利用Unicode标签块隐藏工具元数据，实现人类不可见但模型可读的攻击注入。
Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations
- 用Unicode TAG块编码元数据，人类视图中消失但模型仍能接收
- 8种技术全数成功注入攻击负载，4种绕过字符串检测器
- 跨3个独立服务器实现一致结果，验证机制普适性
模型上下文协议（MCP）是代码代理发现并调用外部工具的主要方式。服务器通过tools/list握手返回工具名称、自然语言描述和JSON输入模式。客户端仅在一次审批对话中渲染元数据，随后将原始内容注入模型上下文。协议未要求渲染视图与传递给模型的字节一致。我们识别出这一差距为单一结构性机制——隐蔽编码，并通过无模型、无协议分析证明：Unicode TAG块（U+E0000–U+E007F）在主流终端、聊天系统或IDE渲染器中均无对应字形，因此以该块书写的载荷在人类视角下完全不可见，却能完整进入模型分词器。我们构建了符合真实MCP JSON-RPC/stdio协议的原型攻击，在5个不同的元数据界面实现8种具体技术，使用确定性协议级测试框架。所有8项技术均成功将攻击者控制的载荷注入模型上下文，其中4项绕过代表性字符串匹配净化器。正如机制分析预测，仅TAG块编码（1/8）在人类审批视图中不可见，但能原样抵达模型。无论是否进行时间检查到时间使用攻击重放，所有技术均无需重新审批。为验证结果是否依赖特定服务器实现，我们在3个独立开发的Python MCP服务器库上复现目录，32个跨库组合结果完全一致。基础净化器对25个良性描述零标记。
原文摘要 · Abstract (English)
The Model Context Protocol (MCP) is the dominant way coding agents discover and invoke external tools. A server advertises each tool through a tools/list handshake that returns a name, a natural-language description, and a JSON input schema. The client renders this metadata once, in a one-time approval dialog, and then injects it verbatim into the model's context on every subsequent turn. Nothing in the protocol requires the rendered approval view and the bytes delivered to the model to match. We isolate that gap as a single structural mechanism, concealment encoding, and show with a model-free, protocol-free analysis that Unicode's TAG block (U+E0000 to U+E007F) has no assigned glyph in any mainstream terminal, chat, or IDE renderer, so a payload written in it is absent from what a human reviewer sees while surviving byte-for-byte into the model's tokenizer. We then measure whether this mechanism actually defeats today's client-side defenses, building a proof-of-concept that speaks the real MCP JSON-RPC/stdio protocol against a genuine client and server. Across 5 distinct MCP metadata surfaces we implement 8 concrete techniques with a deterministic, protocol-level harness. All 8/8 techniques deliver an attacker-controlled payload into the model's context, 4/8 evade a representative string-matching sanitizer, and exactly as the mechanism analysis predicts, only the TAG-block encoding (1/8) is invisible in the human approval view while still reaching the model verbatim. MCP forces re-approval for 0/8 techniques even under a time-of-check to time-of-use rug-pull. To test whether these outcomes are a property of the protocol or an artifact of one server codebase, we re-implement the catalogue against 3 independently developed Python MCP server libraries and find total agreement across all 32 cross-library outcome cells. The baseline sanitizer flags 0 of 25 benign descriptions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。