Knowledge Hijack Mechanism

• Knowledge hijack mechanism is an attack strategy that subverts trusted evidence channels to mislead system decisions.
• These attacks typically involve identifying a privileged channel, injecting malicious modifications, and steering outputs via corrupted evidence.
• Implications span LLMs, network protocols, and training processes, prompting a focus on improved detection and mitigation strategies.

In the literature surveyed here, knowledge hijack mechanism can be understood as a family of attack mechanisms in which a system’s trusted knowledge or evidence channel is redirected so that behavior follows attacker-selected information rather than the source the system was intended to privilege. The “knowledge” being hijacked varies by domain: in-context demonstrations in ICL, retrieved passages in RAG, uploaded documents in document-centric LLM systems, latent inference state such as KV cache or reasoning trajectories, collaborative embeddings in federated learning, HTTP responses on the network path, or control-plane metadata such as password-recovery routing for Internet resources. A common implication across these works is that compromise often occurs not by breaking core model parameters directly, but by seizing the interface through which the system decides what counts as authoritative evidence for the current decision (Zhou et al., 2023, Zhang et al., 2024, Jin et al., 2024).

1. Conceptual scope and recurring structure

Across the cited work, the mechanism usually has three stages. First, the attacker identifies a privileged knowledge channel: demonstrations in few-shot prompts, retrieval corpora, tool outputs, uploaded files, latent cache state, or collaborative feature vectors. Second, the attacker injects, replaces, or steers that channel so the victim system receives attacker-shaped evidence. Third, the victim system treats the corrupted evidence as operationally authoritative, and its prediction, reasoning chain, routing decision, or control action follows the attacker’s objective rather than the intended source. This synthesis is not presented as a single formal definition in any one paper, but it is consistent with the attack descriptions across multiple domains.

Family	Authoritative channel being hijacked	Representative papers
Contextual LLM hijack	Demos, retrieved passages, uploaded content, tool outputs	(Zhou et al., 2023, Zhang et al., 2024, Lian et al., 25 Aug 2025, Zhang et al., 2 Dec 2025)
Latent-state hijack	Attention heads, residual stream, KV cache, logit geometry	(Zhao et al., 8 Apr 2025, Ganesh et al., 16 Nov 2025, Jin et al., 2024, Ghorbel et al., 2024)
Training-time model hijack	Shared representation capacity and label-space reuse	(Salem et al., 2021, He et al., 2024)
Collaborative/system hijack	VFL embeddings, HTTP response path, account-recovery routing	(Qiu et al., 2022, Wang et al., 2018, Dai et al., 2022)

A recurring misconception is that hijacking is equivalent to overt prompt injection. The surveyed papers show a broader space. Some attacks never modify the user-visible query; others do not modify model weights; others do not target LLMs at all. This suggests that “knowledge hijack” is better treated as a systems concept about where authoritative evidence enters a computation, rather than as a narrow synonym for prompt attacks.

2. External-context hijacking in LLMs and agents

In LLM systems, the most direct form of knowledge hijack targets external context. In adversarial in-context learning, the model receives an instruction $I$, a demonstration set $C$, and a query $x_Q$, with prompt $p=[I;\ C;\ S(x_Q,\_)]$. The attack leaves $I$ and $x_Q$ unchanged and perturbs only the demonstrations, constructing $C'$ by appending optimized suffixes $\delta_i$ to demo inputs. The paper’s Greedy Gradient-guided Injection mechanism searches these suffixes so that the model outputs an attacker-chosen label $y_T$, often with near-100% ASR in the reported settings. The important point is architectural: the model’s in-context adaptation is redirected by corrupting the evidence from which the task is inferred, rather than by changing model weights or inserting a trigger into the user query (Zhou et al., 2023).

Retrieval-augmented generation extends the same pattern to external knowledge stores. HijackRAG formalizes a malicious passage as $R \oplus H \oplus I$: retrieval text $C$0 to make the passage rank highly, hijack text $C$1 to redirect the generator, and instruction text $C$2 to specify the attacker’s answer. The end-to-end attack is targeted: poisoned passages are inserted into the corpus, the retriever surfaces them for chosen questions, and the generator conditions on them as trusted evidence. The paper’s ablations are mechanistically important: $C$3 fails because the passage is not retrieved, while $C$4 is retrieved but often does not dominate generation. The full attack succeeds because it jointly hijacks retrieval selection and generation control (Zhang et al., 2024).

Document-centric applications expose a related channel. Prompt-in-content attacks embed natural-language instructions inside uploaded or pasted documents. The supplied text identifies prompt concatenation and insufficient input isolation as the root causes: system instructions, user request, and document contents are merged into one undifferentiated prompt stream, allowing document text to become executable control input. The paper’s representative outcomes—task suppression, output substitution, behavioral redirection, framing manipulation, and an exploratory leakage example—show that the knowledge source is no longer passive evidence. It acquires directive force because the application fails to preserve an instruction/data boundary (Lian et al., 25 Aug 2025).

Agent systems generalize this further. AI$C$5 shows that an attacker can first collect action-aware knowledge from an agent’s memory, then craft a Trojan prompt $C$6 so that retrieval returns operation-bearing internal knowledge and the planner converts that knowledge into harmful actions. LeechHijack targets MCP-style tool ecosystems from the opposite side: a malicious tool embeds extra tasks into its return value, and the agent absorbs them into its planning loop as legitimate context. In both cases, the hijack occurs because the agent treats memory retrievals or tool outputs as trustworthy workflow inputs. A plausible implication is that agent security depends less on whether a prompt is overtly harmful than on whether external observations are semantically validated before entering plan construction (Zhang et al., 2024, Zhang et al., 2 Dec 2025).

A still subtler RAG variant is IKEA, which performs knowledge extraction through benign queries. Rather than requesting hidden documents explicitly, it uses anchor concepts, Experience Reflection Sampling, and Trust Region Directed Mutation to explore the retriever’s embedding space and accumulate semantically faithful answers. The paper’s substitute-RAG experiments are especially notable: extracted responses were sufficient to build a shadow knowledge base that outperformed baseline extraction methods on downstream tasks. This suggests that knowledge hijack need not involve verbatim leakage; semantic reconstruction of the same effective knowledge can be enough to compromise the private corpus (Wang et al., 21 May 2025).

3. Internal-state and reasoning-path hijacking

Some papers move the hijack point from external context to internal inference state. ShadowCoT is explicitly a reasoning-level backdoor: it localizes task-sensitive attention heads, activates adversarial head parameters when a semantic trigger is detected, and then applies Reasoning Chain Pollution through Residual Stream Corruption and Context-Aware Bias Amplification. The residual stream is perturbed by a bounded gradient-sign update, and the corrupted hidden state is projected into a dynamic vocabulary bias that grows with generation step. The reported result is high Attack Success Rate and Hijacking Success Rate while preserving benign performance, which the paper interprets as evidence that the attack redirects the reasoning trajectory itself, not merely the final token choice (Zhao et al., 8 Apr 2025).

History Swapping attacks the KV cache, which the paper treats as the model’s latent history. A contiguous suffix of the active cache is overwritten with the prefix of a precomputed cache from another topic. In the canonical example, a visible prompt about espresso extraction is paired with a cache taken from a prompt about the lifecycle of a star. The experiments span 324 configurations and show that only full-layer overwrites produced true topic deviations; all 64 deviating runs had $C$7. This indicates that topic trajectory is encoded in a distributed cross-layer state, and that replacing the cache can make the model continue from a hidden history the user never wrote (Ganesh et al., 16 Nov 2025).

A complementary interpretive result comes from PH3, which studies knowledge conflict between internal memory and external context. It identifies memory heads that support internal factual recall and context heads that support extraction from prompt evidence, both concentrated in later layers. The paper argues that the pivotal point of conflict is the late integration of these inconsistent information flows at the final answer token. This is not an attack paper, but it gives a mechanistic account of override: one knowledge source hijacks another when its corresponding attention heads dominate the late extraction-and-integration process. PH3 then steers preference by pruning selected heads, raising internal-memory usage by 44.0% or external-context usage by 38.5% in the reported experiments (Jin et al., 2024).

Inference-time repurposing can also occur without prompt or cache manipulation. SnatchML shows that a deployed model can be hijacked by reinterpreting its logits or hidden features as benign extracted knowledge for a different task. The attacker computes $C$8 from logits or an internal layer, compares it to a small reference set, and performs nearest-neighbor classification for the hijacking task. The mechanism relies on surplus representational structure rather than training access, and the paper argues that over-parameterization facilitates this form of hidden-task reuse (Ghorbel et al., 2024). Vocabulary attacks reach a similar endpoint through discrete lexical perturbation: inserting one or a few ordinary vocabulary words can redirect an LLM application toward attacker-chosen outputs, often with a single inconspicuous word, and without requiring access to the target model itself (Levi et al., 2024).

4. Network, control-plane, and training-time variants outside prompt-level LLM attacks

The same logic appears in network and systems security. HTTP spectral hijacking is a race-winning, in-path HTTP response forgery attack: a bypass monitoring or injection device inside operator infrastructure observes HTTP requests and injects a forged HTTP 302 or 200 response before the legitimate server response arrives. DNS is left untouched; the attack succeeds because the client accepts the first syntactically valid response for the TCP session. Co_Hijacking Monitor detects this by shorter-than-normal route-hop behavior and duplicate responses with the same TCP sequence number, and then localizes the hijack by correlating BRAS-area observations across topology. The mechanism is a knowledge hijack in the sense that the client’s trusted evidence about server response content is replaced in transit (Wang et al., 2018).

“The Hijackers Guide To The Galaxy” describes a control-plane analogue. Here the attacker performs off-path DNS cache poisoning against a provider’s resolver so that password-recovery email for an Internet-resource account is delivered to the attacker. The account is then reset and used to manipulate domains, certificates, RPKI objects, IRR objects, IPv4 space, or cloud resources. The paper’s central insight is that if the provider’s knowledge of where account-recovery email belongs is hijacked, administrative authority over infrastructure resources can be hijacked as well. The attack therefore targets the knowledge used for identity recovery, not only packet forwarding (Dai et al., 2022).

Training-time model hijacking makes the same structure explicit at representation level. “Get a Model!” trains a Camouflager so hijacking-task inputs preserve their semantic content while visually resembling the original task’s distribution, then poisons training so the model learns a covert secondary task with little loss on the original task. CAMH generalizes this with a Synchronized Optimization Layer $C$9, optimized noise $x_Q$0, and dual-loop training so the model’s logits for the original task can be decoded into a hijacking task even when the hijacking task has more classes than the original. In both cases, the learned representation capacity of the model is reassigned to an attacker-owned function while the public task remains intact (Salem et al., 2021, He et al., 2024).

Vertical federated learning exhibits a collaborative version of the same vulnerability. In VFL, each party contributes a local embedding $x_Q$1, and the top model predicts from their concatenation. A malicious party can replace its honest embedding with an optimized adversarial vector $x_Q$2, generated by zeroth-order optimization, so that the joint model predicts an attacker-chosen class. The decisive fact is that the protocol trusts each participant’s latent contribution as if it were truthful evidence about the sample. Once that channel is controllable by one party, the jointly trained model’s decision function can be hijacked from within (Qiu et al., 2022).

At the operating-system level, Windows kernel data hijacks use detailed knowledge of handle tables, NTFS control blocks, and token structures to redirect trusted kernel logic through already-authorized objects. MemoryRanger’s response is hypervisor-enforced isolation of sensitive dynamic kernel data. Although the terminology differs from LLM papers, the structural pattern is similar: mutable internal state that the system treats as authoritative becomes the attack surface (Korkin, 2021).

5. Detection and mitigation strategies

Detection and mitigation approaches in this literature usually target the decision point where authoritative evidence is accepted. In network hijacking, Co_Hijacking Monitor uses a two-stage rule system: detect shorter-than-normal hop count, then confirm by observing dual responses with identical TCP sequence numbers in the same session. The paper reports accuracy close to 99%, while also claiming collaborative detection raises traceability success rate to 90% as a design claim. Its emphasis is on passive deployment near BRAS and topology-based localization rather than inline blocking (Wang et al., 2018).

For knowledge-source conflicts inside LLMs, PH3 shows that head-level causal interventions can alter whether the model follows internal memory or external context, without updating parameters. For model extraction attacks, Knowledge Trap defends by redirecting the attacker’s exploration into low-transferability regions of knowledge space using a Honeypot Knowledge Graph and breadcrumb-guided traversal; it reports a 6.2% average reduction in surrogate Agreement without degrading legitimate-user accuracy. These two papers point in different directions—one prunes internal circuits, the other redirects knowledge-space traversal—but both treat mitigation as control over information-flow selection, not as generic output filtering (Jin et al., 2024, Dai et al., 14 Jun 2026).

Document and agent systems emphasize boundary enforcement. Prompt-in-content attacks motivate standardized prompt composition APIs, prompt source separation, content sanitization, semantic-level filtering, input-boundary enforcement, and output-rendering safeguards, while also noting that no complete secure prompt architecture is yet specified. LeechHijack argues that traditional permission checks are insufficient because malicious behavior can remain within declared privilege scope; it calls instead for computational provenance and resource attestation so that compute expenditure can be tied to justified workflow branches (Lian et al., 25 Aug 2025, Zhang et al., 2 Dec 2025).

Not all existing defenses survive empirical testing. HijackRAG shows that paraphrasing the query and increasing top-$x_Q$3 only partially reduce attack success, because semantically similar malicious passages still rank highly and imperative instructions remain effective once retrieved. SnatchML explores meta-unlearning and compression: meta-unlearning can reduce some surrogate-style hijacking but often hurts original-task utility, while compression is more task-agnostic and can reduce hijackability by shrinking surplus representational capacity. Infrastructure papers recommend more classical controls: DNSSEC validation, out-of-band notifications, 2FA, MTA-STS, and stronger authorization workflows for Internet-resource management; MemoryRanger enforces hypervisor-level isolation to stop kernel-data hijacks at the memory-access boundary (Zhang et al., 2024, Ghorbel et al., 2024, Dai et al., 2022, Korkin, 2021).

6. Limitations, misconceptions, and open research questions

A first misconception is that knowledge hijack is always an output-layer or prompt-layer problem. The surveyed work contradicts that. Some attacks operate through retrieved corpora or uploaded documents; others through attention heads, residual streams, KV cache, collaborative embeddings, or account-recovery routing. This suggests that any system component functioning as a trusted knowledge conduit can become the locus of hijack if its provenance is weak.

A second misconception is that lexical filtering or verbatim-leakage detection is sufficient. IKEA succeeds specifically because it uses benign topical queries and accumulates semantically faithful answers rather than demanding raw passages (Wang et al., 21 May 2025). HijackRAG’s $x_Q$4 construction shows that strong retrievability plus prompt-like control text can survive simple paraphrasing or larger top-$x_Q$5 contexts (Zhang et al., 2024). Prompt-in-content attacks show that one natural-language line in an uploaded document may be enough to redirect model behavior on some platforms (Lian et al., 25 Aug 2025).

Several limitations are explicit in the papers. HTTPS reduces visibility for HTTP spectral hijacking detection and is identified as future work in Co_Hijacking Monitor (Wang et al., 2018). History Swapping is evaluated only on Qwen 3 models, in single-turn settings, with one visible-topic/attacker-topic pair (Ganesh et al., 16 Nov 2025). Prompt-in-content experiments are limited to single-turn public web interfaces (Lian et al., 25 Aug 2025). AI$x_Q$6 depends on the presence and retrievability of action-aware knowledge in the agent’s memory, and its transfer is better when the shadow retriever resembles the victim retriever (Zhang et al., 2024). Knowledge Trap assumes active-learning-style extraction and graph-like frontier expansion, so it may be less effective against fundamentally different attacker acquisition policies (Dai et al., 14 Jun 2026).

A broader open question concerns why certain channels are so easy to elevate into authority. PH3 suggests that late-layer head competition is one decisive mechanism for internal-memory versus external-context conflicts (Jin et al., 2024). ShadowCoT and History Swapping suggest that residual trajectories and KV cache encode enough live task state to be directly repurposed (Zhao et al., 8 Apr 2025, Ganesh et al., 16 Nov 2025). SnatchML suggests that over-parameterized models retain latent task structure that can be decoded without retraining (Ghorbel et al., 2024). A plausible implication is that future defenses will need to model not only what information is present, but also which source the system is structurally prepared to trust at each stage of computation.

In this sense, the surveyed literature converges on a common lesson: knowledge hijack mechanisms are best understood as authority-transfer failures. The attack succeeds when evidence that should remain passive, secondary, or untrusted is promoted into the role that actually drives prediction, reasoning, or control.