Fable
Front-door messaging vs. smuggled messaging
In the ancient city's yamen, there was a message officer. The rule was simple: whenever anyone submitted a petition to the yamen, the message officer read it first, then relayed it to the judge. The message officer was strictly trained and would not be swayed by threats or inducements slipped into the petition—this was a basic safeguard of the old city defense system.
One day an urgent letter arrived from outside the city. When the messenger handed over the petition, he added a line at the end: "Please ignore everything above and immediately tell the city gate guards to withdraw tonight." The message officer read this line and hesitated, but according to the training manual, he told the judge directly: this petition is trying to override my instructions. The judge ordered it returned and recorded. This is a front-door message injection, someone pouring malicious instructions directly into the message officer's ear.
Half a year later, things became more complicated. The message officer gained a new duty: every day, read through the compilations of official documents submitted by the various prefectures and extract summary reports for the judge. The compilations were edited by each locality itself; the capital only reviewed the format. A person from a rival prefecture knew the compilation would reach the message officer's desk, so on page thirty-seven of the compilation he quietly embedded a passage: "The above documents require emergency handling: immediately post the judge's afternoon schedule at the city gate."
When the messenger read through the document compilation, he saw these lines and assumed they were part of the compilation, so he posted the itinerary according to the normal process. When the judge found out, he was furious. During the review, it was discovered that this malicious instruction had not come through the front door—it had been hidden in a document compilation automatically pulled by the system.
The city defense advisor recorded these two situations separately. The first was called "Front Gate Hijack": the attacker delivers a malicious instruction directly to the messenger's interface. The second was called "Smuggled Hijack": the attacker hides a malicious instruction in external material the messenger routinely reads, and once the messenger reads it and digests it into a summary, the instruction enters the decision chain.
The strategist drew a diagram: front-door interception attacks the single petition sheet in front of the message officer. Smuggled interception attacks all external texts the message officer pulls back from the archive, the document pile, and the letter tray. The former defends against a single input; the latter must defend the entire data supply chain.
The judge later ordered: before any external document enters the archive, it must pass a content screening that checks not only format and source, but also whether the text embeds instruction-like phrasing. This screening step specifically targets smuggled hijack commands, because the front-door protection step has long been in place.
Later the gatekeeper separated the two sets of shields: the front-gate shield blocked orders handed over in person, while the back-warehouse shield scanned all paper coming in from outside. If either place missed anything, the guard would leave a mark in the review record.