Higher Attack Success Rates

Follow this field Ask about this field

Recent momentum

emerging

0 papers in the last 28 days · 0.0% of indexed attention

Twelve weeks of publication activity for this topic as it is defined today.

Weekly history

Recent digests

What was published in this field, kept on the site without email delivery.

Period ending 2026-09-21

7 new papers

A weekly snapshot of new work published in Higher Attack Success Rates.

Period ending 2026-09-14

17 new papers

A weekly snapshot of new work published in Higher Attack Success Rates.

Period ending 2026-09-07

19 new papers

A weekly snapshot of new work published in Higher Attack Success Rates.

Inside this field

Focused directions

Focused topic

Higher Attack Success Rates

Within Higher Attack Success Rates

67 papersExplore

Focused topic

Transformation-Based Attacks

Within Higher Attack Success Rates

53 papersExplore

Focused topic

Transferable Attack

Within Higher Attack Success Rates

45 papersExplore

Focused topic

Multiple Attack Surfaces

Within Higher Attack Success Rates

35 papersExplore

Focused topic

Attack Paper

Within Higher Attack Success Rates

25 papersExplore

Focused topic

Attacker-Chosen Wrong Answer

Within Higher Attack Success Rates

18 papersExplore

235 papers

Latest in Higher Attack Success Rates

Browse all topics →

Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment
Jun 13, 2026Lipeng He, Yihan Wang, Jiawen Zhang +1Indirect Prompt Injection Higher Attack Success Rates
AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents
Jun 13, 2026Xinhang Ma, Taoran Li, Chaowei Xiao +3Indirect Prompt Injection Transformation-Based Attacks
A Security Analysis of Long-Horizon Agentic AI Systems: Threats, Evaluation, and Framework Development
Jun 12, 2026Ahmed Mohammed Almalki, Mehedi MasudSecurity Analysis Artificial Intelligence Safety
Minim: Privacy-Aware Minimal View for Agents via Trusted Local Sanitization
Jun 11, 2026Hexuan Yu, Chaoyu Zhang, Heng Jin +4Data Leakage Prompt-Level Mitigations
The Vision Encoder as a Privacy Boundary: Visual-Token Side Channels in Encoder-Free Vision-Language Models
Jun 10, 2026Chenyu Zhou, Qiliang Jiang, Shuning Wu +1Vision Encoders Visual Tokens
nCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection
Jun 7, 2026Abu Fuad Ahmad, Istiaque AhmedIntrusion Detection Feature Selection
SoK: Reconstruction Attacks on Synthetic Tabular Data (Insights from Winning the NIST CRC)
Jun 6, 2026Steven Golob, Sikha Pentyala, Martine De CockSynthetic Tabular Data Privacy-Preserving Framework
Beyond Homophily: Towards Generalized Graph Reconstruction Attack and Defense
Jun 6, 2026Zhanke Zhou, Bo Han, Xuan Li +3Graph Neural Networks Text-Attributed Graph
AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling
Jun 4, 2026Gabriela Dobrita, Simona-Vasilica Oprea, Adela BaraSmart Contracts Vulnerability Detection & Repair
Steering Vectors are an Adversarial Attack Surface
Jun 4, 2026Abzal Aidakhmetov, Donato Crisostomi, Tommaso Mencattini +3Language Model Evasion Attacks Activation Steering
Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense
Jun 4, 2026Minseok Choi, Seungbin Yang, Dongjin Kim +5Large Language Model Safety Jailbreak Attacks
Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack
Jun 4, 2026Long P. Hoang, Hai V. Le, Shaoyang Xu +2Large Language Model Safety Safety Alignment
Attack Selection in Agentic AI Control Evaluations Meaningfully Decreases Safety
Jun 3, 2026Catherine Ge-Wang, Tyler Crosse, Benjamin Hadad +3Artificial Intelligence Safety Attack Paper
What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems
Jun 3, 2026Yuanbo Xie, Tianyun Liu, Yingjie Zhang +4Indirect Prompt Injection Agentic Systems
Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming
Jun 3, 2026Nicholas SabanRed-Teaming Higher Attack Success Rates
AI Agents Enable Adaptive Computer Worms
Jun 2, 2026Jonas Guan, Tom Blanchard, Hanna Foerster +3Attack Paper Artificial Intelligence Agents
NeuroArmor: Safe-Variant-Guided Representation Consistency for Selective Re-Anchoring in Jailbreak Defense
Jun 2, 2026Zhongyang Lin, Ziran Zhao, Feifei Zhai +1Higher Attack Success Rates Prompt-Level Mitigations
RogueMerge: Robust and Unified Attacks against LLM Model Merging
Jun 2, 2026Jinghuai Zhang, Yetian He, Kunlin Cai +3Language Model Evasion Attacks Model Merging
Statistical Analysis of using the Shapley Value for Sensor Anomaly Localization with Accurate Classifiers
May 30, 2026Xubin Fang, Rick S. BlumShapley Value Anomalous Frame Detection
SORA: Free Second-Order Attacks in Fast Adversarial Training
May 30, 2026Mazdak Teymourian, Ramtin Moslemi, Farzan Rahmani +1Adversarial Transferability Adversarial Training
GETA: Generalized Encrypted Traffic Analysis
May 29, 2026Ransika Gunasekara, Rahat Masood, Salil KanhereNetwork Traffic Reconstruction-Based Anomaly Detection
Improving IoT Intrusion Detection Through SMOTE-Based Oversampling and Extended Multi-Model Evaluation on Side-Channel Power Data
May 29, 2026Muhammad Khuram Shahzad, Haseeb Khan, Muhammad Masood Khan +1Intrusion Detection Oversampling
Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models
May 29, 2026Junyoung Park, Seongyong Ju, Sunghwan Park +1Large Language Model Jailbreaks Adversarial Jailbreaks
Depth-Dependent Indirect Prompt Injection in Tool-Calling ReAct Agents: Injection Depth, Payload Framing, and Turn-Budget Sensitivity
May 29, 2026Mohammadreza RashidiIndirect Prompt Injection Injection
Can Subgraph Explanations Be Weaponized to Steal Graph Neural Networks?
May 28, 2026Ojas Nimase, Jiate Li, Yue Zhao +1Explainability Graph Representation Learning
The Surface You Test Is Not the Surface That Breaks
May 28, 2026Shifat E Arman, Syed Nazmus Sakib, Nafiul Haque +1Indirect Prompt Injection Multiple Attack Surfaces
Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection
May 28, 2026Travis LelleBackdoor Attacks Language Model Evasion Attacks
How Reliable Are AI Attackers Against a Fixed Vulnerable Target? A 400-Run Empirical Study of LLM Penetration Testing Consistency
May 28, 2026Galip Tolga ErdemLanguage Model Evasion Attacks Penetration Testing
Recovering Diversity Without Losing Alignment: A DPO Recipe for Post-Trained LLMs
May 28, 2026Vinay Samuel, Yapei Chang, Mohit IyyerLarge Language Model Post-Training Diversity
Beyond Attack Success Rate: Temporal Logit Observability for LLM Safety Failures
May 28, 2026Junyoung Park, Sunghwan Park, Seongyong Ju +1Higher Attack Success Rates Large Language Model Safety
Out of Sight, Not Out of Mind: Unveiling Latent Attack in Latent-based Multi-Agent Systems
May 27, 2026Chenxi Wang, Ruiyang Huang, Jiayan Sun +2Transformation-Based Attacks Multi-Agent Systems
Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents
May 27, 2026Yongxiang Li, Moxin Li, Zhixin Ma +4Language Model Evasion Attacks Large Language Model Agents
Symmetry Defeats Auditing
May 27, 2026Nick Merrill, Zeke MedleyIntrospection Adapters Multiple Attack Surfaces
MRMMIA: Membership Inference Attacks on Memory in Chat Agents
May 27, 2026Kai Chen, Yan Pang, Tianhao WangMembership Inference Attacks Agent Memory
BAIT: Boundary-Guided Disclosure Escalation LLM Jailbreaking via Self-Conditioned Reasoning
May 26, 2026Xuan Luo, Yue Wang, Geng Tu +2Jailbreak Evaluations Higher Attack Success Rates
Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks
May 26, 2026Kevin Kuo, Chhavi Yadav, Virginia SmithLanguage Model Evasion Attacks Adversarial Jailbreaks
TTPrint: Evidence-Grounded TTP Extraction via Diverge-then-Converge Verification
May 25, 2026Yutong Cheng, Changze Li, Raihan Sultan Pasha Basuki +3Cyber Threat Intelligence Attack Paper
On Reliability of Efficient Membership Inference Vulnerability Evaluation
May 25, 2026Joonas Jälkö, Gauri Pradhan, Ossi Räisä +1Membership Inference Attacks False Positive Rate
Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS
May 25, 2026Bingyu Yan, Xiaoming Zhang, Jinyu Hou +4Language Model Evasion Attacks Transferable Attack
APT-Agent: Automated Penetration Testing using Large Language Models
May 24, 2026William Guanting Li, Alsharif Abuadbba, Kristen Moore +1Penetration Testing Cp-Agent
MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning
May 24, 2026Xuanye Zhang, Yongsen Zheng, Zhuqin Xu +5Agent Memory Large Language Model Agents
AI Security Research Should Better Incentivize Defense Research
May 22, 2026Youqian ZhangArtificial Intelligence Safety Artificial Intelligence Research
PoisonForge: Task-Level Targeted Poisoning Benchmark for Instruction-Tuned LLMs
May 22, 2026Luze Sun, Anshuman Suri, Harsh Chaudhari +2Language Model Evasion Attacks Poisoning
Hidden-State Privacy Has an Empty Middle
May 21, 2026Alexander Okezue BellEfficient Privacy Loss Hidden States
Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs
May 20, 2026Leitao Yuan, Qinghua Mao, Daizong Liu +5Adversarial Transferability Large Language Model Adaptation
CAMERA: Adapting to Semantic Camouflage in Unsupervised Text-Attributed Graph Fraud Detection
May 19, 2026Junjun Pan, Yixin Liu, Yu Zheng +3Fraud Detection Generalist Graph Anomaly Detection
Targeted Downstream-Agnostic Attack
May 19, 2026Zhuxin Lei, Ziyuan Yang, Yi ZhangAdversarial Examples Attention-Guided Transunet
Adaptive Probe-based Steering for Robust LLM Jailbreaking
May 19, 2026Junxi Chen, Junhao Dong, Xiaohua XieLarge Language Model Jailbreaks Activation Steering
Threats to Arabic Handwriting Recognition: Investigating Black-Box Adversarial Attacks on embedded ConvNet models
May 18, 2026Mohsine EL Khayati, Abdelillah Semma, Abdelaziz Courr +1Handwritten Text Recognition Adversarial Examples
The Capability Paradox: How Smarter Auditors Make Multi-Agent Systems Less Secure
May 17, 2026Qiqi Liu, Thorsten Holz, Shilin Ye +1Multi-Agent Systems Agentic Systems
ADR: An Agentic Detection System for Enterprise Agentic AI Security
May 17, 2026Chenning Li, Pan Hu, Justin Xu +9Artificial Intelligence Detection Agentic Systems
Universal Graph Backdoor Defense: A Feature-based Homophily Perspective
May 16, 2026Mengting Pan, Fan Li, Chen Chen +1Backdoor Attacks Graph Neural Networks
SLEIGHT-Bench: A Benchmark of Evasion Attacks Against Agent Monitors
May 15, 2026Elle Najt, Colin Toft, Tyler Tracy +2Agentic Benchmarks Evasion
3DEditSafe: Defending 3D Editing Pipelines from Unsafe Generation
May 14, 2026Nicole Meng, Zheyuan Liu, Meng Jiang +13D Editing 3D Object Understanding
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
May 14, 2026Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav +4Large Language Model Agents Multiple Attack Surfaces
ReMIA: a Powerful and Efficient Alternative to Membership Inference Attacks against Synthetic Data Generators
May 14, 2026Davide Scassola, Andrea Coser, Sebastiano SaccaniMembership Inference Attacks Synthetic Data
Hierarchical Attacks for Multi-Modal Multi-Agent Reasoning
May 13, 2026Hao Zhou, Tiru Wu, Yan Jiang +3Multi-Agent Systems Multi-Agent Reasoning
Quantifying LLM Safety Degradation Under Repeated Attacks Using Survival Analysis
May 13, 2026Zvi TopolLarge Language Model Safety Large Language Model Jailbreaks
IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection
May 12, 2026Chia-Pei, Chen, Kentaroh Toyoda +2Indirect Prompt Injection Web Agents
Behavioral Integrity Verification for AI Agent Skills
May 12, 2026Yuhao Wu, Tung-Ling Li, Hongliang LiuAgent Skill Ecosystems Malicious Code

Jun 13, 2026 · cs.CRJ/K move · Enter open · S save

Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment

Lipeng He, Yihan Wang, Jiawen Zhang, N. Asokan

Indirect prompt injection attacks hijack LLM-based agents by embedding malicious instructions in third-party data that the agent retrieves during task execution. Existing defenses report near-zero attack success rate on static benchmarks, yet recent adaptive evaluations show that these results collapse once the attacker is allowed to optimize against the deployed defense. In this work, we trace this collapse to two failure modes. First, existing defense methods are confined to recognizing specific attack patterns, rather than assessing whether the intent of every embedded instruction is relevant to the user task. Second, training-based defenses, which otherwise offer the strongest safety-utility trade-off, assemble their adversarial examples from a handful of hand-crafted templates, and the resulting defender fails to generalize outside that narrow strategy distribution. To address these gaps, we propose RETA, a training-based method that grounds defense decisions on the user tasks rather than attacker-controlled data. At each tool-output step, the defender undertakes chain-of-thought reasoning verifying that its actions are consistent with the user task. Leveraging red-teaming, a simulated attacker synthesizes adversarial training data and receives a dictionary-learning diversity reward, achieving broad coverage of injection-reformulation strategies. Together, these allow the defender to be optimized via multi-objective reinforcement learning and achieve better safety-utility trade-off. Across six black-box adaptive attacks, RETA keeps every per-attack ASR below 10%, with average ASR of 2.92% and 3.75% on the two target models, while preserving most utility under attack and on clean inputs.

Indirect Prompt Injection Higher Attack Success Rates Prompt Engineering Automatic Speech Recognition Systems

Open paper Ask about it PDF