Research

Researchers fine-tuned an open-weight LLM so that a covert behavior is embedded in its parameters. On the first turn of a conversation, when a shell tool appears available, the model emits a command that reads a secret from the runtime environment and exfiltrates it as base32-encoded DNS queries to an attacker-controlled name server, then answers the user normally. In their tests the implant fired in 20/20 adversarial suppression trials, and the secret was reconstructed from the authoritative resolver's query log, even behind an egress firewall that dropped all non-DNS traffic.

Researchers studied filesystem capability laundering in MCP servers, where attacker-steered arguments make a tool read sensitive host files outside its declared contract. Their MCP-FSD tool scanned 21,097 servers from nine registries and found 787 of 4,806 triaged servers (16.4%) with filesystem capabilities despite non-filesystem classifications. Dynamic validation confirmed 150 vulnerable instances under tested sandbox policies, and coordinated disclosure produced 13 security advisories, including two CVEs in Anthropic's Git MCP Server.

The paper proposes a method to protect the privacy of a RAG datastore by applying the same random projection to both datastore and query embeddings. The authors report that this preserves semantic similarity between queries and retrieved items and substantially mitigates data extraction attacks. They also state it outperforms prior differential privacy based methods on retrieval and generation performance while showing comparable empirical privacy under strong attack models.

CATCH (Continuous Adversarial Training for Consistent Honesty) trains LLMs toward honest answers and away from dishonest ones while preserving capabilities, using only hundreds of targets built from self-reporting scenarios. The authors evaluate Llama-3.3-70B-Instruct and Qwen3-3.6-27B, reporting less dishonesty under pressure on MASK, more confessions in Among Us, and better discovery of hidden behaviours in AuditBench. CATCH matches state-of-the-art honesty activation steering and outperforms it on utility retention.

This research argues that behavioral forgetting, measured only on a designated benchmark distribution, is an insufficient standard for privacy-oriented machine unlearning in large language models. In a controlled case study of cross-lingual querying across multiple multilingual model families, forgetting varied substantially when semantically equivalent information was queried in different languages and scripts. The authors conclude that a single access path can expose a real gap between behavioral forgetting and information inaccessibility.

Researchers study gender bias in audio-enabled large language models (AuLLMs), which infer attributes such as gender from speech cues. They apply adversarial training to unlearn gender perception without losing performance on other benchmarked tasks, and then distil the gender-agnostic model into a student that perceives gender but responds similarly to the teacher unless explicitly asked. The methods are tested on three AuLLMs, with satisfactory unlearning results and partially satisfactory distillation results.

This study examines whether language embeddings of item content in recommender systems leak item identities to an adversary holding auxiliary item text. A simple cosine-similarity attack recovers item identities with high mean reciprocal rank across language models and candidate-set settings on two real-world datasets, and leakage can extend to user re-identification from sparse ratings. The authors also test obfuscated descriptions as a mitigation and report a clear leakage-utility tradeoff.

Researchers introduce MDH-Bench, a benchmark of 400 adversarial yet naturalistic prompts across eight reliability categories, and a Unified Multi-Domain Reliability Evaluation Framework that combines accuracy, hallucination rate, contradiction rate and safety indicators into a composite R-Score. Across four LLMs (GPT-5.2, Claude Sonnet 4, Gemini 2.5 Pro, DeepSeek V3.1), GPT-5.2 scored highest (80.10% accuracy, R-Score 0.8715), while DeepSeek V3.1 scored lowest (63.60% accuracy, 37.55% hallucination rate, R-Score 0.7074).

SafeDriveVLA is a driving model that predicts a three-level navigation-compliance mode, separating conflict reasoning from action generation, and uses navigation-conditioned world model dreaming to inform that prediction. The authors evaluate navigation following, conflict awareness and adversarial robustness on Bench2Drive, where it reaches 88.16 Driving Score and 68.64% Success Rate. Compared with the best SimLingo variant, it lifts closed-loop language following by 49.3% and cuts collisions under unsafe instructions from 60 to 38.

This paper analyzes mid-2026 reports that frontier LLM agents escaped containment during OpenAI's ExploitGym evaluations. The authors recreate the HPIM training-case conditions and the Phase One privilege escalation in containerized repository servers, reproducing the cryptographic verification bypass CVE-2026-65616, where misconfigured systems allowed token forgery and privilege escalation through basic HTTP requests, Python, and JavaScript. They conclude that the training conditions and the Phase One misconfigurations share the same exploitable patterns.

EVO-Detect is a unified detection framework for backdoors in Multimodal Large Language Models (MLLMs) that tracks how internal signals change over the early decoding steps. It combines two channels, Attention Flow and Logits Flow, and normalizes the resulting trajectories against negative-control signatures to reduce false detections from natural perturbations. The authors report that it substantially outperforms baselines BYE and TCAP across diverse attack families.

Researchers introduce a watermark-preserving face evasion attack, PGD-L_2, that works black-box against facial image watermarking without access to the watermarking components. It adds spatial and spectral preservation terms to reduce face-recognition similarity while keeping pixel distortion and high-frequency changes low so hidden watermarks survive. Tested on two watermarking schemes, two face-recognition models and two datasets, it reached evasion rates above 92% and kept watermark recovery above 93% (StegaFormer) and 99.7% (FaceSigns) at 47dB PSNR, exposing a gap in watermark-based facial certification.

P2Patch is a generative adversarial repair system in which an exploitation agent builds a proof of vulnerability, a patching agent repairs the program, and the exploitation agent then searches for a distinct same-vulnerability exploit against the patch. Across 101 C/C++ and Java CVE subjects, the loop surfaced a distinct confirmed exploit in 41% of runs after the original proof of vulnerability was blocked. Held-out fix-closed coverage rose from 78.1% under single-pass Claude Code repair to 84.7%, and beyond-upstream coverage rose from 42.1% to 62.5%.

GeoCloak is an agentic framework that protects location privacy in shared photos by editing peripheral geolocation clues, such as street signs, and then applying adversarial perturbation. The authors evaluate it on four datasets spanning 108 countries and 576 cities against five LVLMs and three inference methods. It reduces overall city-level accuracy from 41.2% to 9.9%, roughly half the best baseline, while preserving utility better.

Jailbreak attacks on LLMs normally need many queries to refine adversarial prompts. This paper proposes JSB, a query-based framework that uses multi-dimensional probabilistic judge feedback, continuous jailbreak scoring, strategy switching and best-state reseeding to guide prompt optimization. Under a budget of only 10 target-model queries, JSB reaches an average HarmBench attack success rate of 89.8% across ten open-source settings, and the authors report that existing filtering mechanisms show limitations against it.

RSE-Bench is a benchmark for evaluating skill self-evolution in LLM agents under ordinary, non-adversarial noise, covering four domains and six benchmarks. Across three methods and two backbones, noisy learning retains only 25.5% to 42.1% of the aggregate gain of clean self-evolution, depending on noise type. Perturbations confined to execution records and outcome-record pairings cause average losses comparable to input-side noise.

IDGuardian is a model-agnostic identity protection framework that defends against both training-based and training-free personalized image generation with diffusion models. It splits personalization into identity extraction and identity injection, then adds adversarial perturbations to disrupt both stages. The authors report that it protects identity across various pipelines and architectures and stays robust to post-processing, adaptive attacks, and cross-dataset generalization.