6 papers
Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection
Sizhe Chen, Yu-Lin Tsai, Ivan Evtimov +4
Prompt injection is widely recognized as a major security threat to AI agents that interact with untrusted external data, such as websites, documents, and emails. Prior work has sh…
Daydreaming: Stealing Hidden Agent Skills through Black-Box Task Interaction
Yu-Lin Tsai, Yu-An Lu, Ci-Yang Tsai +3
Agent skills bundle instructions, reference data, and executable helpers that let a general agent perform specialized tasks. Hosted providers can keep these files secret while sell…
GradShield: Alignment Preserving Finetuning
Zhanhao Hu, Xiao Huang, Patrick Mendoza +4
Large Language Models (LLMs) pose a significant risk of safety misalignment after finetuning, as models can be compromised by both explicitly and implicitly harmful data. Even some…
Hidden Thoughts Are Not Secret: Reasoning Trace Exposure in LLMs
Yu-An Lu, Ci-Yang Tsai, Yu-Lin Tsai +2
Reasoning traces have become a valuable form of learning signals for improving and transferring the capabilities of large language models. In particular, detailed traces can help d…
Web Agents Should Adopt the Plan-Then-Execute Paradigm
Julien Piet, Annabella Chow, Yiwei Hou +5
ReAct has become the default architecture across LLM agents, and many existing web agents follow this paradigm. We argue that it is the wrong default for web agents. Instead, web a…
MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents
Jinhao Zhu, Kevin Tseng, Gil Vernik +4
Tool calling agents are an emerging paradigm in LLM deployment, with major platforms such as ChatGPT, Claude, and Gemini adding connectors and autonomous capabilities. However, the…