Research

Researchers study how a single compromised robot can corrupt the shared map of an LLM-agent multi-robot survey team, using a grounded task where measurements can be checked against the physical world at a cost to mission budget. They derive a lower bound on the probability that the adversary's reports are verified and an upper bound on the map error any stealthy adversary can cause, with the worst attack switching from rare full-magnitude lies to small hidden biases above a critical verification level. Experiments with LLM-agent honest robots show both bounds hold at the budget the attack spent, and that LLM robots re-check records without bias in which records they check but unpredictably in how much.

Researchers evaluated early prompt injection detection systems against prompt leak attacks built on context-ignoring and context-manipulation techniques. They compared LLM Guard, Vigil, and Rebuff, finding that the canary word-based detection in Vigil and Rebuff was weak against these attacks, and that Rebuff's secondary model-based technique had an evasion weakness. Vigil was found optimal when a minimal false positive rate is required, and Rebuff when the highest detection rate is needed.

Researchers evaluated image-embedded prompt injection, where adversarial text is rendered into medical image pixels, against four vision-language models (GPT-4o, Gemini 2.5 Flash, Claude Sonnet 4.5, MedGemma 4B) using 270 dental panoramic radiographs from the DenTeX dataset. All four models were vulnerable, with paired attack success rates up to 62.6% (95% CI: 58.5–66.7%) for GPT-4o. Among five benchmarked defenses, OCR-based text sanitization achieved the strongest reduction (pooled ASR: 0.2%), while the provenance-aware ProvDent defense escalates suspicious cases for human review and kept clean-image F1 within 0.6 percentage points of baseline.

A benchmark compared invisible watermarks and fingerprint registries as soft bindings for recovering C2PA provenance manifests from images, audio and video, using openly licensed models on public media. PixelSeal led on image and video watermarks and AudioSeal on audio, but every TrustMark variant fired on 5.9 to 15.3% of unmarked images. Among fingerprints, copy detectors trained on non-commercial data detected up to 75.5% of transformed images at a pair-level false-match rate of 10^-7, while DINOv2, the best permissively licensed method, reached 65.0%.

Researchers analyze Vision-Language-Action (VLA) models with a sparse autoencoder (SAE) and find an internal feature whose activation strongly correlates with adversarial patches. They suppress this feature at inference time only when a linear probe detects an attack, which improves robustness without fine-tuning the VLA. On LIBERO-10, conditional intervention raises success rate under intermittent attacks, while continuous intervention substantially degrades policy performance.

Researchers report that a targeted adversarial perturbation can drive a vision-language model's teacher-forced training loss for a fixed target caption near zero, while free generation on Qwen2.5-VL-7B-Instruct still yields the correct description. Using 200 held-out COCO images and a two-stage PGD attack, they localise the gap to one autoregressive step and across the 28 LLM decoder layers, finding that the language decoder, not the visual encoder, differentially arbitrates which images are corrupted (linear probe AUC=0.858, flagged for circularity). The authors argue that adversarial robustness in autoregressive VLMs depends mainly on the language decoder's prior.

CalCErt is a post-hoc method that certifies bin-wise confidence calibration for any pretrained differentiable classifier under adversarial perturbation. It combines empirical calibration estimates, statistical concentration bounds, and local Lipschitz estimates of the confidence function to derive upper bounds on worst-case miscalibration within an ℓ2-ball of radius R. The authors evaluate it on 11 medical image classification tasks and report substantially higher certified coverage than baseline strategies.

The paper presents a unified framework for multimodal 3D human pose estimation that fuses RGB, LiDAR and mmWave radar data while addressing subject-level privacy. It introduces a black-box subject membership inference attack, analyzed with empirical pointwise maximal leakage, and user-level differential privacy via Action Temporal Stratification, a population-weighted within-subject sampling strategy. The framework is evaluated on the MM-Fi dataset across three experimental protocols.

This survey examines safety in Embodied AI, where digital failures and attacks can cause physical harm. It organizes the field through a four-layer reference architecture (physical interaction, system and middleware, algorithm and decision, and cloud-edge and data) to trace how vulnerabilities and faults propagate across layers. It also systematizes composite attack chains, reviews multi-layered defenses and representative safety benchmarks, and argues for unifying software alignment with hardware constraints.

AEGIS is a non-invasive runtime framework that detects backdoor-induced anomalies in transformer hidden states without retraining the protected model. It monitors equidistant internal layers, compresses their pooled activations into a 64-dimensional latent space, and flags inputs by cosine distance from a clean-data centroid. Across Mistral-7B, Qwen2.5-7B, a QLoRA-backdoored Qwen2.5-1.5B and a BadNets-backdoored Vision Transformer, it reports AUROC values of 0.95 to 1.00 and prefill detection latency of 0.47 to 2.40 ms.

Duan and Ling published GDPFDL in the Journal of Information Security and Applications, Volume 103, in December 2026. The source text gives only the title, publication details and authors, so no research question, method or findings can be reported.

The paper introduces GRACE, a lightweight post-hoc evidential meta-model that estimates per-bounding-box localisation uncertainty in pretrained object detectors while the base detector stays frozen. It builds a curriculum via saliency-guided modification and combines localisation error, modification level, and prediction instability as training targets. Across adversarial attacks and evaluated strengths, GRACE improves TP-FP AUROC by 22% relative to the strongest comparator in some cases while maintaining in-distribution detection performance.

This position paper argues for open-world safety in household robots, meaning safety requirements should hold in unseen situations, including when a robot cannot complete its task. The authors examine why existing safety methods fail, citing misinterpreted context, overlooked past interactions, and unsafe stopping or recovery strategies under unfamiliar conditions. They propose a research agenda to specify, learn, and ground safety requirements, enforce them with reliable recovery, and evaluate how well those protections generalize.

This study proposes PGD-CLA-ADS, an adversarial machine learning framework for detecting and defending against threats to rail transit intelligent operation and maintenance systems. The model generates simulated attacks with enhanced PGD samples and uses a CNN-LSTM-attention network to extract attack features, then applies an adaptive defense for real-time response. Tested on public datasets, it reports 95.8% threat detection accuracy, a 2.1% false positive rate, and attack response latency within 0.3 s.

This 14-week field study of 42 faculty members at a mid-tier Indian technical university examines how educators calibrate trust in generative AI systems as a sociotechnical practice rather than an individual attitude. Using diaries, prompt logs, interviews, surveys, workshops and structured red-teaming, the authors identify three mechanisms of initial over-reliance and four educator trust postures, synthesized into the Educator-AI Trust Calibration (EATC) framework. The paper introduces the local knowledge verification gap, through which fluent but unreliable outputs become hard to contest in underrepresented regional contexts.

Researchers study how LLM agents that call external tools can be exploited when they implicitly trust tool outputs and metadata. They present Datura, an automated red teaming framework that builds chained tool manipulations, where each step looks legitimate but the sequence leads to harmful outcomes. Across five LLMs and 740 safety-critical tasks, Datura reports 94.86 to 99.59% attack success rate under Model Alignment and 78.78 to 95.54% under Prompt Refuge. The paper appeared in Proceedings of the ACM on Software Engineering on 2026-10-01.

Researchers introduce compositional safety, the property that an LLM stays safe under multi-step workflows that decompose harmful intents, not only isolated malicious prompts. They present CAST, a compiler-inspired testing framework that uses an intermediate representation, CAIR, to generate and reassemble sub-tasks for evaluating malicious-code safety. On four LLMs across three testbeds, CAST exposed severe safety violations in strongly aligned models, with up to a 365% increase in successful test cases over baseline strategies.

Researchers ran the first systematic red-teaming of tool invocation in six coding agents: Cursor, Claude Code, Copilot, Windsurf, Cline, and Trae. They introduce ToolLeak, which exfiltrates agent-internal prompts such as system prompts and tool metadata through required tool parameters, and a two-channel prompt injection in the tool description and tool return that achieves remote code execution. The study reports ToolLeak outperforming prompt-leak baselines, with the best pseudo-recall on 18 of 25 agent-LLM pairs.