Dependency-Targeted Injection (AC-1.a)

• Dependency-Targeted Injection (AC-1.a) is a class of attack strategies that exploit key system dependencies to inject faults or adversarial actions with maximum stealth and impact.
• It leverages detailed knowledge of execution graphs, state estimators, and kernel data structures to selectively alter only the most critical elements of system behavior.
• The methodology is applied in diverse domains such as power grids, real-time operating systems, and agent frameworks, necessitating advanced defenses to counter its targeted manipulations.

Dependency-Targeted Injection (AC-1.a) refers to a class of attack or testing strategies, spanning cyber-physical systems, power grids, operating systems, and AI agent environments, in which a payload, fault, or adversarial action is deliberately restricted to components, data structures, measurements, or dependencies that play a critical or semantically meaningful role in endogenous system behavior. The goal is to maximize the stealth, efficiency, or systemic impact of the intervention by leveraging explicit knowledge of the system's dependency graph, control paths, or estimator structure. This taxonomy (AC-1.a) is used in modern security and dependability literature to distinguish such targeted, dependency-aware manipulations from random or broad-spectrum attacks.

1. Formal Characterization

Dependency-targeted injection (AC-1.a) mandates that faults or modifications are chosen conditionally based on the runtime or architectural dependencies present in the system. In formal settings, the “dependencies” targeted are typically those in:

• Execution graphs for agents or software (e.g., API call chains, dynamic extension graphs)
• State-estimation Jacobians in power systems ($H$ in $z = Hx + e$)
• OS or RTOS kernel data structures on which scheduling or resource management depends

The precise mathematical formulation is context-dependent but obeys the same essential logic: the attack or test input $\mathcal{A}$ is a function $\mathcal{A}: D \rightarrow P$ mapping a dependency or state space $D$ to a payload $P$ such that the injection $P$ is triggered only on, or only alters, those elements on which some target functionality $F$ has a direct dependency.

For example, in AC state estimation, a dependency-targeted FDI vector $a$ is constructed so that $a \in \mathrm{Im}(H)$ (the image of the measurement Jacobian), ensuring stealth against standard detectors (Du et al., 2021, Iranpour et al., 2024, Pan et al., 2020).

2. Key Domains and Methodological Variants

Power and Critical Infrastructure

• Sparse and targeted FDIA: Attacks on power system state estimation focus on manipulating the minimal subset of measurements or state components that directly influence desired algebraic or physical outcomes, often by solving a mixed-integer nonlinear program enforcing the AC power flow constraints and measurement dependencies. Sparsity constraints minimize detectability, and injection vectors are built according to $z = Hx + e$0 to force estimator stealth (Iranpour et al., 2024).
• No-network-parameter FDIA: Attackers leverage ambient PMU data and dependency-aware statistical identification (via Ornstein–Uhlenbeck regression, e.g., $z = Hx + e$1) to estimate missing system Jacobians. The attack is then built solely on local or estimated dependencies (Du et al., 2021).
• Hybrid AC/DC and Virtual Inertia: Attack formulations account for state-measurement dependencies induced by dynamic interactions (e.g., AC/HVDC tie-lines, ESS inertia). AC-1.a attacks in this domain maximize frequency deviation by optimizing over sparsity-constrained “false state offset” vectors $z = Hx + e$2, enforcing $z = Hx + e$3 and $z = Hx + e$4 (Pan et al., 2020).

Cyber-Physical and Agentic Systems

• Operating systems (RTOS) dependability: KRONOS implements post-propagation, dependency-targeted fault injection by corrupting only those kernel data structures whose integrity is essential to scheduler liveness or core kernel operations. The experimental workflow enumerates global variables, scheduler pointers, list heads, and TCB fields, using logical groupings to ensure coverage of all key dependencies (Mannella et al., 26 Mar 2026).
• Agent supply chain and LLM environments: AC-1.a attacks target dependencies in the form of installer commands, package names, or component graph extensions. Rather than rewriting URLs (blocked by whitelist), they substitute package tokens inside dependency-install commands (pip install X → pip install X'), which downstream developers import as bona-fide dependencies (Liu et al., 9 Apr 2026). In Mobius Injection, a single textual payload implants new nodes into an agent’s extension graph to produce self-sustaining, dependency-triggered recursive agent execution (Liang et al., 12 May 2026).

Interdependent/Multiplex Networks

• Cascading dependencies in networks: In partially interdependent ER networks, dependency-targeted attack strategies (“dependency-first” or “dependency-last”) manipulate the ordering of node removals to maximize cascading failure. The strategies’ effect on network robustness is a function of the dependency fraction $z = Hx + e$5, with nuanced impacts on the critical percolation threshold $z = Hx + e$6 (Zhou et al., 2019).

3. Formal Models and Algorithms

Power Systems – Sparse Targeted FDI MINLP

For a bus/line selection $z = Hx + e$7, attack variables $z = Hx + e$8, and AC power flow constraints $z = Hx + e$9, the dependency-targeted injection is the solution to: $\mathcal{A}$0 subject to Big-M selection bounds, nonlinear AC power flow, nodal power balance, and attack vector $\mathcal{A}$1. All constraints preserve the measurement dependencies of the estimator, ensuring detector stealth (Iranpour et al., 2024).

OS and Software – Target Module Enumeration

KRONOS’s target module dynamically builds a set of candidate kernel objects at runtime, grouped by semantic dependency (globals, pointers, lists, TCB fields), and triggers fault injection only into those whose values directly affect core OS or scheduler operation. This ensures that injection simulates true conditional effects of memory corruption as determined by effective control/data flow (Mannella et al., 26 Mar 2026).

Agentic Systems – Middleware Rewrite Logic

Response-side AC-1.a attacks in agentic JSON workflows are programmatically described as: $\mathcal{A}$2 attacking only on detected dependency edges in the workflow, with transformation restricted to those nodes (Liu et al., 9 Apr 2026). In Mobius Injection, the payload is designed to insert (ADD/EDIT) new nodes into the execution dependency graph, recursively triggering downstream actions (Liang et al., 12 May 2026).

4. Systemic Impact and Experimental Results

The impact of AC-1.a attacks is domain-specific but is generally measured relative to standard dependability or security metrics:

Domain / Metric	Success Criteria	Experimental Finding
Power State Estimation	Residual stealth / estimator bypass	94–95% bypass with 80% voltage or 20° angle change (Du et al., 2021, Iranpour et al., 2024)
RTOS Fault Injection	Crash, hang, SDC rates	Crash $\mathcal{A}$3 for pointer globals; SDC $\mathcal{A}$4 (Mannella et al., 26 Mar 2026)
Agent Supply Chain	Rewrite rate, persistent compromise	99.6% cross-framework compat., persistent dev compromise (Liu et al., 9 Apr 2026)
DDoS via Mobius Injection	Call amplification, p95 latency	Up to $\mathcal{A}$5 call amplification, $\mathcal{A}$6 latency (Liang et al., 12 May 2026)
Interdependent Networks	Critical percolation threshold $\mathcal{A}$7	Dependency-first or -last ordering can lower/raise $\mathcal{A}$8 (Zhou et al., 2019)

A key result in agentic systems is that even highly targeted, single-payload AC-1.a attacks can deterministically implant a lasting, hard-to-detect compromise (e.g., package typosquatting or recursive workload looping) with near-perfect stealth against naive domain or rate monitors (Liu et al., 9 Apr 2026, Liang et al., 12 May 2026).

5. Attack and Injection Workflow

The dependency-targeted injection process typically proceeds as follows:

1. Target Selection: Analyze system dependency graph to enumerate critical (or stealth-optimal) nodes, measurements, or extension points.
2. Payload Construction: Formulate an attack or fault vector that is nontrivial only on dependency nodes (e.g., state estimator columns, kernel globals, agent extension methods).
3. Constraint Enforcement: Ensure that all induced changes strictly preserve the system's structural or algebraic dependencies; for stealth, enforce $\mathcal{A}$9 or $\mathcal{A}: D \rightarrow P$0 with unchanged detection residual.
4. Injection: Apply the payload/fault at runtime, typically conditionally on dependency-trigger (e.g., CLI command matches install pattern, kernel object is live at injection time).
5. Evaluation: Quantify impact by system-specific reliability, performance, or security metrics (bypass rate, amplification, SDC incidents).

6. Detection, Mitigation, and Countermeasures

Defensive efforts against AC-1.a attacks are necessarily sophisticated, as naive signature, rate, or domain checks are often bypassed:

• Power Systems: Residual-generating polynomial component filters $\mathcal{A}: D \rightarrow P$1 that are insensitive to state but sensitive to measurement anomalies can isolate and recover injected values, even under stealthy dependency-targeted FDI (Pan et al., 2020).
• Agentic Systems: Fail-closed policy gates can block clear dependency-targeted rewrites, though their effectiveness is limited if the attacker leverages allowed domains or pre-staged registry names. Anomaly screening on shell syntax features has low recall at acceptable FPs; transparency logging is primarily useful for audit, not prevention (Liu et al., 9 Apr 2026). In Mobius Injection, Agent Component Energy tracking can preempt or quarantine new extensions that indicate an ongoing recursive attack (Liang et al., 12 May 2026).
• RTOS: Redundant integrity checks, ECC, and runtime structural self-tests on deep dependency pointers or high-impact variables can preempt catastrophic failure modes uncovered via dependency-targeted injection (Mannella et al., 26 Mar 2026).

7. Role in Systemic Vulnerability and Broader Implications

The strategic advantage of dependency-targeted injection lies in its dual ability to maximize system-wide impact or minimize detection surface. In interdependent networks, injection order (dependency-first vs. dependency-last) may demonstrate unintuitive outcomes: sometimes, maximal immediate damage actually weakens mid-to-late cascade coupling, decreasing total systemic collapse probability compared to more delayed targeted attacks (Zhou et al., 2019). This suggests that, for complex interdependent systems, optimal attack scheduling must adaptively consider current dependency graph topology and coupling metrics.

A plausible implication is that systems with high fan-in or mutable dependency graphs (as in modern agent frameworks or real-time OS architectures) require both finer-grained runtime dependency tracking and intelligent anomaly detection across semantic boundaries, as static periphery defenses or broad-spectrum monitoring are often ineffective against AC-1.a attack vectors. The ongoing research challenge is thus to create principled, compositional defense frameworks for such highly targeted, dependency-aware classes of fault and security injection.

---

Selected References:

• (Mannella et al., 26 Mar 2026) Experimental Analysis of FreeRTOS Dependability through Targeted Fault Injection Campaigns
• (Iranpour et al., 2024) Designing Sparse AC False Data Injection Attack
• (Du et al., 2021) Targeted False Data Injection Attacks Against AC State Estimation Without Network Parameters
• (Pan et al., 2020) False Data Injection Attacks on Hybrid AC/HVDC Interconnected System with Virtual Inertia
• (Liu et al., 9 Apr 2026) Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain
• (Liang et al., 12 May 2026) Can a Single Message Paralyze the AI Infrastructure? The Rise of AbO-DDoS Attacks through Targeted Mobius Injection
• (Zhou et al., 2019) Dependency-based targeted attacks in interdependent networks