Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,003 items
RegexStealer is a black-box attack that recovers a web application firewall's pre-defined rules as regular expressions. It selects probe samples with a clustering algorithm, builds a directed acyclic graph of the WAF's behavior from its responses, then converts that graph into regexes. The authors use SQL injection as the test case and report over 0.99 fidelity and more than 16 times the speed of ActiveThief and Regex Generator++.
Researchers characterize how detectable malicious injections are on the RAVEN II surgical robot, using a public dataset that pairs platform telemetry with external high-resolution encoder ground truth. They test three injection points across the command and observation paths and three injection patterns with increasing temporal dispersion, detecting at window and session timescales. Detectability depends strongly on how the injected deviation is spread over time: an abrupt step is detected well below the 1 mm clinical tolerance, while the same total deviation spread across a window or session can stay hidden from single-window statistics.
This paper presents BXLL, a Bi-LSTM stacking ensemble combined with SDN-driven honeypot engagement for adaptive intrusion detection in IoT networks. The source text provided contains only the title, publication date, journal volume and authors, so the research question, method details and findings are not stated.
The source text consists only of publication metadata: a December 2026 date, the Journal of Information Security and Applications (Volume 103), and the authors Xinfeng He and Xia Li. It contains no abstract, method, or findings, so no summary of the research can be given.
Researchers introduce IndirectAD, a data poisoning attack against recommender systems inspired by Trojan attacks on machine learning. The attack first promotes a trigger item, then transfers that advantage to a target item by creating co-occurrence data between them, which reduces the number of controlled accounts needed. Experiments on multiple datasets and recommender systems show noticeable impact with only 0.05% of a platform's user base.
AdvNup is a physical adversarial attack that spoofs deep neural network speaker recognition systems using near-ultrasonic perturbations played through commercial off-the-shelf speakers, avoiding the specialized hardware that earlier ultrasound attacks required. The authors use single-sideband modulation with low-pass filtering, a nonlinear frequency response model, and time-frequency masking to keep the adversarial signal intact through physical transmission. In simulated and physical experiments, it reached a 100% attack success rate for closed-set identification and over 90% for open-set identification in targeted attacks.
Researchers study visual prompt injection (VPI), where instructions embedded in input images are followed by large vision-language models (LVLMs). They propose "goal hijacking via visual prompt injection" (GHVPI), which redirects an LVLM from its original task to an attacker-specified one. Their quantitative analysis reports an attack success rate of 15.8% against GPT-4V, and they find GHVPI success depends on the character recognition and instruction-following capabilities of LVLMs.
Published in Circuits Systems and Signal Processing on 2026-09-28, this research paper concerns the robustness of speaker recognition systems in noisy channels. It combines thermal diffusion-based adversarial attacks with a wavelet-based defence. The source text provided contains only the publication details and reference list, so the method and findings are not described.
Researchers ask whether a single adversarial image can consistently mislead diverse frontier MLLMs in black-box settings. They present O-Attack, a transfer-based black-box framework that exploits cross-modally aligned semantic representations in surrogate models, and report attack success rates rising on GPT-5.4 (29.1% to 77.2%), Claude-4.6 (42.8% to 81.6%), and Gemini-3.1 (38.2% to 80.9%). Across 24 MLLMs, O-Attack outperforms six state-of-the-art methods in black-box transferability.
This research asks whether adversarial training improves generalization for multi-view vision-language-action (VLA) robot policies adapted from a pretrained VLM, evaluated across seven LIBERO-Plus shift axes. Direct adversarial training substantially improves Camera Viewpoint and Sensor Noise but gives mixed or negative effects on other shifts, and it can cause view collapse, where the policy becomes dominated by the wrist view. Adding a View Swap intervention further improves Camera Viewpoint, Sensor Noise, and Robot Initial State, with mixed effects elsewhere.
Fix: The source mitigates view collapse with a simple View Swap intervention, applied before re-evaluating adversarial training.
Arxiv (cs.RO + cs.CV security)This research study tests adversarial patches for aerial perception under three physical constraints: a printer's reproducible ink gamut, the flat panel a vehicle offers, and detail loss from altitude. Measured printer gamuts raised net attack success on three of six closed-set segmentation victims, for example +0.120 on DeepLabv3-R101 and +0.041 on SegFormer-B0. A printed-decal evaluation did not detect transfer and bounds the transferred rate at 0.133.