Research

Researchers show that large reasoning models can infer where ordinary photos were taken from visual content alone, even after metadata and obvious location cues are removed. Their GeoTrace attack localizes 25.71% of 525 images within 1 km with Gemini-3-Flash and 16.95% with GPT-5-mini. They also present GeoShift, a user-side defense that rewrites high-impact location clues before release, cutting street-level localization to 2.48% (GPT-5-mini) and 3.81% (Gemini-3-Flash).

Researchers study the mosaic effect, where LLM agents retrieve individually permissible documents and disclose a sensitive conclusion assembled from them. Using 30 synthetic cybersecurity, medical, and military examples, they evaluated 10,800 simulated answers from three agents and 1,440 live answers from two open-source harnesses. GPT-5.6-Sol disclosed forbidden composites in 7.08% of simulated answers, with higher rates in live harnesses, and visible classification headers with explicit aggregation rules still left unsafe disclosures in 32.37% of simulated answers.

Researchers study data-void exploits, where disinformers publish narratives in search spaces with little reliable content so that web-searching LLMs retrieve and cite them. They test ChatGPT, Gemini and Sonar Pro across skeptical, excited and neutral prompt tones and three attacker controls. Attacker content appears in LLM responses 31% of the time, and a single attacker-controlled page can suffice, while prompt tone and model choice show no large effect on success rates.

Researchers present Mirage, a multimodal jailbreak attack that bypasses post-generation safety checkers in diffusion pipelines. Mirage hides an adversarial target, either a reference NSFW image or a malicious text description, inside an imperceptible perturbation on a benign input image, exploiting the shared representation space of multimodal encoders. The authors report targeted jailbreak success against Stable Diffusion 1.5, Stable Diffusion XL, and Kandinsky 2.2 using limited black-box queries.

PhishGen is a framework that evaluates how well LLM-generated phishing pages match real pages visually and how many work end to end. Across 14 LLMs and 64 real-world phishing kits, 96.2% of safeguard-bypassing outputs render, but only 38.7% complete the full credential-harvesting pipeline. GPT 4.1 reaches 86.3 to 94.1% functional success, while uncensored models rarely exceed 45.4%.

The authors argue that current prompt-privacy research is moving toward a single unified framework, which they say is misleading and can create a false sense of security because privacy depends on context. They contend that future work must confront tensions among desirable prompt-privacy properties, so attempts at a unified framework should be reconsidered.

This paper studies how an attacker who submits context queries to a predict-then-optimize system can extract its underlying linear prediction model from the returned decisions alone. The authors combine inverse optimization with boundary sampling in an adaptive attack, then propose a defense that perturbs decisions only when the predicted cost vector lies near a decision boundary. Experiments on synthetic and real data show the defense increases extraction error at a measurable cost in performance.

This research paper examines how attacker-controlled evidence can manipulate LLMs used in digital forensics, extending anti-forensic models to cover the reasoning layer. It proposes a taxonomy of attacks built from an objective, a technique, a payload location and a concealment method, and attributes the gap to a perception difference between deterministic tools, the human examiner and the model. The authors demonstrate three attacks against an LLM-assisted analysis pipeline that alter a reported conclusion, write attacker-chosen content to the analyst's workstation and cause outbound network traffic, each triggered only by text planted on a seized device.

MPIDetector is a detection framework for multi-modal prompt injection that uses few-shot in-context learning on LLMs, with no fine-tuning, and reasoning over specific prompt templates and attack examples. The authors evaluated it on eight textual and seven visual malicious categories plus benign data, across Gemini-2.0-Flash, Qwen3-VL-32B-Instruct and Doubao-seed-1.6-flash. It reached up to 90.91% accuracy and 100% recall on text, up to 99.28% accuracy with 100% precision on visual inputs, and up to 99.80% detection on 500 obfuscated WebInject web-agent injections.

CertMoE is a robustness certification framework for Mixture-of-Experts LLMs that accounts for input-dependent routing. It certifies that perturbed Top-K routing stays within a certified expert pool, then certifies prediction consistency of the induced sub-network, yielding a joint probabilistic guarantee. Experiments show existing certificates are frequently violated under dynamic routing, while CertMoE reduces the empirical violation rate from more than 30% to 0.

Knostic researchers examined how LLM-based vulnerability discovery harnesses can miss real, reachable flaws because of their surrounding code, such as file selection, filtering, and result merging. Starting from their own OpenAnt and raptor harnesses and 10 other open-source harnesses, they mapped 13 points where findings get dropped and organized them into a taxonomy. In six harnesses, a single file was dropped before the model saw it, five of them silently.

This survey codes 118 RAG defense papers by the endpoint each one measures, using a seven-family taxonomy with double-coded annotations (kappa=0.867). It finds that most studies measure corpus-use detection rather than content disclosure, and that most evaluations use general QA datasets and non-adaptive attacks. In the authors' testbed, a normalized 8-gram guard reduced 20-token copying to 0.0%, yet a three-query adaptive attacker still recovered 48.3% of hidden facts on Qwen3-8B.

DiagSafe is a diagnostic framework for evaluating LLM safety that replaces binary safe or unsafe labels with prompt-level rubrics covering safety and usefulness. Tested on a bilingual English-Chinese benchmark built on an 84-label safety taxonomy, it reached 95.34% agreement with human annotations, versus 69%-87% for baselines, and found that leading LLMs differ markedly in unsafe rates and are particularly susceptible in Chinese and multi-turn contexts.

This research benchmarks the physical adversarial robustness of compact grounding Vision-Language Models (VLMs) against object detectors, using a unified metric, conditional attack success rate (cASR), on images a model still localizes under a matched gray occluder. The authors split each failure into omission, substitution, and displacement, and find that VLMs can be as vulnerable as detectors. Failure mode tracks output format more than architecture, and under distribution shift VLMs that mainly omitted often shift toward displacement or substitution, which return confident, well-formed boxes.

This paper evaluates the physical adversarial robustness of compact grounding Vision-Language Models (VLMs) against object detectors, using a unified metric, conditional attack success rate (cASR), on images a model still localizes under a matched gray occluder. Failures are split into omission, substitution, and displacement. The authors find VLMs can be as vulnerable as detectors, that failure mode tracks output format more than architecture, and that under distribution shift VLMs shift from omission toward more dangerous displacement and substitution failures.

Researchers study how AI approval monitors that check consequential agent actions can fail together when they share a base model or a poisoned input. They measured twelve small open-weights monitors plus three closed frontier models and DeepSeek-V3.2 on payment approval under two pre-registered protocols. A rule that counts evidence sources instead of votes blocked 0.9% of correct payments, against 7.4% for the best counting rule, at equal safety.

SICAF is a self-supervised training framework for spiking neural networks estimating event-based optical flow. It uses a constrained optimization with temporal modulation to compress latent representations without discarding temporal saliency, plus a learnable temporal attention estimator. The paper reports an 8.14% AEE improvement on MVSEC and a 13.49% robustness increase under white-box adversarial attacks.

RoFuBERT is a robust fine-tuning framework for Chinese BERT-based pre-trained language models that uses fuzz testing. It extracts basis, glyph, pinyin and semantic features during fine-tuning, feeds them into fuzz testing to assess completeness under adversarial attacks, then retrains the model. Compared with two baselines, it takes 0.69 times the time and reduces attack success rate by 37.76%, with adversarial sample modification rate improved by 5.19% on average.

This review unifies agentic AI security, shadow AI governance and LLM supply-chain risk, drawing on 2136 sources screened from 7254 records dated January 2004 to June 2026. It proposes three failure primitives (visibility loss, identity ambiguity and provenance erosion) as an organizing framework in place of a conventional attack-surface taxonomy. The authors also map where practitioner concern outruns published evidence and set out a research agenda dated to 2026 signals.