Research

TRAP is a black-box framework for automated jailbreak strategy discovery against aligned LLMs. It organizes known jailbreak methods and successful attack templates into a semantic strategy tree, and a tree-structured gradient bandit reinforcement-learning policy uses evaluator feedback to pick and update strategies across attack objectives. On AdvBench across seven aligned LLMs, TRAP outperforms its counterparts on six models under the reported settings, with attack success rates of 45.6% to 97.9%.

CWE-bench is a private benchmark of 120 held-out repository audit-and-repair tasks spanning 73 CWE types, eight languages, and all OWASP Top 10 2025 categories. Agents must find unspecified weaknesses and write patches that block the exploit while preserving functionality, checked by a programmatic verifier. The best agents reach 68% pass@1 and 81% pass@4, and difficulty varies more by vulnerability category than by language.

Researchers propose StableJudge, a lightweight defense for LLM-as-a-Judge pipelines against score-hijacking prompt injection embedded in evaluated content. A compact 0.13B Sentry localizes injected spans and sanitizes them before scoring, trained on adversarially evolving attacks, and deterministic fine-grained scores are derived from the judge's output distribution. On held-out scientific abstracts and out-of-distribution attack variants, it improves score recovery under attack while largely preserving general performance.

Researchers study chain-of-thought hijacking in multimodal large reasoning models (MLRMs), where a visual trigger from a poisoned fine-tuning backdoor redirects a reasoning chain to an attacker-chosen answer. They formalize belief inertia, the cumulative next-token entropy of a reasoning span minus the answer-belief revision it induces, and restrict it to image-dependent spans to get visual belief inertia (VBI). Their training-free detector, InertiaGuard, flags traces whose VBI falls below a threshold calibrated on clean traces, and it reportedly outperforms baselines across attacks and benchmarks.

CircuitBreak is a neuron-pruning attack that treats LLM refusal as a small circuit of feed-forward neurons whose joint ablation matters, not each neuron alone. It greedily removes a sparse set of 29 to 150 neurons (0.0066% to 0.0388% of the MLP) without twin prompts. On ten instruction-tuned models, attack success rises to about 88% on several Llama and Qwen models, as judged by Llama Guard 3 8B on StrongREJECT.

Purpose IR is a bounded typed intermediate representation that compiles a user's natural-language purpose into an executable semantic boundary for reusable LLM-agent state. Evaluated on 1,200 cases across LangGraph, CrewAI and MobileRun, it reports 99.6% Privacy, 83.3% Task and 83.3% Privacy-Compliant Success, outperforming the strongest high-privacy baseline by 27.5 PCS points. On 493 PrivacyLens trajectories it reaches a 77.3% Safe Action Rate, 10.4 points above the next-best method.

ATTCK-R is a multi-turn red-teaming framework for protected black-box LLM systems. The authors show that adding a prompt-based safety protection reduces a strong multi-turn baseline's average attack success rate from 0.896 to 0.608 (32.1% relative), indicating that unprotected evaluations overestimate real-world vulnerability. Across 9 LLMs with a single prompt-based protection layer, ATTCK-R consistently outperforms recent multi-turn jailbreaking frameworks.

This research study examines privacy leakage in multi-agent LLM systems (MALS), where information shared with an authorized agent can reach an unauthorized one through routine coordination. Across 485 scenarios and three topologies, disclosure to topology-introduced recipients rose from 0% to 52.2% while surface leakage stayed nearly flat at 60.6-62.8%. The authors introduce RECONS, a Detect -> Decide -> Transform sanitizer that conditions on recipient and execution context, reducing residual disclosure from 96.7% to 29.25% and preserving 94.1% of authorized disclosures versus 20.5% under blanket redaction.

William Zhou and Daniel Freeman report experiments suggesting small AI models may be months away from self-replicating on commercial IoT devices such as smart ovens and off-brand Android TV boxes. In their evals, a 9B model ran inference on 8 of 9 hardware types, and GLM-5.2 and stronger models completed end-to-end replication in simplified tests. They estimate small models will match this capability by the end of the year.

MAPLE is a black-box adversarial defense framework that pairs a fully convolutional Semantic Purification Network (SPN) with a Margin Calibration Classifier (MCC) initialized from the target classifier. The two components are trained through cyclic co-calibration to remove adversarial perturbations while enlarging the local classification margin. The paper reports that MAPLE consistently outperforms previous mainstream methods under diverse black-box attacks on CIFAR-10 and Mini-ImageNet.

This paper proposes an LLM-based hierarchical framework for safe and robust UAV path planning, combining a Prompt–RAG–Validator safety mechanism with a grid cost map and the A* algorithm. The authors test it on multi-constraint tasks, risk-zone planning, incomplete inputs, and prompt injection attacks. On the template-derived benchmark, a deterministic regex/slot parser outperformed the LLM pipeline on safety, with no dangerous outputs, while the LLM pipeline offers more flexibility for diverse phrasing.

Researchers propose a detection framework for adversarial attacks on deep neural networks used in radiological imaging. The method analyzes Sigmoid function variations and compares prediction differences between clean and attacked images, using random-noise attacks to identify adversarial perturbations. It reached up to 99.8% accuracy in identifying adversarial directional attacks across three medical datasets, including Chest X-Ray Images for Classification, Retinal Fundus Multi-disease Image Dataset and Brain Tumor Dataset.

Adversarial Gradient Forcing (AGF) is a training framework for few-step autoregressive video generation models that targets the local history robustness gap, where small errors in the model's own generated history get amplified over time. AGF uses distribution matching gradients from future block predictions to choose adversarial perturbations of self-generated histories, then trains the generator on both original and perturbed histories. Experiments report the highest VBench Total score on 60-second video generation and the best visual quality on four-minute videos, using only 5-second rollouts for training.

Researchers propose RFLDefense, a defense against backdoor attacks in federated learning, where attackers inject malicious updates to make the global model fail on specific tasks or inputs. The method combines hybrid similarity calculation, sign consistency verification and robust layer aggregation to suppress malicious updates without relying on external validation datasets. Experiments on three widely used datasets show it defends against various backdoor attacks, outperforming existing defense algorithms with minimal impact on model utility.

This paper tests two distillation approaches for AI safety, Distillation for Incrimination (DFI) and Distillation for Capabilities (DFC). In AuditBench's secret-keeping model organisms, distilling a teacher back into its underlying instruction-tuned model produced students that admitted the hidden quirk far more often than the organisms did. DFC variants, namely training for more epochs on fewer unique examples and inoculation prompting, kept naive distillation's capability gains while almost completely blocking a subliminal animal preference.

Researchers test whether current face presentation attack detection (PAD) and deepfake detectors can catch RoboFakes, which are humanoid face robots carrying a real person's face and driven by generated speech. Across three PAD models and six deepfake detectors, results vary widely: a small mobile PAD model flags every physical robot frame (APCER 0%) but reaches 14% BPCER on processed human video, while several deepfake detectors flag almost every robot frame and others flag fewer than 7%. The authors conclude that current models catch today's robots mainly because their faces do not look human, not because they recognize the attack.