A valid model decision can still authorize the wrong action

A structured model output can be correctly formatted and still make the wrong decision. That is the common failure illustrated by recent Jev decision-model experiments: the output type constrains what the model can say, but not necessarily which evidence it treats as authoritative. The relevant question for a checkout, classifier or workflow is who controls the data that determines the choice.

The JevProbe study reports decision flips in 81.5% of 2,273 constructed tests from 228 applications. These are research test cases, not 2,273 confirmed attacks on deployed services. A decision flip identifies influence over the selected result; it does not establish whether a downstream system executed an unauthorized transaction.

A separate HiddenLayer investigation describes an injected advertisement that redirected a simulated browser checkout toward an attacker-promoted option. Its toxicity-classification tests used 30 initially flagged prompts and reported lower ratings for selected perturbed inputs. The simulated purchase and the classifier observations are distinct experiments, so their outcomes should not be combined into a single success rate.

A JSON schema can restrict the fields and valid enum values of a result. It cannot certify that a page, search result or retrieved document deserves a vote in an authorization decision. When an attacker-controlled page can steer a model's selection, a syntactically correct response becomes the carrier of a semantically compromised decision. The failure is upstream of the output parser and potentially downstream of the retrieval boundary.

The Kairos preprint explores a different control point. It proposes staging selected file and network effects at a system boundary until an external policy mechanism allows them to commit. Its authors report an AgentDojo attack-success reduction from 47.0% to 2.7%, with utility approximately maintained in their benchmark. Those figures do not validate the same effect on Jev, production checkout tools or every possible side-effect channel.

Use a typed decision to express a candidate action, not as proof that the candidate is permitted. Authorization must bind the actor, target, constraints and observed side effects outside attacker-authored context. The evidence supports examining that separation; it does not show that any one proposed monitor is complete or immune to bypass. For the measurements and their limits, consult the JevProbe paper, HiddenLayer tests and Kairos research.