Research

This paper argues that attack success rate (ASR) for jailbreaks ignores repeated calls to the victim model, which give the deployed system more chances to detect and intervene. It introduces ASR_STEP, which penalizes additional victim-model calls while keeping binary success judgments. On JailBreakBench across three model families, GCG's scores drop by 7.0 to 8.7 percentage points after discounting, PAP's stay unchanged, and PAIR's drop by 3.4 to 12 percentage points.

Researchers asked whether text-to-image diffusion models can flag unsafe or adversarial prompts before an image is generated, rather than filtering outputs afterward. They propose Conditional Semantic Trajectory Interception (CSTI), which compares conditional and unconditional responses at early checkpoints, trained on canonical concept and safe examples without attack samples. Across five generators, four adversarial attack collections and two NSFW datasets, CSTI achieves the strongest overall performance among six baselines at a matched 5% FPR, and cuts generation latency by over 60% on intercepted paths.

This research introduces a benchmark for information injection attacks against LLM trading agents, which act on news as evidence and cannot reliably separate fabricated headlines from real ones. Across about 10,000 decisions on 15 U.S. stocks, fabricated news reached a 62% attack success rate, while two 30-word templates reached 100% on all 15 stocks. Removing credibility cues such as a named source or a "BREAKING" tag dropped success from 100% to 0% for the same fake claim. The authors report that most attacks evade standard defenses, and that only hierarchical aggregation reduced attack success rate.

Researchers propose Path-level Inference Randomization (PAIR), a defense for fine-tuned LLMs that randomizes computation inside LoRA adapters at inference time instead of filtering inputs and outputs. PAIR inserts generated shadow weights into feature-sensitive layers to create a stochastic inference network. Across evaluated jailbreak, prompt-stealing and backdoor attacks, the authors report reduced attack metrics with small changes in held-out task performance.

Researchers propose LI-Boost, a technique that improves how well adversarial perturbations transfer between models. They find that transferability correlates positively with the local invariance of perturbations relative to the input image. On ImageNet, LI-Boost enhances five categories of transfer-based attacks, with gains reported on CNNs, ViTs, defenses, commercial vision APIs and vision-language models.

Researchers propose DNS-TGA, a topology-guided adversarial attack on Graph Neural Networks that works in black-box settings. The method builds a graph representation aligned with the victim model using a similarity measure against a shadow model, then uses the volcanic eruption algorithm (VEA) to select critical nodes. A dual-discriminator built from the shadow and victim models generates perturbation samples. The authors report superior attack performance across six representative GNN models, plus scalability and transferability.

FedSEA is a federated learning framework that protects clients' local models while enabling accurate aggregation of the protected coefficients. The server applies truncated SVD to the initial global model and distributes quantized bases to clients, which upload only quantized pseudo-singular values. Pairwise symmetric masking, built on Diffie–Hellman key exchange and a pseudo-random generator, is removed during aggregation, and the source reports improved communication efficiency with preserved utility and security.

Pharmacist is a method that curates safety alignment data for large language models to resist harmful fine-tuning. It trains a selector to rank alignment data, up-ranking high-quality, safety-critical examples and down-ranking the rest. When combined with RepNoise and T-Vaccine, the selected subset improved defense performance by 2.60% and 3.30%, and reduced training time by 56.83% and 57.63%.

FedPSA is a backdoor attack framework against federated parameter-efficient fine-tuning of LLMs. It identifies the most sensitive prompt layers, poisons a minimal subset of them under parameter constraints, and uses adaptive triggers that adjust to non-IID data. Across five datasets and six language models, it reportedly outperforms the evaluated baselines while keeping clean-task performance competitive.

The authors ask when adversarial perturbations on vision models can be provably detected, using a geometric approach. They compare a standard CNN embedding space with a novel prime-quantized space, where small perturbations are absorbed by number-theoretic discretization, and use the geometric discrepancies between the two spaces to flag adversarial samples. They report theoretical guarantees, including Gromov-Wasserstein separation, and state that experiments show strong detection across many attack types and model families.

Autonomous clinical-modeling agents can raise predictive performance while breaking conditions needed for usable models, such as using prediction-time-invalid inputs. The authors introduce LeakBench, an executable audit suite that tests agent decisions for leakage, calibration, site-level evaluation, support awareness and decision-curve net benefit. In logged runs, DeepSeek Flash and GPT-6-astra leaked a fatal feature in 10/10 unconstrained runs and 0/10 runs with an explicit admission-time constraint, and a deterministic provenance verifier in the loop removed the leak.

SpanGuard is a lightweight guardrail against indirect prompt injection (IPI) that splits detection into two steps. It first locates candidate injected instructions in tool outputs using unsupervised segmentation, then uses a small language model to judge whether each block is authorized by the user's request. The authors report a 0.32% attack success rate with negligible loss in benign utility, while remaining effective with substantially smaller models.

SPLASH is a method for detecting security hallucinations in LLM-generated code, which pass functional tests while staying insecure. It scores candidate programs using audit pressure, a contrast between teacher-forced log-probabilities under a security review and a style review. On 63,684 programs from 12 models across 899 tasks, it picks the secure program in 74% of cases and places the vulnerable statement first in 58% of insecure programs.

SUMMARK is an auditor-assisted watermarking framework that verifies whether a hosted LLM served a claimed identity, using user-visible reasoning summaries as a keyed audit surface. Auditors enroll identities and calibrate per-identity thresholds before deployment, and audits rely only on the released output. Across model families, scales and task domains, the method reliably detects cross-family and cross-scale substitutions at low false-positive rates while preserving answer quality, though the authors also report failure boundaries under rewriting stress tests and text-only spoofing.

RAGLeak is a supply-chain privacy backdoor attack on Retrieval-Augmented Generation systems that separates information leakage from direct textual exposure. When triggered, the generator reversibly obfuscates retrieved private documents, which an auxiliary LLM then recovers with high fidelity. Across three model families and three application domains, the attack reaches up to 100% ASR, with at most a 10-percentage-point ASR drop under representative detection-based defenses.

This paper formalizes budgeted attack scheduling for red-teaming LLMs, where a fixed attempt budget must be spent across a fixed jailbreak attack library. It compares three signals: historical attack success rate priors, semantic guidance from LLMs, and online feedback from earlier queries, using four scheduling strategies across three victim models and three defense settings on GPT-5.2. The authors find that historical priors give a strong start but weaken under defense-induced distribution shift, while online feedback helps most once transferred priors go stale.

GHOST is a two-phase backdoor attack on federated learning that pairs a dual-discriminator GAN with multi-round anticipation. The GAN generates synthetic samples aligned with the global data distribution, which the attacker uses to simulate future FL rounds and optimize a poisoning update for long-term survival. Experiments on several vision datasets show more durable backdoor persistence than prior methods, including under norm-bounding and FoolsGold, with competitive clean accuracy.