arXiv:2606. 28962v1 Announce Type: cross Abstract: Model quantization is essential for the efficient deployment of Large Language Models (LLMs), but introduces a critical vulnerability: Quantization-Conditioned Backdoor (QCB) attacks.
arXiv:2605. 15152v2 Announce Type: replace-cross Abstract: LLM quantization has become essential for memory-efficient deployment.
The paper shows that post‑training quantization can introduce backdoors in large language models that are not detected by source‑precision checks. By formalizing the validation‑deployment gap with Quantization Behavioral Equivalence Classes (QBECs), the authors demonstrate that models can pass full‑precision tests yet exhibit malicious behavior after INT8 or 4‑bit compression. Experiments on machine translation and political stance classification reveal significant corruption and ideological shifts, and cross‑quantizer analysis indicates that attack persistence depends on the quantization scheme and architecture rather than just bit‑width.
arXiv:2606. 10525v1 Announce Type: cross Abstract: Indirect prompt injection poses a critical threat to LLM agents that interact with untrusted external data, yet automated attack methods--proven effective for jailbreaking--remain underexplored in realistic agentic settings.
The paper proposes universal, tool‑based defenses for large language model agents that use external tools, addressing four types of adversarial attacks: direct and indirect prompt injection, memory poisoning, and backdoor attacks. Two main defenses are introduced: Attacker Tool Filtering, which uses anomaly detection to remove suspicious tools, and Normal Tool Recalling, which restores the agent’s original toolset before planning. The authors also add prompt‑based defenses such as Chain‑of‑Thought prompting and self‑reflection, and demonstrate that these methods dramatically lower attack success rates—often to 0%—across multiple open‑source and proprietary LLMs while maintaining or improving task performance.
The paper introduces a unified attack framework that can simultaneously target multiple large language model (LLM) transformations such as quantization, pruning, and model merging. By treating each transformation as a weight perturbation, the authors jointly train a model to perform benignly before transformation and maliciously after any one of the transformations is applied. Experiments across various attack scenarios and model families show high success rates, illustrating that a single adversarial model can exploit diverse deployment-time transformations.
The paper introduces Quarantined Expert Shutdown (QES), a new backdoor containment strategy for large language models. QES allows backdoor learning to occur during training but routes it into a designated, quarantined expert that can be disabled at deployment. The method achieves significant reductions in attack success rates while largely preserving model utility.
SentryBench is a cost‑sensitive benchmark designed to evaluate large language model agents that use tools in public‑safety contexts. It measures agents on a frontier that jointly considers attack success, over‑refusal (missing real emergencies), and over‑reaction (unwarranted actions) under adversarial tool use, using scenarios grounded in real emergency‑call transcripts and disaster messages. The study shows that naive caution leads to high harm, while a targeted trust‑gate wrapper reduces harm across models and defenses.
arXiv:2602. 06911v2 Announce Type: replace-cross Abstract: As increasingly capable open-weight large language models (LLMs) are deployed, improving their tamper resistance against unsafe modifications, whether accidental or intentional, becomes critical to minimize risks.
AgentSentry is an inference‑time defense for tool‑augmented large language model agents that mitigates indirect prompt injection (IPI) attacks. It uses temporal causal diagnostics by performing counterfactual re‑executions at tool‑return boundaries to detect mediator‑sensitive proposals, purifies implicated content, and resumes execution from a sanitized state. Evaluations on AgentDojo show zero successful attacks (ASR = 0%) and an average Utility Under Attack of 76.10%, outperforming baselines while maintaining low false‑positive rates.
arXiv:2606. 19535v1 Announce Type: cross Abstract: Large language models (LLMs) are increasingly deployed in sensitive settings such as software engineering, where their outputs directly shape downstream artifacts.
arXiv:2606. 13385v1 Announce Type: cross Abstract: Web agents driven by large language models (LLMs) are increasingly deployed in real-world environments, where they operate over untrusted web content and execute actions with direct consequences.