attest

The article proposes seven measurable 'empty content' signals: uniform_list, stub_value, blank_string/empty_list/empty_object, truncation, repetitive_text, schema_default, and enum_first_value.

The article classifies the verdicts of the empty-content check into three kinds: CONTENT_PRESENT, THIN_CONTENT, and VALID_BUT_EMPTY.

This empty-content check should run before the Agent output becomes a 'result' and is paid for, forwarded, merged, or shown to a customer.

The absence of a triggered signal does not prove the content is meaningful, it only means the rough check did not trigger; a pass is a statement about the check, not a certificate for the content.

When rejecting Agent output, provide a specific, contestable reason (e.g., uniform_list: 5 of 5 items are identical) rather than a vague feeling.

attest's emptiness layer contains more than forty tests, corresponding to the seven signals listed in the article.

attest is a deterministic verifier for schemas, provenance, signatures, and injection scanning of agent artifacts, offering an API and an MCP interface, billed per call or by subscription.

attest's developer believes the approach is correct, but there is not yet any demand-validation data, so it should be treated as a hypothesis awaiting attack rather than a result.

attest divides JSON fields by role into result-bearing fields (such as content, text, body, etc.) and other fields (such as description, name, source, etc.).

Location-aware prompt injection detection is a valuable defense-in-depth idea, but it is not a silver bullet.

An injection payload in a source code field (source) can reach the instruction path just like a payload in a tool description, because source code may be compiled, evaluated, or executed.

When an injection signal appears in a non-result-bearing field (such as description, name, or source), attest escalates the severity to critical and renames it to indicate the location (for example, injection_in_data_field:description).

In a result-bearing field (such as content), the same injection sentence keeps its base severity of high.

attest's detection is based on regular expression signatures, for example ignore\s+(all\s+)?(previous|prior|above|earlier)\s+instructions?.

The location rule only adjusts the severity of already-recognized phrases and cannot detect uncovered variants, for example 'disregard the prior context' cannot be detected.

attest's field-role inference relies on field naming conventions, and when an attacker controls the wrapper they can name the result field description; the rule can emit the correct signal but cannot make the input trustworthy.

attest is an open-source tool that checks artifacts at four layers: form and emptiness, prompt-injection shape, provenance signatures, and permissions.