11 papers
Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
Yudong Gao, Linghan Chen, Wenhan Wu +5
Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a…
Shortcut Before Circuit: Document Statistics Time In-Context Conflict Resolution
Yijun Liao, Fanwei Liang
When a context asserts two values for one fact, a model commits to a cue -- recency, repetition, position -- but natural data rarely makes these disagree, so behavior cannot reveal…
Uncovering and Understanding Hidden Dependencies in the LLM API Reseller Ecosystem via Prefix-Cache Side Channels
Zimo Ji, Xin Wei, Congying Xu +5
LLM API resellers have become an important access layer to modern LLM services. However, multi-level resale creates an opaque supply chain: a user's request may traverse undisclose…
PathMark: Protecting Intellectual Property of Mixture-of-Expert LLMs via Path Watermarks
Yudong Gao, Qingyue Wang, Yuanyuan Yuan +4
Mixture-of-Experts (MoE) large language models represent high-value intellectual property, yet existing watermarking schemes designed for dense models fail on MoE architectures due…
Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware
Zimo Ji, Congying Xu, Zongjie Li +4
LLM coding agents increasingly rely on third-party agent skills from public marketplaces, which execute with the agent's privileges and create a software supply-chain attack surfac…
Coding Agents Are Guessing: Measuring Action-Boundary Violations in Underspecified DevOps Instructions
Zimo Ji, Zekai Zhang, Congying Xu +4
LLM coding agents are increasingly deployed to act autonomously on real production infrastructure. They execute shell commands, modify repositories, and call operational APIs. Howe…
Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode
Zimo Ji, Zongjie Li, Pingchuan Ma +3
Claude Code's auto mode is the first deployed permission system for AI coding agents, using a two-stage transcript classifier to gate dangerous tool calls. Anthropic reports a 0.4%…
SkillReducer: Optimizing LLM Agent Skills for Token Efficiency
Yudong Gao, Zongjie Li, Yuanyuan Yuan +3
LLM-based coding agents rely on \emph{skills}, pre-packaged instruction sets that extend agent capabilities, yet every token of skill content injected into the context window incur…
Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework
Zimo Ji, Daoyuan Wu, Wenyuan Jiang +5
Large Language Model (LLM)-based agent systems are increasingly deployed for complex real-world tasks but remain vulnerable to natural language-based attacks that exploit over-priv…
RepetitionCurse: Measuring and Understanding Router Imbalance in Mixture-of-Experts LLMs under DoS Stress
Ruixuan Huang, Qingyue Wang, Hantao Huang +4
Mixture-of-Experts architectures have become the standard for scaling large language models due to their superior parameter efficiency. To accommodate the growing number of experts…
Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks
Zimo Ji, Xunguang Wang, Zongjie Li +6
Large Language Model (LLM)-based agents with function-calling capabilities are increasingly deployed, but remain vulnerable to Indirect Prompt Injection (IPI) attacks that hijack t…