LoRA subspace projection suppresses backdoors but does not erase them
Few-shot reactivation restored 91.7% to 100% attack success in one epoch for every weight-editing defense tested.
Stories per day · 30 days
4 RSS
Relatedprompt-injection2adversarial-prompts1adversarial-training1advguard1ai-safety1audit1backdoor1clustering1code-generation1corpus-poisoning1edge-llm1guardrails1harmbench1indirect-prompt-injection1insecure-code1jailbreak1lora1model-optimization1
40 stories, newest first · one card per story
Stories tagged #llm-security
SecPO adversarial training for prompt injection security
The SecPO loss combined with strong adversarial training reduces attack success rates by 1.5-14.5x versus prior methods in agentic workflows.
Paper argues edge LLM optimization can open new attack surfaces
The abstract says cutting memory, compute and energy can change representations, decision pathways and trust boundaries.
AdvGuard detects multi-turn system prompt leakage with graph classification
Authors report up to 36% higher recall than the strongest baseline, with a false-positive rate of at most 3.4%.
GuardRAG filters poisoned document clusters after RAG retrieval
The training-free method clusters expanded retrieval results and prunes suspicious groups before they reach the model.
SpanGuard splits localization from authorization for small-model IPI defense
Authors report a 0.32% attack success rate and little loss of benign utility while using substantially smaller guardrail models.
SPLASH localizes insecure statements in LLM-generated code without training
Across 63,684 programs from 12 models, it selected secure code in 74% of cases and ranked the vulnerable statement first 58% of the time.
Diagnose Before You Refine: Multi-Dimensional Judge Feedback for Query-Efficient Jailbreak Attacks
A new paper reports a query-efficient jailbreak method with 89.8% HarmBench success in 10 queries.
Poster: A Preliminary Study of LLM Distillation Inference
Distillation-inference test flags Llama-3.2-3B models distilled from Qwen2.5-7B at TPR 1.0 and p=0.02.
A Security Meta-Model for Retrieval-Augmented Generation Systems
A RAG security meta-model catalogs attacks, weaknesses, risks, and CIA impact drawn from 43 papers.
LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense
LTBD uses learnable trust delimiters to sharply reduce prompt-injection success without changing LLM weights.
RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems
RAG-PIBench offers 4,876 leakage-aware examples for detecting prompt injection in RAG systems.
Surviving the Router: Optimizing Skill Injections for Retrieval and Execution
CORSA optimizes malicious agent-skill injections so they survive router retrieval and still execute across models.
CorrectGuard: Eyes-Off Correctness Estimation for Black-Box Security Guardrails
CorrectGuard estimates black-box AI guardrail correctness without inspecting user input or guardrail internals, boosting error-detection accuracy up to 25 points.
MADBench: Benchmarking the Security of Multi-Agent Debate
MADBench shows multi-agent debate can reduce some answer attacks but amplify unauthorized reads and writes.
Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution
Patched Unsloth Studio flaw let malicious AI models run arbitrary Python code on researchers' machines via trust_remote_code during model inspection.
Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation
NEEDLE removes LLM backdoors by weight orthogonalisation with little capability or safety loss.
LENS: The Sum Is Worse Than the Parts for Set-Level Poisoning in Retrieval-Augmented Generation
LENS poisons RAG by composing document sets whose attack succeeds only when the full set is retrieved.
Distillation Defenses Easily Break After Reinforcement Learning
Distillation defenses for closed language models often fail after later reinforcement learning.
ENDOPROMPT: Victim-Side Pseudo-References for Utility Degradation
ENDOPROMPT learns prompt-injection prefixes that cut benign LLM task utility without requiring target labels.
Prefilling the Reasoning Channel: Output-Prefix Attacks on Reasoning LLMs
Output-prefix attacks plus injected reasoning jailbreak Gemini, DeepSeek, and Claude models at up to 99% success.
From Alignment to Access Control: A Framework for GenAI Policy Enforcement
A framework maps generative AI policy enforcement from model alignment to access control.
CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation
A controlled study finds layered jailbreak defenses beat any single defense across 19 attacks.
APort Vault: Benchmarking AI Agent Payment Authorization with the Open Agent Passport
APort Vault benchmark evaluates AI agent payment security across 14 models, showing Open Agent Passport blocks all unauthorized transfers.