Instruction Injection Attacks

Follow this topic Ask about this topic

Momentum

6 papers in the last four weeks, with none the four weeks before. 0.1% of all new papers.

Jul 13Week of Sep 28

Latest papers 21

All topics

Hidden in the Comments: A Context-Injection Attack Surface in Code LLMs
Oct 4, 2026Noor Munir, Francesco Quinzan, Stephen RobertsInstruction Injection Attacks Instruction-Tuned Models
Department of Engineering Science, University of Oxford, Oxford OX1 3PJ, UK
Integrity Detection and Characterization of Malicious Injections in RAVEN II
Sep 27, 2026Xingli Zhang, Diba Afroze, Fei Hu +1Surgical Robots Instruction Injection Attacks
School of Computing and Informatics University of Louisiana at Lafayette Lafayette, USA · Department of Electrical and Computer Engineering University of Alabama Tuscaloosa, USA
Prefilling the Reasoning Channel: Output-Prefix Attacks on Reasoning LLMs
Sep 24, 2026Lukáš Brůna, Robert Bridges, Adam EkLLM Reasoning Strategies Attacker Large Language Model
Uppsala University · AI Sweden
Exact Quantile Balancing and Load-Error Injection for Mixture-of-Experts
Sep 23, 2026Pit Neitemeier, Jiaze Li, Alessio Serra +2Load Balancing Balanced Learning
Aleph Alpha
Total Cost of Agency: Exact Attribution of Memory Injection Cost in Multi-Agent LLM Workflows
Sep 20, 2026Vivek Kumar Singh, Preeti Priyam, Gautam BhowmickLarge Language Model Workflows Multi-Agent Workflows
Independent Researcher McKinney, TX, USA · Independent Researcher Chicago, IL, USA
AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agents
Sep 10, 2026Zhihao Liu, Hongyu Sun, Zhiyuan Fu +7Computer-Use Agents Instruction Injection Attacks
Hainan University, Hainan 570228, China · University of Chinese Academy of Sciences National Computer Network Intrusion Protection Center, Beijing 101408, China · School of Computing and Communications, Lancaster University, Lancaster, United Kingdom
CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training
Aug 6, 2026Amine Lbath, Manan Suri, Aurelien Delaitre +4Instruction Injection Attacks Codebases
National Institute of Standards and Technology · Université Grenoble Alpes, CNRS · University of Maryland, College Park
Breadcrumbing Search Agents
Aug 5, 2026Xuebin Li, Hanqing Zhao, Siyuan Liang +4Search Agents Instruction Injection Attacks
School of Cyber Science and Technology, University of Science and Technology of China · College of Computing and Data Science, Nanyang Technological University
MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck
Jul 30, 2026Dongyi Liu, Haixing He, Xiaobao Wu +1Instruction Injection Attacks Attacker Large Language Model
The Hong Kong University of Science and Technology (Guangzhou) · Shanghai Jiao Tong University · The Hong Kong University of Science and Technology
Construction-Driven Injection: Linguistically-Grounded Edit-Based Code-Mixing Fingerprints for Large Language Models
Jul 28, 2026Yongyi Cui, Yue Li, Tianbao Jiang +1Fingerprint Instruction Injection Attacks
East China Normal University
EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability
Jul 27, 2026Andrea Ponte, Daniel Gibert, Matous Kozak +5Malware Security Evaluation
Department of Informatics, Bioengineering, Robotics and Systems Engineering, University of Genova, Italy · Artificial Intelligence Research Institute (IIIA-CSIC), Spain · Department of Information Security at Faculty of Information Technology, CTU in Prague, Czech Republic +2
Binding Drift in Multi-Step Tool-Augmented Agents
Jul 17, 2026Rahul Suresh Babu, Shashank IndukuriAgentic Workflow Design Instruction Injection Attacks
Agent Data Injection Attacks are Realistic Threats to AI Agents
Jul 6, 2026Woohyuk Choi, Juhee Kim, Taehyun Kang +3Instruction Injection Attacks Artificial Intelligence Agents
Seoul National University · Largosoft · University of Illinois Urbana-Champaign
TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models
Jun 24, 2026William Aiken, Paula Branco, Guy-Vincent Jourdan +1Diffusion Models Diffusion Dynamics
School of Electrical Engineering and Computer Science, University of Ottawa, Ottawa, ON K1N 6N5, Canada
LoomVideo: Unifying Multimodal Inputs into Video Generation and Editing
Jun 4, 2026Jianzong Wu, Hao Lian, Jiongfan Yang +12Video Generation Long Videos
Peking University, Alibaba Group
Blind Spots in the Guard: How Domain-Camouflaged Injection Attacks Evade Detection in Multi-Agent LLM Systems
May 21, 2026Aaditya PaiInstruction Injection Attacks Camouflage
Data Science Institute Columbia University
Adversarial SQL Injection Generation with LLM-Based Architectures
May 11, 2026Ali Karakoc, H. Birkan YilmazInstruction Injection Attacks Attacker Large Language Model
Department of Computer Engineering, NETLAB, Bogazici University, Istanbul, Turkey.
When Prompts Become Payloads: A Framework for Mitigating SQL Injection Attacks in Large Language Model-Driven Applications
May 11, 2026Farzad Nourmohammadzadeh Motlagh, Mehrdad Hajizadeh, Mehryar Majd +3Instruction Injection Attacks Text-To-Sql
Hasso Plattner Institute, University of Potsdam, Germany · Chemnitz University of Technology, Chemnitz, Germany
Watch Your Step: Information Injection in Diffusion Models via Shadow Timestep Embedding
May 1, 2026An Huang, Junggab Son, Zuobin XiongTimestep Embeddings Diffusion Models
Department of Computer Science, University of Nevada Las Vegas, Las Vegas, USA.
From One-to-One to Many-to-Many: Dynamic Cross-Layer Injection for Deep Vision-Language Fusion
Jan 15, 2026Cheng Chen, Yuyu Guo, Pengpeng Zeng +4Recent Vision-Language Models Cross-Modal Attention
Tongji University, China · Ant Group, China · Shanghai Innovation Institute, China +1
When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination
Date pendingKaran Parekh, Sanjana Pendyala Ravinder, Sana Mhapsekar +1Large Language Model Evaluation Machine-Generated Text Detection
University of North Texas

Oct 4, 2026, cs.LGJ/K move · Enter open · S save

Hidden in the Comments: A Context-Injection Attack Surface in Code LLMs

Noor Munir, Francesco Quinzan, Stephen Roberts

Department of Engineering Science, University of Oxford, Oxford OX1 3PJ, UK

Instruction Injection Attacks Instruction-Tuned Models

Open paper AskPDF arXiv

Code large language model (Code LLM) assistants generate code from heterogeneous development contexts, including open files, imported modules, pasted snippets, and comments, much of which may originate from untrusted sources. We investigate whether insecure instructions embedded in such contexts can steer Code LLMs toward vulnerable code without access to model weights or training data. We evaluate ten open-weight Code LLMs spanning 3B--13B parameters, including four base and six instruction-tuned models, across ten web-application weakness classes. We compare completion tasks containing insecure instructions embedded as code comments with benign tasks without malicious instructions. Attack-condition completions contained a medium-or-higher weakness in {\bf 77.4--92.3}% of cases, compared with {\bf 1.7--5.1}% in the benign condition. Base and instruction-tuned models averaged 86.5% and 84.5% vulnerable outputs, respectively; equivalence testing and three matched model pairs indicated reductions of at most 8.1% after instruction tuning. Susceptibility showed no clear association with model scale or specialization. Among vulnerable attack outputs, 86.2--91.0% were rated high or critical, and the effect persisted without the pattern-based detector. Post-generation screening reduced but did not eliminate the risk, the strongest screen leaving roughly one-third undetected. These findings identify inference-time context injection as a substantial attack surface and motivate provenance-aware training objectives.

Momentum

Related topics

Latest papers 21