Research

This research shows that dense LLM graders used to score jailbreak attacks can collapse compliant responses into the evasion class, so the reported attack success rate depends heavily on which grader is used. On two corpora of 900 responses and eight graders, the compliance rate differs by a factor of 22 to 25, while the non-refusal rate differs by 18 to 23 percentage points. The authors propose reporting the compliance rate with its per-class label counts and the named grader, alongside the non-refusal rate.

This research paper shows that coordinated retrieval poisoning in RAG systems leaves a detectable fingerprint: a dense, query-anchored component in the evidence embedding geometry. The authors' CoordGuard auditor flags this structure from query-weighted affinities without poison labels, answers or reader gradients. Pooling four Natural Questions retrieval seeds, e5 always-filtering cuts exposure-conditional attack success to 0.167 at a 13.6-point clean accuracy cost.

Researchers study jailbreak attacks on LLM agents, comparing zeroth-order (function-value feedback), first-order (gradient-based), and combined optimization orderings. They propose a ZO-FO framework with Pair-aware optimization, which keeps multiple adversarial prefix candidates, refines their suffixes, and selects among the resulting prefix-suffix pairs. Experiments on malicious-instruction and malicious-environment benchmarks show hybrid optimization improves attack effectiveness over single-optimizer methods, and optimization order substantially affects performance.

This paper proposes a defense against a data-poisoning attack that plants a Trojan in an LLM. When the trigger appears in the prompt, the Trojan lengthens the response and so raises the user's token cost. The authors show that a subtle Trojan can activate on semantically similar instructions of an instruction fine-tuned LLM.

This study tests whether LLMs misjudge CVSS severity from narrative bug bounty reports, using 240 Huntr reports with vendor-validated CVSS vectors and eight models under four prompting strategies and fine-tuning. The best prompting configuration reaches only 49.58% level accuracy, and fine-tuning a 7B model raises this to at most 56.25%. Errors are directional: models overestimate far more often than they underestimate, and they almost never recognize low-severity vulnerabilities.

Researchers analyze cross-lingual safety behavior in large language models at the neuron level and identify a compact set of safety-related neurons shared across languages, called the safety kernel (SK). They introduce SK-Masked LoRA, which restricts LoRA adaptation to the feed-forward network output dimensions corresponding to the SK. According to the paper, this substantially reduces attack success rates across multiple languages, including languages excluded from SK discovery, while changing only a small fraction of neuron coordinates.

Researchers introduce safe task completion, a setting where an LLM-enabled robot refuses the harmful part of a compound instruction while still completing its legitimate sub-tasks. They propose RuleGraph, a multi-agent Graph-of-Rules planning framework that spreads safety enforcement across several reasoning and verification stages. On two benchmarks, RuleGraph reduces Attack Success Rate to 0% and reports Task Success Rates of 98.57% on RoboGuard and 84.54% on long-horizon compound instructions.

Researchers study feature vectors, directions in a language model's activation space that correspond to human-interpretable concepts such as honesty or deception. They build vectors from the difference in mean activations between synthetic concept and antagonist stories, scaling to 1,036 alignment-relevant concepts from 2M stories released publicly. The vectors generalize across six models from three families for detecting concepts and steering behavior, and are used to analyze jailbreak attacks and reasoning.

UAAD (Unified Anomaly-Aware Defense) is a framework that mitigates diverse backdoor attacks on graph neural networks. It builds a pseudo-clean reference distribution with spectral clustering, scores suspicious nodes with Mahalanobis distance, and prunes suspicious edges with an adaptive Gaussian Mixture Model, without fixed thresholds. In GCN-based evaluation on five real-world datasets, its mean ASR stays at or below 0.0775 against GTA, UGBA, and DPGBA, with a dataset-dependent clean-accuracy trade-off.

The paper titled "TNIA: Target-aware transformer-based node injection attacks on graph neural networks" was published in Expert Systems with Applications (Elsevier BV) on 2026-10-17, DOI 10.1016/j.eswa.2026.134772. The source text provides only publication metadata and no details of the method or findings.

Screwtape is a pipeline that edits real agent transcripts to insert attacks that evade action-only monitors, refining each edit until the monitor no longer flags it. An LLM verifier checks that each attack is realistic, clearly harmful, and plausibly successful. Across 252 runs on 94 transcripts, 35 attacks evaded the authors' monitors and 6 of those also evaded a held-out frontier developer monitor, confirmed through human review.

Researchers study token-level attribution for multi-mode Gumbel-max LLM watermarks, where a document may mix spans watermarked under different secret keys with unwatermarked text. They show that the optimal rule reports the mode with the largest prior-weighted alternative density and rejects when this density exceeds a common threshold, then propose the BLADE detector, which keeps the exact Type I error and attains higher correct-label power than compared detectors on OPT-1.3B and other open-weight models.

SemPurify is a data purification framework for black-box backdoor defense that uses multi-level semantics, including low-level semantic embeddings and high-level image tags, to guide a text-to-image model during image restoration. The authors state that the approach removes backdoors across classification models, CLIP-style encoders and generative models while preserving semantic information for downstream tasks. The paper argues that existing purification defenses that rely on transformations such as blurring degrade image quality and can alter visual or semantic content.

Researchers show that visual perturbations can redirect vision-language-action robot models away from the user's intended task. Prior attacks used fixed target supervision, which stops matching the states the attacked robot actually reaches. The proposed TRACO framework rebuilds supervision from the states reached under attack and focuses updates where task progress stalls, improving task-redirection success across VLA models and simulation environments.

This paper studies monitor-validity failures in LLM and agent frameworks, where a safety detector recognizes a policy-relevant payload but the framework never routes that evidence to its enforcement decision. Using canary contracts on public framework repairs, the authors confirm 18 evidence-path failures across 11 LLM or agent safety project groups and four implementation ecosystems, with 14 reaching enforcement boundaries. They conclude that monitor assumptions need regression tests at the schemas, streams, tools, and adapters that frameworks evolve.

MobileInject is a benchmark for testing MLLM-based mobile agents against multimodal injection attacks, where malicious objectives are embedded in cross-application content. It covers 11 scenarios, 9 security-risk categories and 108 executable risk instances, and adds Cross-Modal Consistency Injection plus two attack methods, Multi-Role Collaborative Deception and Reasoning-Camouflage Injection. The authors report that mobile agents are broadly vulnerable, with many failures arising from reasoning hijacking at early stages.

Benchmarks for indirect prompt injection in tool-using agents usually report attack success rate, which counts every failed attack as a defense. An audit of 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo found that most failed attacks were ignored (76-80%) rather than refused (17-18%). Changing only the system prompt moved InjecAgent ASR from 0.2% to 43% with identical weights, and 21.7% of AgentDojo episodes stayed safe without completing the user's task.