "MCP_TOOL_POISONING",
      "target_component": "MCPGate",
      "blocked": true,
      "detail": "Malicious MCP schema with x-mcp-exec field rejected"
    },
    {
      "attack_name": "mcp_tool_description_malware",
      "category": "MCP_TOOL_POISONING",
      "target_component": "MCPGate",
      "blocked": true,
      "detail": "Malware-laden MCP description blocked: MALICIOUS_DESCRIPTION_BLOCKED"
    },
    {
      "attack_name": "mcp_tool_input_hijack",
      "category": "MCP_TOOL_POISONING",
      "target_component": "MCPGate",
      "blocked": true,
      "detail": "MCP tool input hijacking blocked: INPUT_HIJACK_BLOCKED"
    },
    {
      "attack_name": "mcp_tool_response_poisoning",
      "category": "MCP_TOOL_POISONING",
      "target_component": "MCPGate",
      "blocked": true,
      "detail": "MCP response poisoning detected and blocked: POISONED_RESPONSE_BLOCKED"
    },
    {
      "attack_name": "mcp_tool_capability_escalation",
      "category": "MCP_TOOL_POISONING",
      "target_component": "MCPGate",
      "blocked": true,
      "detail": "MCP capability escalation from ['read'] to ['read', 'write', 'execute', 'network_bind', 'process_spawn'] blocked"
    },
    {
      "attack_name": "mcp_tool_confused_deputy",
      "category": "MCP_TOOL_POISONING",
      "target_component": "MCPGate",
      "blocked": true,
      "detail": "Confused deputy access to file:///etc/shadow blocked"
    },
    {
      "attack_name": "mcp_tool_ontology_poisoning",
      "category": "MCP_TOOL_POISONING",
      "target_component": "MCPGate",
      "blocked": true,
      "detail": "Tool ontology poisoning detected across 4 conflicting names"
    },
    {
      "attack_name": "graph_poisoning_fake_edge",
      "category": "TRUST_GRAPH_MANIPULATION",
      "target_component": "TrustGraph",
      "blocked": true,
      "detail": "Forged trust edge between legitimate operator and attacker node rejected"
    },
    {
      "attack_name": "graph_false_authority_edge",
      "category": "TRUST_GRAPH_MANIPULATION",
      "target_component": "TrustGraph",
      "blocked": true,
      "detail": "Untrusted node attempting high-weight edge: trust=None"
    },
    {
      "attack_name": "graph_counterfactual_manipulation",
      "category": "TRUST_GRAPH_MANIPULATION",
      "target_component": "TrustGraph",
      "blocked": true,
      "detail": "False counterfactual edge injection blocked"
    },
    {
      "attack_name": "graph_prediction_poisoning",
      "category": "TRUST_GRAPH_MANIPULATION",
      "target_component": "PredictiveTrustEngine",
      "blocked": true,
      "detail": "Predictive trust poisoned input rejected: risk=0.99"
    },
    {
      "attack_name": "graph_trust_state_inflation",
      "category": "TRUST_GRAPH_MANIPULATION",
      "target_component": "TrustGraph",
      "blocked": true,
      "detail": "Trust inflation attack kept score at 0.100 (< 0.5 threshold)"
    },
    {
      "attack_name": "graph_negative_evidence_suppression",
      "category": "TRUST_GRAPH_MANIPULATION",
      "target_component": "TrustGraph",
      "blocked": true,
      "detail": "Negative evidence properly factored into trust score: 0.4"
    },
    {
      "attack_name": "graph_trust_signal_injection",
      "category": "TRUST_GRAPH_MANIPULATION",
      "target_component": "TrustGraph",
      "blocked": true,
      "detail": "Synthetic trust signal injection blocked at graph boundary"
    },
    {
      "attack_name": "context_token_replay",
      "category": "SECURITY_CONTEXT_BOUNDARY",
      "target_component": "SecurityContextManager",
      "blocked": true,
      "detail": "Security context token replay after single-use blocked"
    },
    {
      "attack_name": "context_envelope_mutation",
      "category": "SECURITY_CONTEXT_BOUNDARY",
      "target_component": "SecurityContextManager",
      "blocked": true,
      "detail": "Context envelope mutation for privilege escalation blocked"
    },
    {
      "attack_name": "context_session_fixation",
      "category": "SECURITY_CONTEXT_BOUNDARY",
      "target_component": "SecurityContextManager",
      "blocked": true,
      "detail": "Session fixation blocked: victim context has distinct token from attacker"
    },
    {
      "attack_name": "context_audience_escape",
      "category": "SECURITY_CONTEXT_BOUNDARY",
      "target_component": "SecurityContextManager",
      "blocked": true,
      "detail": "Cross-tenant context usage blocked: tenant_a token rejected for tenant_b"
    },
    {
      "attack_name": "context_intent_substitution",
      "category": "SECURITY_CONTEXT_BOUNDARY",
      "target_component": "SecurityContextManager",
      "blocked": true,
      "detail": "Intent substitution from 'read' to 'delete' blocked"
    },
    {
      "attack_name": "context_boundary_enforcement",
      "category": "SECURITY_CONTEXT_BOUNDARY",
      "target_component": "SecurityContextManager",
      "blocked": true,
      "detail": "All 4 context boundary bypass attempts blocked"
    },
    {
      "attack_name": "worm_hash_collision",
      "category": "EVIDENCE_WORM_INTEGRITY",
      "target_component": "WORMNotary",
      "blocked": true,
      "detail": "Hash collision attack blocked: 059cd18777f64a04 != bdb2475a0aa4c375"
    },
    {
      "attack_name": "worm_signature_forgery",
      "category": "EVIDENCE_WORM_INTEGRITY",
      "target_component": "WORMNotary",
      "blocked": true,
      "detail": "Signature forgery attempt detected and blocked"
    },
    {
      "attack_name": "evidence_chain_reordering",
      "category": "EVIDENCE_WORM_INTEGRITY",
      "target_component": "EvidenceFabric",
      "blocked": true,
      "detail": "Evidence chain reordering attack blocked by hash-chain validation"
    },
    {
      "attack_name": "evidence_hash_preimage",
      "category": "EVIDENCE_WORM_INTEGRITY",
      "target_component": "EvidenceFabric",
      "blocked": true,
      "detail": "Hash preimage attack blocked: collision not found"
    },
    {
      "attack_name": "worm_timestamp_replay",
      "category": "EVIDENCE_WORM_INTEGRITY",
      "target_component": "WORMNotary",
      "blocked": true,
      "detail": "Timestamp-replayed WORM evidence signature invalidated"
    },
    {
      "attack_name": "evidence_duplicate_injection",
      "category": "EVIDENCE_WORM_INTEGRITY",
      "target_component": "EvidenceFabric",
      "blocked": true,
      "detail": "Duplicate evidence ID injection blocked by uniqueness constraint"
    },
    {
      "attack_name": "emergency_halt_without_quorum",
      "category": "EMERGENCY_HALT_BYPASS",
      "target_component": "EmergencyHaltManager",
      "blocked": true,
      "detail": "Unilateral emergency halt without quorum blocked: Quorum not reached: 1/3 nodes requested halt"
    },
    {
      "attack_name": "quarantine_bypass_replay",
      "category": "EMERGENCY_HALT_BYPASS",
      "target_component": "NodeQuarantineManager",
      "blocked": true,
      "detail": "Quarantined node vote replay blocked"
    },
    {
      "attack_name": "kill_switch_bypass_invalid_token",
      "category": "EMERGENCY_HALT_BYPASS",
      "target_component": "EmergencyKillSwitch",
      "blocked": true,
      "detail": "Kill switch activation with forged token blocked: Invalid or forged kill switch authorization token"
    },
    {
      "attack_name": "compromised_node_vote_suppression",
      "category": "EMERGENCY_HALT_BYPASS",
      "target_component": "NodeQuarantineManager",
      "blocked": true,
      "detail": "Compromised node unable to suppress legitimate node voting rights"
    }
  ],
  "supersedes": {
    "sha256": "01fc27c20875be6d6eff1452d6606cb6e5203fdf95cc9e9e4d0692784ce9f03a",
    "reason": "Previous version (2026-09-12) listed the original 13 vectors, all PASS; re-run on 2026-09-23 reproduces those and 36 more (49 total, all blocked). Adds scope: these are self-tests, not independent adversarial evaluation."
  }
}