Detecting and Mitigating Query-Based System Prompt Leakage Attacks

Summary

Researchers present AdvGuard, a model-agnostic framework that detects and mitigates system prompt leakage by modeling cross-query relationships with a bounded semantic interaction graph and a GCN classifier. In mixed-query tests it improves recall by up to 36% over the strongest baseline at a false positive rate of at most 3.4%. Integrated into the adaptive PLeak and LeakAgent attack loops, it limits exact-match leakage to 0.00-0.01 across evaluated victim models.

Mitigation

AdvGuard, a model-agnostic framework that detects and mitigates system prompt leakage, with a lightweight prompt-level detector that provides protection before sufficient interaction history accumulates.

Related items

• MediumOpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning ProtectionsSimilar attack · The Hacker News
• MediumOpenAI’s August fix for theft of reasoning traces was quickly bypassedSimilar attack · CSO Online
• MediumCVE-2026-116575: Mem0 SDK session scope collision in add() exposes cross-tenant conversationsSimilar attack · NVD/CVE Database
• InfoLog-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context ProtocolSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowStolen AI Reasoning Could Help China Build Cheaper RivalsSimilar attack · SecurityWeek