Untrusted Content

Follow this topic Ask about this topic

Momentum

2 papers in the last four weeks, against 2 the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 30

All topics

Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agents
Sep 30, 2026Wenxin Wu, Lingyong Yan, Lei Sha +2Poisoning Malicious Agents
Beihang University · Baidu Inc · Wilfrid Laurier University
Semantic-TVM: Structure-Preserving Trustworthy Virtual Memory for Memory-Augmented and Tool-Using Agents
Sep 14, 2026Yu Li, Qikun Cai, Tao Huang +1Peak Memory Untrusted Content
School of Computer and Big Data, MinJiang University Fuzhou, China
When Detection Does Not Guarantee Resistance: Reasoning and Poisoned Context in RAG
Aug 17, 2026Mehrdad Ghassabi, Audrina Ebrahimi, Sadra Hakim +3Poisoning Deliberation
University of Isfahan · University of Texas at Dallas · University of Windsor
PIPES: Securing Agent Perception with Provenance and Priors
Aug 13, 2026Sanjay Kariyappa, Severin Klingler, G. Edward SuhUntrusted Content Generation Provenance
NVIDIA
Auditing Provenance Sensitivity in LLM Agent Action Selection
Jul 23, 2026Junchi LiaoUntrusted Content Model Auditing
Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents
Jul 21, 2026Aarushi SinghLarge Language Model Safety Untrusted Content
Independent Researcher India
Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing
Jul 20, 2026Jie LiUntrusted Content Security Evaluation
Texas Tech University
SlotGuard: Stop Oversharing Private Local Context in LLM Agent Transcri
Jul 19, 2026Haocheng Xia, Yongjoo ParkData Leakage Untrusted Content
Siebel School of Computing and Data Science, University of Illinois Urbana-Champaign.
From ambiguous utterances to governed reuse classes: canonicalization, quotient invariance, and conditional decidability
Jul 11, 2026Cosimo Spera, Ray GarciaReuse Tractability
Minerva CQ (Bourbaki Intelligent Systems, Inc.), Los Gatos, CA, USA
Prismata: Confining Cross-Site Prompt Injection in Web Agents
Jul 9, 2026Corban Villa, Alp Eren Ozdarendeli, Sijun Tan +1Web Agents Untrusted Content
UC Berkeley
Untrusted Content Masking for Web Agents with Security Guarantees
Jul 6, 2026Kristina Nikolić, Egor Zverev, Javier Rando +3Untrusted Content Web Agents
ISTA · Anthropic
DualView: Preventing Indirect Prompt Injection in Personal AI Agents
Jul 4, 2026Juhee Kim, Woohyuk Choi, Taehyun Kang +2Indirect Prompt Injection Untrusted Content
Seoul National University
Mnemosyne: Agentic Transaction Processing for Validating and Repairing AI-generated Workflows
Jun 30, 2026Edward Y. Chang, Longling GengAgentic Workflows Untrusted Content
Stanford University
Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense
Jun 29, 2026Mitchell Hermon, Rahul Gupta, Weitong Ruan +2Prompt-Injection Detectors Large Language Model Safety
University of Illinois Urbana-Champaign · 2Amazon
On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models
Jun 25, 2026Dewank Pant, Shruti Lohani, Avijit KumarPrompt-Injection Detectors Untrusted Content
Independent Researcher
GIF: Locally Sound Geometric Information Flow Control for LLMs
Jun 22, 2026Adam Storek, Nikolaus Holzer, Zhuo Zhang +1Information-Flow Control Data Leakage
Columbia University
Minim: Privacy-Aware Minimal View for Agents via Trusted Local Sanitization
Jun 11, 2026Hexuan Yu, Chaoyu Zhang, Heng Jin +4Privacy Data Leakage
Virginia Tech, Arlington and Blacksburg, VA, USA · Washington University in St. Louis, St. Louis, MO, USA.
From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
Jun 3, 2026Pritam Dash, Tongyu Ge, Aditi Jain +2Poisoning Attacker Large Language Model
Huawei Canada · University of Waterloo, Canada · Work done during an internship at Huawei.
Evaluating using Mock Tool Calls to Quarantine Untrusted Prompt Inputs
May 28, 2026David Gros, Adam GleaveUntrusted Content Attack-Success Rate
Attested Tool-Server Admission: A Security Extension to the Model Context Protocol
May 22, 2026Alfredo MetereModel Context Protocol Untrusted Content
Enclawed LLC
Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback
May 17, 2026Lecheng Yan, Ruizhe Li, Xicheng Han +5Untrusted Content Large Language Model Safety
Southern University of Science and Technology · University of Science and Technology of China · Zhejiang University +2
SLEIGHT-Bench: A Benchmark of Evasion Attacks Against Agent Monitors
May 15, 2026Elle Najt, Colin Toft, Tyler Tracy +2Evasion Untrusted Content
1Anthropic Fellows Program · University of Waterloo · 3Redwood Research +1
MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
May 14, 2026Ciyan Ouyang, Rui HouUntrusted Content LLM Defense Mechanisms
State Key Laboratory of Cyberspace Security Defense Institute of Information Engineering, CAS Beijing, China
The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck
May 11, 2026Linfeng Fan, Ziwei Li, Yuan Tian +3Untrusted Content Agentic Deployments
Gaoling School of Artificial Intelligence, Renmin University of China, Beijing, China · King Abdullah University of Science and Technology, Thuwal, Saudi Arabia · Dongbei University of Finance and Economics, Dalian, China +1
PragLocker: Protecting Agent Intellectual Property in Untrusted Deployments via Non-Portable Prompts
May 7, 2026Qinfeng Li, Yuntai Bao, Jianghui Hu +5Untrusted Content Prompt Engineering
Zhejiang University · Chang’an University · Innovation and Management Center, School of Software Technology (Ningbo), Zhejiang University +2
AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use
May 6, 2026Chenglin YangRuntime Safety Filtering Untrusted Content
Independent Researcher
Skills as Verifiable Artifacts: A Trust Schema and a Biconditional Correctness Criterion for Human-in-the-Loop Agent Runtimes
May 1, 2026Alfredo MetereSkills Untrusted Content
Enclawed, LLC, California, USA
Trace-Level Analysis of Information Contamination in Multi-Agent Systems
Apr 30, 2026Anna Mazhar, Huzaifa Suri, Sainyam GalhotraMulti-Agent Workflows Agentic Workflow Design
Cornell University Ithaca, NY, USA · University of Illinois Urbana-Champaign, IL, USA
SUDP: Secret-Use Delegation Protocol for Agentic Systems
Apr 27, 2026Xiaohang Yu, Hejia Geng, Xinmeng Zeng +1Delegation Untrusted Content
Imperial College London · University of Oxford · Stanford University
Interactive proofs for verifying (quantum) learning and testing
Oct 31, 2024Matthias C. Caro, Jens Eisert, Marcel Hinsche +3Quantum Learning Post-Quantum Cryptography
Department of Computer Science, University of Warwick, UK · Dahlem Center for Complex Quantum Systems, Freie Universität Berlin, Berlin, Germany · Helmholtz-Zentrum Berlin für Materialien und Energie, Berlin, Germany +4

Sep 30, 2026, cs.CRJ/K move · Enter open · S save

Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agents

Wenxin Wu, Lingyong Yan, Lei Sha, Shuaiqiang Wang+1

Beihang University · Baidu Inc · Wilfrid Laurier University

Poisoning Malicious Agents Large Language Model Agents Untrusted Content

Open paper AskPDF arXiv

LLM agents increasingly rely on reusable Skills for complex, multi-step tasks, creating a critical supply-chain attack surface where poisoned Skill content steers agent decision loops under benign requests. Existing skill poisoning attacks either colocate actuation with its contextual pretext or distribute actuation across multiple Skills, but do not explicitly separate the rationale for execution from the operation itself. In this work, we reveal that untrusted agent decisions fundamentally depend on two conceptually distinct Risk-Realization Factors (RRFs): an actuation factor (specifying what concrete operation is performed) and a pretext factor (providing the situational rationale for why the agent must perform it). Guided by this abstraction, we propose a coordination-based attack paradigm: decoupling pretext from actuation. Rather than fragmenting the malicious actuation, we preserve it as an intact operation within a downstream Steering Skill, while delegating the pretext factor to an upstream Grounding Skill that subtly alters persistent environment artifacts through routine utility operations. The intact actuation thus hides in plain sight, appearing completely legitimate and task-driven only when evaluated against the fabricated pretext. Building on this formulation, we develop an automated framework that discovers authentic execution dependencies, synthesizes coordinated pretext-actuation skill pairs, and iteratively refines poisoned skill instructions via runtime closed-loop feedback. Extensive evaluations across single-session and persistent cross-lifecycle scenarios demonstrate that decoupled skill poisoning achieves high attack success, exposing a critical blind spot in isolated Skill security audits. Our automated framework code is available at https://github.com/Wenxin-buaa/CoordPoison.git.

Momentum

Related topics

Latest papers 30