| Challenge: | Large Language Models (LLMs) are increasingly deployed via third-party system prompts downloaded from public marketplaces. |
| Approach: | They propose a framework that optimizes system prompts to trigger LLMs to output compromised responses only for specific queries. |
| Outcome: | The proposed framework achieves up to 70% F1 reduction on targeted queries with minimal degradation to general capabilities. |
Similar Papers
Are My Optimized Prompts Compromised? Exploring Vulnerabilities of LLM-based Optimizers (2026.eacl-long)
Copied to clipboard
| Challenge: | Recent studies have focused on poisoning during supervised fine-tuning, RLHF, or inference-time time optimization. |
| Approach: | They propose a simple fake reward attack that requires no access to the reward model and significantly increases vulnerability. |
| Outcome: | The proposed attack reduces the fake reward ASR from 0.23 to 0.07 without degrading utility. |
ProxyPrompt: Securing System Prompts against Prompt Extraction Attacks (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing defenses against prompt extraction are either easily bypassed or require constant updates to address new threats. |
| Approach: | They propose a new mechanism that replaces the original prompt with a proxy to prevent prompt leakage by obfuscating the extracted prompt. |
| Outcome: | The proposed defense outperforms the existing defense, which only achieves 42.80% of the prompts extracted from the original task. |
System Prompt Hijacking via Permutation Triggers in LLM Supply Chains (2025.findings-acl)
Copied to clipboard
| Challenge: | Large language models (LLMs) are rapidly transforming the landscape of artificial intelligence due to the substantial resources required for training. |
| Approach: | They propose a post-deployment attack that bypasses system prompts to compromise models . they introduce Precise Activation Guarding and Unit Deviation Sampling to protect against attack . |
| Outcome: | The proposed attack bypasses system prompts, enabling unrestricted model outputs and safety violations. |
Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs Through a Global Prompt Hacking Competition (2023.emnlp-main)
Copied to clipboard
Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, Jordan Boyd-Graber
| Challenge: | Large Language Models are increasingly being deployed in interactive contexts that involve direct user engagement. |
| Approach: | They run a global prompt hacking competition to encourage research on prompt hacks . they elicit 600K+ adversarial prompts against three state-of-the-art LLMs based on a dataset . |
| Outcome: | The results of the competition show that current LLMs can be manipulated via prompt hacking . the competition elicits 600K+ adversarial prompts against three state-of-the-art LLM models . |
Sugar-Coated Poison: Benign Generation Unlocks Jailbreaking (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods to jailbreak large language models rely on black-box manipulation of prompt templates, resulting in high costs and poor generalizability. |
| Approach: | They propose a sugar-coated poison attack paradigm that uses a "semantic reversal" strategy to induce the model into a safety response mode. |
| Outcome: | The proposed attack paradigm outperforms baselines in the study. |
PromptKeeper: Safeguarding System Prompts for LLMs (2025.findings-emnlp)
Copied to clipboard
| Challenge: | PromptKeeper is a defense mechanism designed to safeguard system prompts . adversarial and regular queries can exploit LLM vulnerabilities to expose hidden prompts. |
| Approach: | PromptKeeper is a defense mechanism designed to safeguard system prompts . it detects both explicit and subtle leakage and regenerates responses using a dummy prompt . |
| Outcome: | PromptKeeper detects and mitigates side-channel vulnerabilities when prompts are exposed . it regenerates responses using a dummy prompt, ensuring outputs remain indistinguishable from typical interactions . |
Harmful Prompt Laundering: Jailbreaking LLMs with Abductive Styles and Symbolic Encoding (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have demonstrated remarkable capabilities but their misuse for harmful purposes remains a concern. |
| Approach: | They propose a jailbreaking technique that exploits weaknesses in LLMs' architecture . they propose abductive framing and symbolic encoding to bypass safeguards . |
| Outcome: | The proposed technique achieves over 95% attack success rate on GPT-series models and 70% across all targets. |
A Wolf in Sheep’s Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily (2024.naacl-long)
Copied to clipboard
| Challenge: | Existing methods for generating 'jailbreaks' suffer from manual design or require optimization on other white-box models, which compromises either generalization or efficiency. |
| Approach: | They propose a framework that leverages LLMs to generate effective jailbreak prompts and a generalized framework that can be used to generate prompts. |
| Outcome: | The proposed framework improves the attack success rate while reducing the time cost compared to baselines. |
The Threat of PROMPTS in Large Language Models: A System and User Prompt Perspective (2025.findings-acl)
Copied to clipboard
| Challenge: | Prompts are essential for guiding model output and influencing content generation. |
| Approach: | They propose to attack models with prompt leakage and prompt jailbreak attacks . they summarize the experimental setups of these methods and explore the relationship between prompt threats and prompt injection attacks. |
| Outcome: | The proposed methods summarize the experimental setups and examine the relationship between prompt threats and prompt injection attacks. |
SequentialBreak: Large Language Models Can be Fooled by Embedding Jailbreak Prompts into Sequential Prompt Chains (2025.acl-srw)
Copied to clipboard
| Challenge: | SequentialBreak enables LLMs to bypass safety mechanisms by arranging malicious prompts in a single query. |
| Approach: | They propose a single-query jailbreak technique that arranges multiple benign prompts in sequence with a hidden malicious instruction among them to bypass safety mechanisms. |
| Outcome: | The proposed technique outperforms baselines on open-source and closed-source models. |