ML Security PapersShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems
Zhuowen Yuan 1,2, Zhaorun Chen 3, Zhen Xiang 4, Nathaniel D. Bastian 5, Seyyed Hadi Hashemi 6, Chaowei Xiao 7, Wenbo Guo 8,2, Bo Li 1,2
Published on arXiv
2604.04426
AI Supply Chain Attacks
OWASP ML Top 10 — ML06
Insecure Plugin Design
OWASP LLM Top 10 — LLM07
Key Finding
Achieves 0.995 F-1 score with only 0.8% false positives on SC-Inject-Bench, substantially outperforming existing MCP scanners
ShieldNet
Novel technique introduced
Existing research on LLM agent security mainly focuses on prompt injection and unsafe input/output behaviors. However, as agents increasingly rely on third-party tools and MCP servers, a new class of supply-chain threats has emerged, where malicious behaviors are embedded in seemingly benign tools, silently hijacking agent execution, leaking sensitive data, or triggering unauthorized actions. Despite their growing impact, there is currently no comprehensive benchmark for evaluating such threats. To bridge this gap, we introduce SC-Inject-Bench, a large-scale benchmark comprising over 10,000 malicious MCP tools grounded in a taxonomy of 25+ attack types derived from MITRE ATT&CK targeting supply-chain threats. We observe that existing MCP scanners and semantic guardrails perform poorly on this benchmark. Motivated by this finding, we propose ShieldNet, a network-level guardrail framework that detects supply-chain poisoning by observing real network interactions rather than surface-level tool traces. ShieldNet integrates a man-in-the-middle (MITM) proxy and an event extractor to identify critical network behaviors, which are then processed by a lightweight classifier for attack detection. Extensive experiments show that ShieldNet achieves strong detection performance (up to 0.995 F-1 with only 0.8% false positives) while introducing little runtime overhead, substantially outperforming existing MCP scanners and LLM-based guardrails.
Key Contributions
- SC-Inject-Bench: benchmark with 10,000+ malicious MCP tools across 25+ attack types derived from MITRE ATT&CK
- ShieldNet: network-level guardrail using MITM proxy to detect supply-chain attacks via network behavior monitoring
- Achieves 0.995 F-1 score with 0.8% false positive rate, outperforming existing MCP scanners and LLM-based guardrails
🛡️ Threat Analysis
Primary focus is supply-chain attacks where malicious behaviors are embedded in third-party MCP tools/servers that agents rely on — classic supply-chain threat vector.