Defenses-for-Tool-Integrated-LLM

Universal Defences for Tool-Integrated LLM Agents Against Adversarial Attacks This repository contains the code and experiments for our project on defending tool-integrated large language model LLM agents against adversarial attacks. Overview We build upon Agent Security Bench ASB to evaluate how...

JANUS: Synthesizing Cross-Layer Defenses against Web Deserialization Attacks

Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit diverse exploit variants that evade defenses tailored to a known exploit. Existing defenses typically operate at a single enforcement point with limited visibility into the full...

Distillation Defenses Easily Break after Reinforcement Learning

Distillation attacks copy the reasoning capabilities of closed-source large language models, allowing bad actors to replicate state-of-the-art performance at low cost. Attackers systematically collect a large volume of frontier model reasoning traces and then train i.e., "distill" their own model...

Sustained Participation As a Security Resource: The Bounded Participation Channel

Can sustained, per-identity participation be engineered into a security resource? Most anti-Sybil defenses price identity creation rather than identity survival. Once admitted, an adversary may sustain many identities without paying a recurring cost. We introduce the Bounded Participation Channel...

PT-2026-89452

Name of the Vulnerable Software and Affected Versions Traefik versions 3.2.0 through 3.7.12 Description Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but fail to inspect req.Trailer. This allows an unauthenticated client to...

OpenAI Is About to Release Its First AI Model With ‘Critical’ Cyber Abilities

The company will give select partners early access to its Astra AI model—so they have time to shore up their defenses...

LongPIBench: A Long-Context Benchmark for Prompt Injection

Prompt injection attacks pose a serious security risk to large language models in real-world applications. However, existing prompt injection benchmarks primarily focus on short-context inputs, leaving the attacks and defenses in long-context settings largely unexplored. This gap leads to a...

Not the Coyote, but the Road Runner: The Reality of Autonomous AI Attacks

Autonomous AI security threats aren't novel super-weapons. They're relentless, low-tech attacks that never stop. Learn why traditional defenses fail...

Hardware Design and Security in the Era of Chiplets and LLMs

The semiconductor industry is undergoing a dual revolution: the shift toward heterogeneous 2.5D chiplet systems and the integration of Large Language Models LLMs into Electronic Design Automation EDA flows. While these paradigms offer unprecedented benefits in yield, modularity, design...

When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills

Persona skills distill personal interaction histories into portable and executable artifacts for downstream agents. While enabling flexible personalization, this process concentrates fragmented personal signals, amplifies their impact through reuse, and challenges defenses designed for individual...

Decoy Images Amplify Caption-Mediated Defenses against Encoded Jailbreaks

We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models VLMs: pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate ASR. The operative change is in the defense pipeline, not in the...

Temporal Poisoning: Clean-Label Backdoors Via Event Redistribution in SNNs

Backdoor attacks on Spiking Neural Networks SNNs have primarily assumed dirty-label poisoning, in which triggered training samples are relabeled to an attacker-selected class. We study clean-label temporal poisoning, where a fixed timestamp transformation is applied only to the target-class...

Blockchain Transaction Simulation Phishing

Cryptocurrency users have increasingly become targets of phishing and scam attacks. To mitigate these threats, leading crypto wallets e.g., MetaMask have introduced transaction simulation, which previews a transaction's balance changes before on-chain execution. While effective against traditiona...

ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors Via Adversarial Code Comments

Large language models are increasingly deployed for security-sensitive tasks such as vulnerability detection and code review. Their reliance on natural-language context embedded in source code exposes a previously underexplored attack surface: adversarial comments that can influence a detector's...

When LLM Defenses Backfire: Characterizing Safety, Performance, and Cost Trade-Offs

Jailbreak defenses are essential for protecting large language models LLMs, but they can also introduce secondary costs that weaken model utility. We present a systematic study of these defense trade-offs along three dimensions: performance impact, over-refusal on benign inputs, and inference cos...

llm-redteam-helixpay

Red-teaming an LLM support agent — HelixPay A self-contained...

Broken Gates: Re-Evaluating Web Bot Defenses in the Age of LLM Agents

LLM-based browser agents are rapidly changing the threat landscape for web security. Unlike traditional automation frameworks that execute predefined scripts, these agents can autonomously navigate websites, reason about page content, and interact with web interfaces using natural-language...

Shared Vulnerabilities in Robustness-Optimized Defenses: One Breach Exposes the Family

Adversarial robustness optimization aims to preserve correct prediction under adversarial perturbations, and has produced substantial robustness gains through methods such as adversarial training and adversarial purification. However, we identify a new security risk: these gains can create shared...

MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a...

Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerability

Large language models LLMs have transformed misinformation from a primarily content-centric problem into a broader ecosystem-level security challenge. When misused, LLMs create risks beyond false content generation, enabling attacks on the social contexts, evidence sources, retrieval corpora, and...