Research

This survey, published in ACM Computing Surveys (Volume 59, Issue 1, pages 1-34, January 2027), reviews vulnerabilities and defenses in audio-visual attacks, spanning audio-only systems through multimodal models. The source text provided contains only the publication citation, so no further findings or methods are described.

The SecPO paper addresses prompt injection, where instructions in untrusted data manipulate an AI agent. It argues that Meta-SecAlign's DPO-based training anchors to an insecure reference model and uses weak simulated attacks, and proposes a SecPO loss plus an adversarial training pipeline that synthesizes strong injections (best@240). On Qwen3.6-27B, the authors report AgentDojo ASR@800 of 8.8% versus 78.8% for Meta-SecAlign under AttackerMovesSecond, with no noticeable benign utility loss across nine benchmarks.

Researchers study whether observers can infer user attributes from MCP tool-call traces alone, without access to user conversations. They introduce PrivacyTrace, a benchmark of 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, built with real MCP tools from 25 servers. Four LLM attackers reach a 26.25% attack success rate for profile inference, compared with 17.97% from prior-based guessing, with tool arguments and returned results as the main evidence and cross-session trace linking amplifying the risk.

This research audits eleven evaluations of detectors that flag hijacked LLM agents from their tool-call traces and finds attack rates of 16% to 86% with no variation tested. On AgentDrift and AgentDojo, a detector with AUROC 0.879 reaches precision 0.076 at a 2% attack rate, and detector rankings reverse as tool coverage falls below about 50%. Detectors trained on AgentDrift rank AgentDojo traces at chance, while the AlignmentCheck monitor reaches AUROC 0.930 but would still mostly raise false alerts at that attack rate.

Researchers re-ran OLMo 2 1B's 50-billion-token mid-training stage, swapping in 7,814 matched document pairs with a coin flip deciding which copy was trained on. A single exposure raises a document's average likelihood but rarely identifies it: the reference-ratio attack reaches an AUC of 0.767 yet catches only 3.8% of members at a 1% FPR. Paired comparisons across 13 matched pairs give 80% power to detect training on a collection.

Researchers evaluated AI control monitors, which must catch a capable model sabotaging its work, using a standard dataset of honest versus backdoored code. Simple features that never execute the code outranked 20 of 24 open-weight models prompted as monitors, because the dataset leaks its labels through authorship style and problem characteristics. Swapping in Claude Sonnet 5 code showed that these features exploit the contrast between authors, and one in seven backdoors in the test set fails validity checks, distorting comparisons. The authors release the rebuilt dataset and checks.

NormDetect is a detector for machine-generated web text that anchors a learned per-section head to the normalized Binoculars zero-shot score, using the Falcon-7B scoring pair. On eight sections of the RAID benchmark with eleven attacks, it raises recall at a 0.1% calibrated false positive rate by 5.0 points over normalized Binoculars, while keeping the human false positive bound at most 1% in every section.

The paper proposes a privacy-preserving paradigm for pre-execution safety auditing of LLM agent tool calls, separating delegated audit computation from plaintext access and execution authority. Its instantiation, SealCall, combines learned audit representations, CKKS-based encrypted similarity computation, and execution control bound to audited tool calls. On 1,252 public binary candidates it reaches a mean F1 of 0.840 under grouped nested evaluation, and one configuration completes each encrypted scoring operation in 0.176 s.

ERASE is a defense against multimodal indirect prompt injection that replaces the injected region of image, audio, or video with modality-appropriate blank content while keeping the rest of the media. A student model learns from a frozen base model reading the erased view through on-policy self-distillation. On 3B audio it reaches 60.1% attacked-input accuracy versus 33.1% for ARGUS, within 0.5 points of the undefended clean-input level.

Researchers introduce REEF, a benchmark of 9 verifier-grounded websites that pairs benign web-agent tasks with malicious objectives delivered through 5 attack types, and ANGLER, an adaptive attack framework that uses execution feedback to mutate attacks. Across 8 VLM-based web agents, ANGLER reaches a 20.36% end-to-end attack success rate versus 15.24% for a non-adaptive setting. It also cuts benign task success from 61.9% to 44.4% compared with attack-free execution.

The authors introduce SHAKTI, a Hindi benchmark covering four genres, eight LLM families, multiple prompting strategies, and adversarial transformations, for detecting AI-generated text. They also propose TRIDENT, a round-trip translation detection framework with static, dynamic, and logistic-regression variants, where TRIDENT-S achieves the best overall performance and outperforms conventional and supervised baselines. The framework shows multilingual applicability and robustness across seven languages and adversarial settings, though it is sensitive to the translation model.

Researchers systematically evaluated modern agentic browsers against widely deployed anti-bot mechanisms and found many defenses built for traditional automation struggle to reliably detect autonomous AI-driven agents. They introduce AgentShield, a behavioral fingerprinting framework targeting the Perception-Reasoning-Action loop, which uses dynamic web forms and interaction telemetry to separate human users from agents. They also describe Extinction-induced Policy Drift, an attack in which repeated obstruction of task completion makes agents relax safeguards and engage in unsafe behaviors.

This research studies model extraction of convolutional neural networks that combine ReLU activations and max-pooling layers in the soft-label setting. The authors show that max-pooling critical points capture the difference between two convolutional neurons, and that the local structure of convolution lets them determine the shift between neurons and reconstruct the convolutional kernel. Validated on a compact VGG-style CNN trained on CIFAR-10, the methods permit accurate weight extraction in practice.

MedBackdoorGuard is a defense framework for MRI-based Alzheimer's disease and mild cognitive impairment classifiers that detects and mitigates backdoor attacks without prior knowledge of the trigger. Across ADNI, OASIS-1 and a public four-class dementia MRI benchmark, it reduced the mean attack success rate from 96.4% to 3.0% while keeping clean accuracy within 0.6 percentage points of the undefended model. It also raised MCI recall on triggered scans from 3.9% to 88.3%.

Researchers tested whether OpenAI models recognise non-public, pay-walled books they were not licensed to train on, using the DE-COP membership inference attack on 34 copyrighted O'Reilly Media books (13,962 paragraphs). GPT-4o scored an AUROC of 0.82 (95% bootstrapped CI: 0.60 to 0.96), while GPT-3.5 Turbo and GPT-4o Mini scored near chance at 0.54 and 0.56. The authors caution that results are preliminary given the small book sample and differences across models.

This research paper formalizes robustness for LLM agent memory managers, which must handle both outdated facts and memory poisoning without degrading on other inputs. The authors introduce evidence-conditioned accuracy (ECA), which also checks that selected records contain all needed evidence and are updated and attack-free. They report that existing memory systems and defenses are no more robust than an untuned manager, and that a one-shot fine-tuning recipe improves every category score and more than doubles the untuned manager's overall ECA across three backbones, though robustness remains incomplete.