arXiv AI
Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv AI
Aug 5
Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure
arXiv:2608. 02657v1 Announce Type: cross Abstract: Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.
arXiv AI
1d ago
Will the User Ever Know? Covert Indirect Prompt Injection on Tool-Using LLM Agents
arXiv:2608.30362v1 Announce Type: new Abstract: As LLM agents take real-world actions through tools, indirect prompt injection (IPI) has emerged as a serious threat. The standard metric, Attack Succe...
arXiv Machine Learning
Jul 30
AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents
arXiv:2607. 26998v1 Announce Type: cross Abstract: Large language model (LLM) agents automate penetration testing through an observation-action loop, selecting actions based on observations returned by tools.
arXiv AI
Jun 16
AutoDojo: Adaptive Attacks Expose Superficial Defenses and User-Underspecification Limits in LLM Agents
arXiv:2606. 15057v1 Announce Type: cross Abstract: Indirect prompt injection (IPI) is a major security threat to LLM-powered agents.
arXiv Machine Learning
Jul 21
When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift
arXiv:2602. 14161v2 Announce Type: replace Abstract: Detecting prompt injection, jailbreak attacks, and harmful requests is critical for deploying LLM-based agents safely, yet current evaluation practices in this literature overestimate generalization.
arXiv AI
Aug 19
The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges
The paper introduces LeakGauge, a method that appends a suffix to a model’s input to gauge the risk of context leakage before decoding. By mapping prefill token probabilities to an attack‑risk score, LeakGauge achieves high AUROC (0.944–0.996) across 11 large language models, including GLM‑5.2 and Kimi‑K3, and remains robust to language changes and different attack styles. The approach also demonstrates sensitivity to internal leakage directions and can be implemented with fewer than 0.5K additional parameters and minimal latency.