The paper proposes universal, tool‑based defenses for large language model agents that use external tools, addressing four types of adversarial attacks: direct and indirect prompt injection, memory poisoning, and backdoor attacks. Two main defenses are introduced: Attacker Tool Filtering, which uses anomaly detection to remove suspicious tools, and Normal Tool Recalling, which restores the agent’s original toolset before planning. The authors also add prompt‑based defenses such as Chain‑of‑Thought prompting and self‑reflection, and demonstrate that these methods dramatically lower attack success rates—often to 0%—across multiple open‑source and proprietary LLMs while maintaining or improving task performance.
By Xiaoyan Li, Yunli Wang
arXiv:2605. 08876v2 Announce Type: replace Abstract: Large Language Models (LLMs) are increasingly deployed as autonomous agents that execute tool-augmented, multi-step tasks, where latency is a critical factor for real-world applications.
By Xinyu Li, Ronghui Mu, Lin Li, Tianjin Huang, Gaojie Jin
arXiv:2607. 20759v1 Announce Type: cross Abstract: AI coding agents powered by LLMs are increasingly integrated into real-world software development, where they generate, edit, and execute code with autonomous access to local files and tools.
By Ankur Singh, Jinqiu Yang, Tse-Hsun Chen
arXiv:2607. 20982v1 Announce Type: new Abstract: As large language model agents increasingly operate autonomously with access to tools and external environments, ensuring their safe and reliable behavior becomes critical.
By Vishal Ishwar Naik, Chenyu Xu, Donna Dong, Hussein Hassan, Abhishek Pradhan, Ofer Mendelevitch, Tallat Shafat, Humayun Irshad
The paper introduces JIL, an attack that manipulates length predictions used by large language model (LLM) schedulers to gain higher priority and reduce completion time. By optimizing an adversarial suffix, JIL causes lightweight output-length probes to underestimate request lengths, leading to up to an 83.4 % reduction in predicted length and an average 1.53× faster completion in end‑to‑end serving experiments. The study also evaluates defenses, showing that grouping predictions into coarse intervals can mitigate JIL’s advantage and protect benign requests.
By Yuyang Dai, Rana Shahout, Mahmood Sharif
The paper investigates whether hidden representations in latent-based multi‑agent systems can carry attack information that remains effective during normal operation. A latent attack framework is introduced, reactivating attack effects through latent interventions without using adversarial text. Experiments show that these latent attacks can significantly degrade task performance, especially when targeting inter‑agent KV‑cache handoffs, and that the degradation cannot be explained by simple perturbations or invalid generation.
By Chenxi Wang, Ruiyang Huang, Jiayan Sun, Lei Wei, Yifan Wu