Research

Screwtape is a pipeline that edits real agent transcripts to insert attacks that evade action-only monitors, refining each edit until the monitor no longer flags it. An LLM verifier checks that each attack is realistic, clearly harmful, and plausibly successful. Across 252 runs on 94 transcripts, 35 attacks evaded the authors' monitors and 6 of those also evaded a held-out frontier developer monitor, confirmed through human review.

Researchers study token-level attribution for multi-mode Gumbel-max LLM watermarks, where a document may mix spans watermarked under different secret keys with unwatermarked text. They show that the optimal rule reports the mode with the largest prior-weighted alternative density and rejects when this density exceeds a common threshold, then propose the BLADE detector, which keeps the exact Type I error and attains higher correct-label power than compared detectors on OPT-1.3B and other open-weight models.

SemPurify is a data purification framework for black-box backdoor defense that uses multi-level semantics, including low-level semantic embeddings and high-level image tags, to guide a text-to-image model during image restoration. The authors state that the approach removes backdoors across classification models, CLIP-style encoders and generative models while preserving semantic information for downstream tasks. The paper argues that existing purification defenses that rely on transformations such as blurring degrade image quality and can alter visual or semantic content.

Researchers show that visual perturbations can redirect vision-language-action robot models away from the user's intended task. Prior attacks used fixed target supervision, which stops matching the states the attacked robot actually reaches. The proposed TRACO framework rebuilds supervision from the states reached under attack and focuses updates where task progress stalls, improving task-redirection success across VLA models and simulation environments.

This paper studies monitor-validity failures in LLM and agent frameworks, where a safety detector recognizes a policy-relevant payload but the framework never routes that evidence to its enforcement decision. Using canary contracts on public framework repairs, the authors confirm 18 evidence-path failures across 11 LLM or agent safety project groups and four implementation ecosystems, with 14 reaching enforcement boundaries. They conclude that monitor assumptions need regression tests at the schemas, streams, tools, and adapters that frameworks evolve.

MobileInject is a benchmark for testing MLLM-based mobile agents against multimodal injection attacks, where malicious objectives are embedded in cross-application content. It covers 11 scenarios, 9 security-risk categories and 108 executable risk instances, and adds Cross-Modal Consistency Injection plus two attack methods, Multi-Role Collaborative Deception and Reasoning-Camouflage Injection. The authors report that mobile agents are broadly vulnerable, with many failures arising from reasoning hijacking at early stages.

Benchmarks for indirect prompt injection in tool-using agents usually report attack success rate, which counts every failed attack as a defense. An audit of 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo found that most failed attacks were ignored (76-80%) rather than refused (17-18%). Changing only the system prompt moved InjecAgent ASR from 0.2% to 43% with identical weights, and 21.7% of AgentDojo episodes stayed safe without completing the user's task.

AgentLoupe is an application-transparent eBPF-based observability tool that attributes AI agent tool invocations to their originating LLM interactions. It captures TLS plaintext to interpret LLM interactions, assigns each a kernel-resident semantic label stored in eBPF maps, and propagates that label across processes, threads, files and sockets. The authors report average observation overhead below 8% and case studies tracing cross-lineage persistent attacks back to their originating LLM interactions.

This paper studies an authorization-grounded workflow attack on tool-using language-model agents in the OpenClaw Agent Security Attack Competition. The attack walks the agent through a denied document request, a normal approval token request to the local approval service, and supplying that token to the document service via authorized_by, succeeding on three Enterprise OA document targets. In 23 controlled local validation experiments, the original configuration reached the approval-token transition in 9/9 reruns and completed the exact target operation in 8/9 reruns.

ECHO is an optimization-based jailbreak attack that replaces the usual token-level compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor. It pairs this with five word-level perturbation operators and Keyword-Anchored Beam Search under a strict black-box threat model. Across five open-weight victims on AdvBench, it reaches up to 0.898 StrongREJECT mean score and 89.23% HarmBench success.

SAFE-Mem is a memory governance framework for LLM agents that tags each stored claim with kind, authority and scope labels to track provenance and permitted use. Its governance-aware retrieval matches query requirements against claim permissions, blocking unauthorized influence while keeping legitimate information. On MPBench and LoCoMo across four LLM backbones, it reports the lowest attack success among defenses that retain legitimate memory, at least 77% below the strongest of them, and up to 15% higher answer accuracy.

LENS is an LLM-based system that guides language models with exploitability-analysis discipline and protocol evidence to assess Diameter field-level exploitability. Across four LLMs it reached mean recall of 94.00% to 98.00%, precision of 78.73% to 88.94%, and accuracy of 84.00% to 92.00%. The authors report that over 25% of field paths in the S6a and Cx interfaces are exploitable, and they uncover 95 previously unknown vulnerabilities in EPC/IMS implementations and commercial deployments.

Researchers introduce KoLing, a bias-controlled adversarial benchmark of 50.9k instances for detecting LLM-generated Korean text, aimed at suppressing superficial shortcuts. They also propose KoLingProbe, an interpretable detector grounded in theoretical linguistics that models Korean-specific properties across multiple linguistic levels. They report that KoLingProbe substantially outperforms strong baselines on all detection tasks and stays robust to adversarial attacks.

This paper proposes EDIC, a decomposed reward framework that trains LLMs to classify each instruction embedded in external data as beneficial or harmful, then follow the former and reject the latter. A generative judge, initialized by SFT and refined with GRPO, attributes compliance per instruction to produce separate rewards. Across two backbones and five benchmarks, EDIC improves harmful-rejection by up to 7.7% and Arena-Hard-Auto utility by 12.5% on Qwen3-4B over the strongest prior defense.

Researchers show that reusing key-value caches built from reasoning traces, which can improve task performance much like RAG, opens new poisoning vulnerabilities in LLM systems. Their black-box attack, R$^2$ECAP, plants poisoned traces through a chat interface alone, and the retained trace keeps adversarial influence after the preceding trace's cache entries are discarded. It reaches up to 79% attack success rate on three open-weight LLMs and three datasets, and 46% in a realistic reasoning-trace retrieval system, while only 1% of its retained responses were flagged by a popular prompt injection detector.

GRAD is a defense for LLM agents against memory poisoning and decomposition attacks, which spread malicious evidence across multiple operations. It combines graph-based evidence aggregation across operations with an extensible set of detection experts that are added on frozen encoder snapshots and routed by graph signatures. Across Decomp, MCP, and MRT it reports AUROCs of 97.19%, 77.59%, and 86.60%, and its continual adaptation improves final accuracy by 13.08 percentage points over Replay.

Veil-then-Reveal (VtR) is a user-side framework that pseudo-anonymizes PII in prompts before they reach untrusted remote LLM providers, keeping plaintext PII on the user's device. It combines format-preserving encryption for structured PII, such as phone and credit-card numbers, with a keyed-hash dictionary and secure vault for semantic PII, such as names and organizations. On three datasets with 11,322 annotated PII instances, it reports 97.9% detection recall, 95.2% protection of detected values, and 99.9% round-trip restoration.