146 citations · 1.1k across the 129 of their papers we have counts for
72 papers · 1 filter
Practical Secrets Extraction against Black-box LLMs
Shiqian Zhao, Siwei Jiang, Xinfeng Li +5
Large language models (LLMs) increasingly power autonomous coding agents such as Codex and Claude Code, yet their training corpora may contain confidential credentials exposed in p…
SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs
Haoran Ou, Gelei Deng, Xuanye Zhang +3
As LLM-based agents perform increasingly complex tasks, Agent Skills have emerged as a flexible mechanism for extending their capabilities. An Agent Skill packages task-specific in…
ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems
Shiqian Zhao, Yangfan Zhou, Xinfeng Li +5
Recently, large language model (LLM) agents, such as Codex, Claude Code, and OpenClaw, have become capable of planning and executing long-horizon tasks through repeated tool calls.…
Efficient Fuzzy PSI under One-Sided Assumptions
Xinpeng Yang, Meng Hao, Yanxue Jia +3
Fuzzy private set intersection (PSI) enables two parties to identify approximately matching elements between their input sets, where two elements are considered a match if their di…
Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States
Jianshuo Dong, Yiming Liu, Maosen Zhang +6
Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.g., malicious side-tasks hidden in external tool results. While many efforts have sought to address this t…
The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges
Maosen Zhang, Jianshuo Dong, Boting Lu +5
LLMs increasingly rely on external contexts, such as pre-defined system prompts or retrieved documents, to improve generation quality. However, processing these contexts alongside…
Towards Scalable Fuzzy PSI via Efficient Fuzzy Matching
Meng Hao, Xinpeng Yang, Hanxiao Chen +5
In this paper, we present scalable fuzzy PSI protocols for general distance, supporting both low- and high-dimensional sets. The core technique is two effic…
Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents
Zihao Wang, Yiming Li, Yutong Wu +8
LLM-based web agents are increasingly deployed in real-world settings such as e-commerce, where they interact extensively with untrusted web content while executing actions that ca…
When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents
Yechao Zhang, Shiqian Zhao, Jiawen Zhang +5
Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. Thi…
Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies
Ruixiao Lin, Xinhao Deng, Qingming Li +12
Self-evolving LLM agent systems, which autonomously update their model parameters, memory, tools, and architectures, introduce a qualitatively new threat landscape in which adversa…
Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges
Xianglin Yang, Bryan Hooi, Gelei Deng +2
The known stylistic biases in LLM judges, such as a preference for verbosity or specific sentence structures, present an underexplored security vulnerability. In this work, we intr…
MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning
Xuanye Zhang, Yongsen Zheng, Zhuqin Xu +5
LLM-driven agents are capable of selecting external tools to complete users' tasks. However, attackers could compromise such process, steering agents toward inappropriate/wrong too…
Capacitive Touchscreens at Risk: A Practical Side-Channel Attack on Smartphones via Electromagnetic Emanations
Yukun Cheng, Changhai Ou, Shiyu Zhu +6
Capacitive touchscreens in modern smartphones introduce severe side-channel vulnerabilities. However, existing attacks often require restrictive conditions or invasive measurements…
Mitigating Many-shot Jailbreak Attacks with One Single Demonstration
Kejia Chen, Jiawen Zhang, Boheng Li +6
Many-shot jailbreaking (MSJ) causes safety-aligned language models to answer harmful queries by preceding them with many harmful question-answer demonstrations. We study why this a…
LeakDojo: Decoding the Leakage Threats of RAG Systems
Maosen Zhang, Jianshuo Dong, Boting Lu +4
Retrieval-Augmented Generation (RAG) enables large language models (LLMs) to leverage external knowledge, but also exposes valuable RAG databases to leakage attacks. As RAG systems…
State-Dependent Safety Failures in Multi-Turn Language Model Interaction
Pengcheng Li, Jie Zhang, Tianwei Zhang +5
Safety alignment in large language models is typically evaluated under isolated queries, yet real-world use is inherently multi-turn. Although multi-turn jailbreaks are empirically…
Grounding-Driven Attack: Improving Encoder-based Adversarial Transferability against Large Vision-Language Models
Xinwei Zhang, Li Bai, Tianwei Zhang +5
Large vision-language models (LVLMs) have achieved impressive performance across multimodal tasks, but their reliance on visual inputs exposes them to adversarial threats. Encoder-…
On the Adversarial Robustness of Large Vision-Language Models under Visual Token Compression
Xinwei Zhang, Hangcheng Liu, Li Bai +4
Visual token compression is widely used to accelerate large vision-language models (LVLMs) by pruning or merging visual tokens, yet its adversarial robustness remains unexplored. W…
Coward: Collision-based OOD Watermarking for Practical Proactive Federated Backdoor Detection
Wenjie Li, Siying Gu, Yiming Li +4
Backdoor detection is currently the mainstream defense against backdoor attacks in federated learning (FL), where a small number of malicious clients can upload poisoned updates to…
SwitchPatch: Physical Adversarial Attack Strategy with Switchable Adversarial Objectives
Hanrui Jiang, Yutong Wu, Shiyi Yao +5
Physical adversarial patch (PAP) attacks attach carefully crafted patches to physical objects to manipulate a deployed model. However, existing PAP attacks suffer from several limi…
FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprint
Shuo Shao, Haozhe Zhu, Yiming Li +3
Model fingerprinting has emerged as a crucial mechanism for safeguarding the intellectual property of open-source models, offering a non-intrusive approach that requires no modific…
Systematic Categorization, Construction and Evaluation of New Attacks against Multi-modal Mobile GUI Agents
Yulong Yang, Xinshan Yang, Shuaidong Li +4
The integration of Large Language Models (LLMs) and Multi-modal Large Language Models (MLLMs) into mobile GUI agents has significantly enhanced user efficiency and experience. Howe…
ShadowCode: Towards (Automatic) External Prompt Injection Attack against Code LLMs
Yuchen Yang, Yiming Li, Hongwei Yao +5
Recent advancements have led to the widespread adoption of code-oriented large language models (Code LLMs) for programming tasks. Despite their success in deployment, their securit…
AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA
Weitao Feng, Wenbo Zhou, Jiyan He +6
Diffusion models have achieved remarkable success in generating high-quality images. Recently, the open-source models represented by Stable Diffusion (SD) are thriving and are acce…