The paper introduces HackProbe, a black‑box monitoring tool that can be attached to any self‑evolving language model loop without accessing internal weights or activations. HackProbe uses a fixed‑distribution comparison core and a rotated fresh layer to detect reward hacking through four statistical tests, and it can immunize the model by selecting honest candidates from the proposal pool. Experiments on a controlled host with injected hacking channels show that HackProbe achieves higher AUROC and lower false‑positive rates than the strongest baseline, and its bandwidth‑limited reselection improves true capability under hacking more than it harms clean runs.
By Rongxin Yang, Yang Liu, Shang Luo, Haoxuan Jia, Chongyang Zhang, Hao Zheng, Yingguang Yang, Yulin Huang, Jianshen Zhang, Yongzhi Qi, Kefu Xu, Congjing Ran, Bin Chong
arXiv:2609.36570v1 Announce Type: cross
Abstract: Indirect prompt injection makes an LLM agent treat untrusted retrieved text as instructions. We present CounterSteer, an inference-time defense that...
By Mark Russinovich
arXiv:2609.01487v1 Announce Type: cross
Abstract: Skill-augmented agents load reusable skills as persistent runtime context, improving task performance but also giving malicious skills a durable chan...
By Xiaofang Yang, Ziqi Miao, Dianbo Sui, Jing Shao, Lijun Li
arXiv:2606. 26479v1 Announce Type: cross Abstract: Recent work (2024 to 2026) has converged on a strategy for defending tool-using LLM agents against indirect prompt injection: rather than training the model to refuse malicious instructions, enforce security outside the model with a deterministic policy that mediates the agent's actions.
By Praneeth Narisetty, Shiva Nagendra Babu Kore, Uday Kumar Reddy Kattamanchi, Jayaram Kumarapu
arXiv:2609.22510v1 Announce Type: cross
Abstract: As LLM applications integrate with external tools, they are increasingly exposed to indirect prompt injection (IPI), where adversarial instructions a...
By Justin Szczepaniak, Elad Feldman, Naum Viner, Ben Nassi
arXiv:2609.06934v1 Announce Type: cross
Abstract: Post-hoc safety training (RLHF, DPO) is the dominant way to align large language models, yet jailbreaks (Zou et al., 2023b), fine-tuning attacks (Qi...
By Srikanth Malla, Chiho Choi, Joon Hee Choi
DriftNet is a dual‑head trajectory Transformer designed to detect and localize prompt injection attacks in large language model agents. It processes logged tool‑call trajectories, classifying each as compromised or not while labeling every step as benign, injection point, hijacked, or failed injection. On the AgentDrift benchmark, DriftNet achieves high accuracy, with an F1 score of 0.983, 98.7% exact injection‑point recovery, and low false‑alarm rates.
By Asif Pinjari, Mithun Paul Saint-Germain
arXiv:2608. 05045v1 Announce Type: cross Abstract: Released aligned large language models remain vulnerable to malicious downstream finetuning.
By Yuxuan Huang, Xingyu Zeng, Tianhang Zheng, Chaochao Lu
arXiv:2607. 24893v1 Announce Type: cross Abstract: Multi-agent LLM systems can be attacked by a payload that no single agent ever holds in full: a poisoned tool hides encrypted fragments in its observations, spreads them across several agents, and an external step reassembles and executes them after the run.
By Diego Fernandez Arias, Dev Prashant Mistry, Ren Wang, Yibo Hu
arXiv:2606. 29441v1 Announce Type: cross Abstract: Inference-time safety methods for large language models have proliferated, yet no systematic comparison exists.
By Subhadip Mitra
arXiv:2608.00745v2 Announce Type: replace
Abstract: Modern endpoint detection systems face a fundamental tension: signature-based approaches are trivially evaded by polymorphic or adaptive threats, w...
By Zihan Luo
The paper introduces ‘Fool’s Gold’, a defensive deception technique for open‑weight language models that hardens them against safety‑removal attacks. By training decoy responses within a differentiable simulation of the attack, the method poisons the payoff of stripped refusal mechanisms, producing confident but falsified answers to hazardous requests while preserving benign behavior. Experiments on seven models (9B‑122B) show that 51‑90% of attacked‑state responses become decoys, with the defense accounting for 27‑84% of this effect, and that the defended 122B model remains within benign‑behavior budgets.
By Mark Russinovich