Research

An empirical study in Knowledge-Based Systems (Elsevier BV, published 2026-10-29, DOI 10.1016/j.knosys.2026.117270) examines cross-dataset generalization in LLM jailbreak prompt detection. The source text provided contains no further details of the method or findings.

Researchers red-teamed Jev, a typed decision model that answers in a single query, using a fast black-box attack that calls no attacker language model. Across 12 datasets, Jev resisted common prompt injections in 10,240 paired tests, but short universal suffixes flipped confident answers within minutes, with one suffix per dataset flipping 43% of unseen documents. Suffixes generated for one task also flipped 90-100% of samples in other tasks.

Researchers built three agentic testbeds spanning tool use, coding, and daily workflow domains to study how the placement of an indirect prompt injection affects an agent's susceptibility. With injection content held fixed, an agent powered by GPT-5.4 followed an unsafe instruction in a repository documentation file (README or TODO) 2.6 times more often on average than the same instruction in a code or data file. The authors call this the trust region effect and build learning-based attackers that select better injection placements.

Researchers introduce Curriculum of Models (CoM), a method that trains a jailbreak-discovery investigator model against a sequence of progressively harder versions of a target model, starting from a version that rarely refuses harmful requests. They evaluate CoM on CBRN, explosives, and illicit drug elicitation tasks against the open-weight targets gemma-4-31b-it and gpt-oss-120b. CoM finds successful jailbreaks more reliably than the PRBO baseline and direct training when trained on a single behavior, though PRBO-trained investigators achieve higher success rates in the multi-behavior setting.

This survey argues that distributed machine learning, including federated learning, widens the attack surface across cloud-edge-IoT systems and couples privacy, robustness, and fairness challenges. It maps assets, adversaries, and trust assumptions, analyzes how non-IID data and resource asymmetry affect attack detectability and defense reliability, and compares layered defenses such as robust aggregation, differential privacy, secure aggregation, and trusted execution environments. It closes with evaluation and governance guidelines emphasizing reproducible non-IID partitions and auditable lifecycle artifacts.

Current LLM jailbreak evaluation relies on a binary success indicator, which hides how a prompt shapes the distribution of possible responses. The authors propose a continuous, context-conditioned risk landscape over first-token branches, estimated by fixing candidate openings and repeatedly sampling their continuations. Across multiple target models and jailbreak attacks, they find risky branches beneath apparently safe outputs, and attacks that are strongest before an adaptive defense are not always strongest after it reacts.

AgentAnchor is a session-keyed behavioral watermark for attributing LLM agent trajectory logs to their owner. Each step key derives from a secret key, a fresh public session identifier, and semantic states of recent observations, and parity evidence is embedded through a KL-bounded exponential tilt. The authors formulate a learned-forgery threat, in which repeated observation of watermarked trajectories enables cross-session forgery through learned action preferences.

WebMaze is a defense against LLM-based web vulnerability scanners that embeds functionality-coupled traps in genuine pages and generates view-tailored interactive decoy worlds. Tested on 12 web applications with three LLM-based scanners under the default no-disclosure setting, decoy pages accounted for an average of 93.0% of distinct pages requested per run. Scanners still explored mostly decoy pages even when told about the decoy mechanism and instructed to avoid it.

Researchers formalize Role Grounding Attack (RGA), which exploits role-to-principal attribution flaws in LLM agent memory systems. An attacker-designed nested conversation, shared in an experience-sharing post, causes the victim agent to record the attacker's preference as its user's preference, and that misattributed preference persists into later retrieval and decisions. The authors instantiate RGA as tool selection manipulation and privacy leakage, reporting high attack success rates across five memory systems and six language models.

VISTA is a black-box attack framework that finds semantically vulnerable image regions in multimodal LLMs using only their text responses, without gradients, logits, parameters or internal representations. It builds an Uncertainty-Based Multimodal Behavior (UBMB) map from response drift, conflict, misleading and semantic shifts, then routes perturbations to those regions. Across GPT-5, Gemini-3.5-Flash and Claude Sonnet 4.6 it reports up to 97 % attack success rate at PSNR above 30 dB, and VISTA-Proxy reaches up to 93 % without querying the final victim model.

Researchers introduce Heads of Security (HoS), a prompt injection defense that uses a small set of learned per-head attention gates to separate trusted instructions from untrusted data. Evaluated on Llama-3.3-70B-Instruct and GPT-OSS-20B, HoS cut the black-box RL-Hammer attack success rate to 10%, versus 97% on GPT-OSS-20B and 85% on SecAlign. It also preserved base-model utility on standard benchmarks, where SecAlign and ASIDE degraded in few-shot settings.

Researchers built a continued-pretraining corpus on documented human, biosphere and AI dependency, option value under irreversibility, and recovery from harm, and installed it on five open models of three designs. Under the highest pressure in their companion paper's ladder (arXiv:2610.16043), coupled-welfare training reduced harmful choices to at or near zero in four of five models, with MMLU unchanged, while a construct-neutral control showed no such improvement. The corpus also led the Qwen3.6-27B base model to decline most harmful underwriting proposals under decommissioning pressure.

This paper presents SimpleLoRIF, a gradient embedding method that flags instruction-tuning examples whose gradients align with unsafe behavior, even when the examples look benign. Applied to Tulu 3, removing the 20% most aligned examples to produce SafeTulu reduced GCG attack success rate by up to 22% across Qwen, Llama, and Olmo, with capability largely preserved. On emergent misalignment, the authors report AUC as high as 0.865 in the gradient space of misaligned models.

This paper studies the envelope layer, the channel through which malicious content enters an LLM agent, using the A2A-TIBA attack as its test vehicle. A two-by-two factorial experiment and a memory experiment measure the semantic breach rate and semantic refusal rate. Strong labels reduce the breach rate only when the envelope is authentic, and memory has a larger effect than label manipulation: success memory raises the breach rate while failure memory lowers it.

Watermark Basin Alignment (WM-Basin) is a black-box detector that identifies models distilled from a watermarked teacher without access to weights or logits. It projects generated text into gradient space and tests for alignment with a key-specific watermark basin orthogonal to ordinary fine-tuning directions. At a 0.1% false-positive rate it detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, versus 29% and 1.3% for the token-level baseline, and the signal survives quantization, pruning and reinforcement-learning post-training.

Audit-based certification bounds an LLM agent's violation rate by auditing a random fraction of actions, but its validity also depends on the audit coin staying hidden from the agent before the action commits. The authors call this pre-commit noninterference (PNI), measure its violation by the total-variation distance D_A between the agent's views under the two coin values, and show the worst-case bias is (1-ε)D_A. In experiments, a visible audit notice let a real LLM agent detect audits and follow an injection that named it, so the plain certificate failed, while a silent audit restored validity.