Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,003 items
This abstract, published in Annals of Emergency Medicine on 2026-10-01 (DOI 10.1016/j.annemergmed.2026.08.326), examines whether large language models can extract pulmonary embolism features from radiology reports. The source text provided is only publication metadata and contains no study methods or findings.
Researchers asked whether adding targeted adversarial training to a Federated Learning pipeline improves diagnosis and spatial interpretability in chest X-ray analysis. They trained a ConvNeXt model with Federated Averaging and a single-step adversarial strategy (Step-ML) across controlled and multi-site heterogeneous client setups. The adversarially enhanced approach improved diagnostic performance over non-adversarial and non-targeted baselines, and the aggregated model stayed more robust than individual local models under severe data fragmentation.
Researchers propose the Neuro-Immune Transformer (NIT), a hybrid intrusion detection architecture that pairs a transformer-based contextualization engine with an adaptive Artificial Immune System using a Clonal Selection Algorithm for detector evolution. Evaluated on the imbalanced WUSTL EHMS 2020 IoMT dataset, NIT reports 98.04% accuracy, a 92.9% detection rate, a 0.9168 F1-score and a 1.4% false alarm rate, and it resists Gaussian noise and FGSM adversarial attacks. With 856 K parameters and 3.2 ms inference latency, it targets resource-constrained edge-IoT deployment in healthcare networks.
Researchers surveyed 301 wearable fitness device users and ran a focus group of 99 participants to study what drives willingness to disclose personal health information. They tested an integrated model built on the health belief model and the theory of planned behavior. Perceived benefits, perceived barriers, attitudes, and subjective norms significantly shaped disclosure, and pandemic risk concerns moderated it. Users shared sensitive data more readily when they saw high personal benefit and low risk.
This paper proposes function calling (FC), a built-in LLM mechanism for invoking custom tools, as a lightweight defense add-on against adversarial prompts. By defining functions that represent malicious actions, FC-equipped LLMs intercept harmful prompts by triggering those calls instead of generating unsafe content. The authors also introduce the DSPEC dataset, on which FC reportedly outperforms existing defenses.
The article is titled "Less is more: Interpretable prefix-based jailbreaking of MoE language models" and was published in Knowledge-Based Systems (Elsevier BV) on 2026-10-01, DOI 10.1016/j.knosys.2026.117130. The source text provided contains only publication metadata, so its research question, method and findings cannot be summarized from it.
A paper in Information Sciences (Elsevier BV, published 2026-10-01, DOI 10.1016/j.ins.2026.124269) presents a learning-based framework for classifying pneumonia from chest X-rays. The title indicates it combines privacy-preserving deep learning with adversarial training. The source text provides no further method details or findings.
Researchers present AgentBreaker, an indirect prompt injection framework that autonomously writes adversarial phrases tailored to each page's context and embeds them as HTML elements. Against five state-of-the-art web agents across 60 webpages sampled from Online-Mind2Web, it reached an attack success rate of 71.7%–100%, inducing actions such as clicking attacker-designated elements, posting attacker-provided text and disclosing internal agent secrets.
Fix: The authors propose defenses that mitigate the observed threats and address potential adaptive attacks, reducing the attack success rate to 1.7%. The source does not describe the individual defense mechanisms in the provided text.
OpenAlex (peer-reviewed AI security)Researchers show that CNN downsampling layers violate the Sampling Theorem, and that this aliasing correlates with vulnerability to adversarial attacks and distribution shifts. They propose Frequency Low Cut Pooling (FLC Pooling) and its extension Aliasing and Sinc Artifact-free Pooling (ASAP), an alias-free downsampling operation in the frequency domain that also removes sinc-interpolation artifacts. On ImageNet-1k, ImageNet-C and CIFAR across several CNN architectures, networks using these methods showed greater robustness to common corruptions and adversarial attacks while keeping clean accuracy close to baseline models.
The paper asks whether a network intrusion detection system's model can be extracted using only hard-label black-box queries. The source text provided gives only the title, publication date (December 2026), journal (Journal of Information Security and Applications, Volume 103), and authors (Donguk Min, Seungsoo Nam, Daeseon Choi), with no method description or findings.
Stuart Russell's human-compatible AI framework proposes that AI systems should defer unconditionally to human operators. This paper argues that total deference carries its own risks and limitations, and reports a HICSS workshop panel on (un)cooperative robots that can refuse human directives for principled reasons. The panel identified eleven research themes, including authority hierarchies, benevolent uncooperativeness, and AI liability, and called for research beyond compliance-centric AI design.
TACTIC is a scene-aware framework that uses a multimodal large language model to coordinate roadside LiDAR attacks under a gray-box threat model, without access to the victim LiDAR's point clouds or internal processing. Across 280 randomized CARLA trials, the full policy achieved a 100% collision rate, compared with 35% for a fixed rule, 60% for random selection, and 75% for a restricted LLM using mode selection with default parameters. The authors conclude that scene-dependent tactical planning can expose context-sensitive LiDAR failure modes that fixed attack policies may miss.
Researchers propose a "carrier", a secondary visual element that gives unrestricted adversarial attacks an auxiliary region to work in, so the primary object (the subject) is distorted less. Under global classifier guidance, the carrier absorbs a larger share of normalized attack updates and improves cross-model transferability. Targeted attacks keep the personalized subject as the main content perceived by humans while misleading the classifier.
This paper proposes Normal Diffusion Dynamics Learning (NDDL), a backdoor defense for text-to-image diffusion models. NDDL trains a timestep-conditioned dynamics model on benign samples only, using cross-attention, latent and noise space trajectories. At inference, deviations between observed and predicted transitions flag backdoors and enable trigger localization by substituting low-semantic words; the authors report effectiveness and generalizability across diverse attacks.
Researchers present AdvPCS, a universal cross-prompt adversarial attack on Promptable Concept Segmentation in SAM3, which extends SAM-series models to concept-level prediction. The method combines min-max prompt optimization with perception deception and temporal memory misalignment attacks. A single universal adversarial perturbation (UAP) generalizes across frames from different videos and reduces the average mIoU of PCS models on the SA-CO dataset to below 5% under text prompts.
Researchers propose a Universal Adversarial Object, a sphere with an optimized surface texture, that degrades the task success of Vision-Language-Action (VLA) models when placed in a robot's field of view. Their multi-level attack framework disrupts trajectory planning, task execution and action control, and was validated in simulated and real-world robotic settings. The object reduces average task success rates by 31.2% to 39.9% for two VLA models, Pi0 and RDT, with success rates dropping to near zero in complex scenarios.