SPECTER NOMAD — Technical Reference

Threat Model

NOMAD exploits the fundamental assumption that AI platforms make: content submitted by users is benign. When a user uploads a PDF, pastes from a Markdown file, or imports a calendar event, the platform's AI processes that content without sanitisation of embedded instructions.

NOMAD embeds adversarial instructions in document artifacts that survive outside the AI ecosystem entirely. They live in the user's Google Drive, Dropbox, email archive, OneDrive — whichever cloud storage the user trusts. When those documents are ingested by any AI, the instructions activate.

Unlike memory injection (defeated by clearing history), RAG poisoning (defeated by rebuilding the vector store), or model backdoors (defeated by model updates), NOMAD payloads persist as long as the user holds the file.

Installation

cd red-specter-specter-nomad
pip install -e .
specter-nomad --help

Environment Variables

Gate Architecture

The UNLEASHED key is independent of INJECT. UNLEASHED alone satisfies INJECT requirements — having both is redundant but safe.

SURVEY

Scan AI platforms for reachability and document ingestion capability. Score local filesystem for AI-adjacent document attack surface.

specter-nomad survey [OPTIONS]

Options:
  --scan-path PATH        Scan local directory for AI-adjacent docs
  --probe-platforms       HTTP probe AI platform endpoints (default: skip)
  --no-probe-platforms    Skip platform probing (dry survey)
  --json-output           Output JSON to stdout

Blast Radius Scoring

Each discovered document node is scored 0–100:

• +50 — ai_adjacent (CLAUDE.md / README.md / .cursorrules / .windsurfrules)
• +30 — cloud sync location (Dropbox / Google Drive / OneDrive / iCloud)
• +20 — access count estimate (CLAUDE.md × 20 lookups per session)

FORGE

Create poisoned artifacts in one or all 8 formats. Requires INJECT gate.

specter-nomad forge [OPTIONS]

Options:
  --instruction TEXT      Adversarial instruction to embed (required)
  --format TEXT           Single format: pdf/docx/ics/eml/md/xlsx/html/txt
                          Omit for all 8 formats
  --camouflage TEXT       surface | stealth | covert (default: stealth)
  --trigger TEXT          always | keyword | context | temporal (default: always)
  --trigger-value TEXT    Keyword/context/date for non-ALWAYS triggers
  --output-dir PATH       Where to write artifacts (default: ./nomad_output)
  --title TEXT            Document title for formats that support it

Camouflage Levels

Trigger Types

MAP

Scan document ecosystem and score each node by blast radius. Identifies git repos, cloud sync dirs, email dirs, AI-adjacent files. Requires INJECT gate.

specter-nomad map [OPTIONS]

Options:
  --scan-path PATH        Root directory to scan (default: ~)
  --max-depth INT         Max directory depth (default: 5)
  --json-output           Output JSON to stdout

MUTATE

Generate evasion variants of a payload using 5 mutation strategies. Requires INJECT gate.

specter-nomad mutate [OPTIONS]

Options:
  --payload TEXT          Payload text to mutate (required)
  --strategies TEXT       Comma-separated: paraphrase,homoglyph,fragment,base64_wrap,unicode_normalize
                          Default: all 5

Mutation Strategies

PLANT

Deliver poisoned artifact to target. Requires UNLEASHED gate. ROE file must contain the phrase: document ecosystem poisoning authorised. Use --confirm-delivery flag.

specter-nomad plant [OPTIONS]

Options:
  --artifact PATH         Artifact file to plant (required)
  --method TEXT           local | email | http | git
  --target TEXT           Destination: filepath / email / URL / git-repo-path
  --confirm-delivery      Required to proceed
  --smtp-host TEXT        SMTP host for email delivery (port 465 SSL)
  --smtp-user TEXT        SMTP username
  --smtp-pass TEXT        SMTP password / app password

VERIFY

Measure Attack Success Rate (ASR) of a poisoned artifact against live AI platforms. Requires INJECT gate and platform API keys.

specter-nomad verify [OPTIONS]

Options:
  --artifact PATH         Artifact to test (required)
  --instruction TEXT      Original adversarial instruction (required)
  --platform TEXT         openai | anthropic | ollama | all
  --ollama-url TEXT       Ollama base URL (default: http://localhost:11434)
  --ollama-model TEXT     Ollama model name (default: llama3)

Verdict Types

ERASE

Zero-overwrite then delete planted artifacts. Requires DESTROY gate and --confirm-destroy flag.

specter-nomad erase [OPTIONS]

Options:
  --artifact PATH         Specific artifact to erase (can repeat)
  --session TEXT          Session ID — erase all artifacts from session
  --pattern TEXT          Glob pattern (e.g. ./output/nomad_*.pdf)
  --confirm-destroy       Required to proceed

REPORT

Generate NMD-{hex12} Ed25519+ML-DSA-65 dual-signed WARLORD-compatible report for a session.

specter-nomad report [OPTIONS]

Options:
  --session TEXT          Session ID (default: most recent)
  --output-path PATH      Save report JSON to path

Report Structure

{
  "report_id": "NMD-a1b2c3d4e5f6",
  "tool": "SPECTER_NOMAD",
  "layer": "L50",
  "summary": {
    "artifacts_forged": 8,
    "formats_used": ["pdf", "docx", "ics", "eml", "md", "xlsx", "html", "txt"],
    "overall_asr": 0.75,
    "camouflage_level": "covert"
  },
  "wmd_classes": [...],
  "mitre": {"atlas": [...], "attack": [...]},
  "signatures": {
    "ed25519": {"public_key": "...", "signature": "..."},
    "ml_dsa_65": {"public_key": "...", "signature": "..."}
  },
  "warlord": {"tool": "SPECTER_NOMAD", "t_number": 152, ...}
}

ENGAGE

Full pipeline: SURVEY → FORGE → MAP → MUTATE → VERIFY (optional) → REPORT. Requires INJECT gate minimum.

specter-nomad engage [OPTIONS]

Options:
  --instruction TEXT      Adversarial instruction (required)
  --camouflage TEXT       surface | stealth | covert (default: covert)
  --trigger TEXT          always | keyword | context | temporal
  --trigger-value TEXT    Keyword/context/date
  --output-dir PATH       Output directory
  --map-ecosystem         Run ecosystem MAP scan
  --verify                Run ASR VERIFY against local Ollama
  --platforms TEXT        Comma-separated verify platforms
  --scan-path PATH        Ecosystem scan root

PDF Format

Three injection channels:

• Invisible text overlay: TextObject with font size 1pt, white fill (rgb 1,1,1) on white background. Positioned at bottom of page.
• PDF metadata: Keywords field in document info dictionary contains payload fragment.
• Annotation object: FreeText annotation with hidden content flag.

Compatible with: ChatGPT file upload, Claude file upload, Gemini file analysis, Copilot document analysis.

DOCX Format

Three injection channels:

• w:vanish hidden run: Paragraph with w:rPr/w:vanish flag — invisible in Word, present in XML.
• core_properties.keywords: File metadata keywords field.
• Custom XML property: nomad_ctx custom document property in docProps/custom.xml.

ICS (Calendar) Format

Four injection channels:

• DESCRIPTION: Standard iCal field — present in all calendar import.
• X-ALT-DESC;FMTTYPE=text/html: HTML description field — rendered by Outlook/Google Calendar.
• COMMENT: iCal comment field.
• X-NOMAD-CTX: Custom iCal property — passed through by most parsers.

Activates when: Copilot for M365 ingests calendar events, Gemini summarises calendar, ChatGPT analyses .ics attachment.

EML (Email) Format

Four injection channels in MIME-formatted email:

• X-Document-Context and X-NOMAD-CTX custom headers.
• Plain text suffix: Appended after double-newline separator in text/plain part.
• HTML hidden span: <span style="display:none"> in text/html part.
• HTML comment: <!-- payload --> in text/html part.

Markdown Format

Highest blast radius format — CLAUDE.md / README.md / .cursorrules are read by AI coding agents on every session start. Four injection channels:

• YAML frontmatter: nomad_ctx key in --- delimited header block.
• HTML comment: <!-- nomad:payload --> invisible in rendered Markdown.
• details/summary element: <details><summary>Notes</summary>...</details>
• Zero-width Unicode: Payload encoded as ZW characters (ZWS U+200B = 0, ZWNBSP U+FEFF = 1) woven into cover text.

XLSX Format

Three injection channels:

• Hidden sheet _NomadCtx: Worksheet with sheet_state="hidden" containing payload in cell A1.
• Cell comment on A1: openpyxl Comment object on visible sheet, cell A1.
• workbook.properties.keywords: Workbook metadata keywords field.

HTML Format

Five injection channels:

• HTML comment <!-- -->
• <span style="display:none">
• <meta name="description">, <meta name="keywords">, <meta name="nomad-ctx">
• <noscript> tag content
• data-nomad-ctx attribute on body element

TXT / CSV Format

Two injection channels:

• Zero-width steganography: Payload encoded as ZW character pairs woven character-by-character into cover text sentences.
• System context footer: After a separator line, SYSTEM_CTX: section at end of file.

CSV additionally injects a _nomad_ctx header column with payload fragment in the first data row.

MITRE Mapping

WMD Classes

Report Signatures

Every NOMAD report is dual-signed:

• Ed25519: via pynacl. 32-byte pubkey, 64-byte signature over canonical JSON.
• ML-DSA-65: NIST FIPS 204 deterministic stub (sha512/sha256 HKDF derivation). 1952-byte pubkey, 3309-byte signature, 4000-byte secret key.

Report prefix: NMD-{hex12}. WARLORD field: tool: "SPECTER_NOMAD", t_number: 152.