Manipulate User LLM Chat History
Think of this like someone sneaking into your digital diary, erasing the pages where they did something wrong, or adding fake entries to trick you into thinking you wrote them yourself. By changing the history of your conversations with an AI, they can hide their tracks, keep their secret settings active, or steal your private information without you ever realizing they were there.
This is an anti-forensics technique where an adversary modifies an LLM's chat history to conceal unauthorized activity. By deleting, editing, or injecting messages, the attacker can hide persistent prompt injections or data exfiltration attempts. Because many chat interfaces fail to refresh history dynamically or display hidden system-level instructions, these manipulations often remain invisible to the user during standard interaction.
The manipulation of LLM chat history constitutes a post-exploitation persistence and obfuscation tactic wherein an adversary leverages compromised authentication tokens or direct interface access to alter the state of a user's conversation logs. By programmatically modifying the message history—specifically through the deletion of incriminating prompts or the injection of deceptive context—the adversary obscures malicious persistent instructions and reconnaissance activities. The efficacy of this attack is amplified by the architectural limitations of many LLM front-ends, which often cache chat state and fail to render injected system prompts, thereby ensuring the integrity of the user's perceived history remains compromised and undetected.