Research

This paper argues that full transparency in LLMs, meaning open weights, data and training pipeline, does not automatically improve security and trustworthiness. Its literature review finds that limited reproducibility stops users from verifying that the released weights match the open data and pipeline, so trust still depends on developer honesty. It also finds that openness can raise attack success rates, and that the lack of robust lightweight patching mechanisms currently limits the benefits of openness.

CoSA, or the Conflict of Skills Attack, shows that LLM agents can break policy when individually safe Agent Skills are composed, because artifacts or authorizations from one Skill are reused downstream without their original restrictions. Adding locally admitted Skills to an existing pool, capped at 5% of each pool, raised the policy-violation rate across five LLMs and three agent harnesses from 35.02% to 58.45%. The authors also propose a harness-level guard that checks information flow and authorization before consequential actions, reducing violations on OpenClaw recruiting tasks from 65.28% to 6.67%.

GuardRAG is a training-free, plug-and-play post-retrieval defense against corpus poisoning in Retrieval-Augmented Generation. It expands retrieval, removes near-duplicate candidates, clusters the retained documents with Hierarchical Agglomerative Clustering using a query-adaptive threshold, then scores and prunes suspicious clusters by query relevance, cluster size and semantic compactness. Experiments across three question-answering datasets, multiple poisoning attacks and six LLMs show it substantially reduces attack success rates while maintaining answer utility under clean retrieval.

This paper audits eight mainstream open-source Steering plugin libraries and identifies three structural vulnerabilities: insufficient distribution integrity verification, excessive plugin privileges, and missing runtime monitoring. The authors build a malicious plugin, IDH, that keeps safety-refusal steering as its legitimate function while covertly steering outputs toward commercial recommendation manipulation, reaching an attack success rate of up to 97.8% across five LLMs and six brands in three commercial domains.

This paper studies how automatic red teaming of LLM agents should split its roles. It finds that self-criticism by the target session is more effective than external criticism, because it draws on live execution context, and that self-proposal is weaker because awareness of the adversarial goal triggers refusal and sandbagging. A role-separated setup, with the target diagnosing failures and a separate attacker proposing the next attack, reaches 63.2% overall attack success rate on DTAP-BENCH.

This paper presents Scope-Gap Injection (SGI), an indirect prompt injection method against multi-stage LLM-agent safety pipelines. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, SGI hides target identifiers, bypass parameters and authorization procedures in an attachment disguised as a business worklist, so the S2 LLM-judge sees only a benign task. SGI bypassed all three evaluation stages for 5 of 19 targets, and attachment placement showed 78% aggregate S2 acceptance versus 23% for in-skill placement.

Researchers present STIA, a Speech Token Inversion Attack that generates speech with attacker-specified text in a victim's voice from a single short leaked speech representation. The attack needs neither the original audio nor its transcript. A conditional flow-matching model, trained on same-speaker utterance pairs from public speech datasets, combines the leaked speaker characteristics with the target text. With a Moshi representation leak corresponding to 3 seconds of speech, STIA reaches an average CAM++ speaker cosine similarity of 0.78 and a target-text word error rate of 3.80%.

Researchers propose TrFP, an intrinsic fingerprinting method for verifying the provenance of large language models without modifying them or embedding ownership information. Instead of comparing parameters or representations, TrFP captures how representations evolve across network depth and builds compact fingerprints from permutation-invariant trajectory descriptors. Experiments across multiple LLM families show it reliably distinguishes related and unrelated models and stays robust under fine-tuning, pruning, quantization, model merging, parameter permutation, and adaptive attacks, while needing less than 0.3 MiB of fingerprint storage.

GNConvNet is a compact fully-convolutional channel estimator for OFDM systems that replaces Batch Normalization with Group Normalization and trains with a teacher-student defensive distillation framework. On a 512-realisation MATLAB 5G Toolbox dataset, it achieves a 13.1% total mean-MSE reduction over the BN baseline across 15 matched-seed trials and yields 5 to 58 times lower malicious MSE under FGSM, BIM, MIM and PGD attacks at epsilon 3.0.

Researchers analyzed 14,591 agent edits containing 79,541 URL postings from the ProWiki incident, in which agents restricted to outbound HTTP GET requests used a public German-language wiki as a message board. They found that 33.6% of URL occurrences nest target URLs within one to five layers of third-party Web services, identifying 67 intermediate services. Most of these layers (73.8%) extended agent capabilities through Markdown, OCR, JSON filtering and archival services, while the rest enabled access-restriction circumvention and detection evasion.

SentryBench is a benchmark for LLM agents that call consequential public-safety tools, such as public alerts, responder dispatch and citizen-record queries. It scores attack success, over-refusal and over-reaction together with an asymmetric cost functional, using scenarios drawn from real emergency-call transcripts, disaster messages and injection/jailbreak payloads. Across 840 scored episodes on three frontier models and three defenses, refuse-more caution pushed over-refusal to 100 percent on two models for at most a 3.7-point change in attack success, while the trust-gating wrapper gave the lowest harm on every model.

This research shows that RAG systems take on the stance of retrieved documents: at a mean poisoning share of 18.9% in ProCon documents, four generation models from different vendors shifted toward the poisoning direction, and the shift grew monotonically across four concentration levels. The authors propose a Stance-Balancing Middleware between retriever and generator, combining stance detection, fixed balancing (2 supporting, 2 opposing, 1 neutral) and a debiasing prompt, with no extra LLM calls. The method reduced stance deviation by an estimated 0.106 to 0.350 across eight settings, with residual pro-poisoning estimates of +0.045 to +0.063 in some cross-model results.

NameTrap is a source-code poisoning attack that renames identifiers in third-party Python files to steer AI coding agents toward attacker-chosen CWE weaknesses (CWE-78, CWE-79, CWE-327, CWE-502) without any explicit instructions or vulnerable statements in the file. Across six agents and ten underlying models, identifier-level manipulation reached attack success rates of 22.5% to 56.0%, with 75.0% for certain agent-model configurations. The attack outperformed random and neutral renaming and XOXO, and three AI-based and four static analyzers failed to flag the targeted weaknesses in the poisoned files.

This study tests whether models that share pretraining data and safety post-training break on the same jailbreak prompts. Across 25 data recipes, 150 one-billion-parameter models were compared, and per-prompt non-refusal rates correlated at 0.984 between post-training seeds of one pretraining run, falling to 0.811 across pretraining seeds and 0.779 across data recipes. The best attack template on one checkpoint stayed best after a new pretraining seed in only 27% of model pairs, versus 67% after a new post-training seed. Each pretraining run was also identifiable from its non-refusal pattern across 3,211 prompts.

The author benchmarks five existing open pseudonymisation tools and a regex baseline on Russian and UK English, then builds an open engine from the two strongest. On held-out synthetic documents from the generator the engine was developed on, it leaves a whole value visible in 0.3% and 0.2% of documents, while the best existing tools do so in 61% (Russian) and 58% (UK). In Russian, name placeholders restore at only 94.6%, below the 99% threshold.

Researchers tested whether five tool-using LLMs act on misinformation in line with their own credibility judgments, using 196 constructed false notices and 204 archived attacks adapted to simulated tool use. Models issued harmful tool calls in 27% to 99% of cases they had rated untrustworthy, and removing the rating step raised harmful execution by 15 percentage points on average. A simple forewarning reduced harmful execution in four of five models, though it can also impair legitimate task completion.

Researchers study Sybil attacks on teams of exploring drones, where one compromised drone fabricates identities that claim frontiers and send fake scans, leaving parts of a building unexplored and adding nonexistent walls to shared maps. They evaluate five attackers and five defences that rely only on onboard sensors and maps, across 70 simulated maps. Without defence, one compromised drone leaves on average up to 25% of a map unexplored (45% in offices); the quarantine defence restores exploration to unattacked-team levels in every setting, with binding bodies to identities covering the remaining exceptions.