VortexPIA: Indirect Prompt Injection Attack against LLMs for Efficient Extraction of User Privacy (2026.findings-eacl)
Copied to clipboard
| Challenge: | Large language models (LLMs) have been widely deployed in Conversational AIs . however, the methods proposed in the study rely on a white-box setting . |
| Approach: | They propose an indirect prompt injection attack that induces privacy extraction in LLMs . they use token-efficient data containing false memories to inject LLM data . |
| Outcome: | The proposed method outperforms baselines and achieves state-of-the-art performance. |
Similar Papers
Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs Through a Global Prompt Hacking Competition (2023.emnlp-main)
Copied to clipboard
Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, Jordan Boyd-Graber
| Challenge: | Large Language Models are increasingly being deployed in interactive contexts that involve direct user engagement. |
| Approach: | They run a global prompt hacking competition to encourage research on prompt hacks . they elicit 600K+ adversarial prompts against three state-of-the-art LLMs based on a dataset . |
| Outcome: | The results of the competition show that current LLMs can be manipulated via prompt hacking . the competition elicits 600K+ adversarial prompts against three state-of-the-art LLM models . |
Exploiting the Shadows: Unveiling Privacy Leaks through Lower-Ranked Tokens in Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Large language models face vulnerabilities related to the extraction of sensitive information. |
| Approach: | They propose a method to exploit the model's lower-ranked output tokens to extract private information from retrieved documents or training knowledge. |
| Outcome: | The proposed method is effective in both the agentic application privacy extraction setting and the direct training data extraction. |
Know Thy Enemy: Securing LLMs Against Prompt Injection via Diverse Data Synthesis and Instruction-Level Chain-of-Thought Learning (2026.findings-acl)
Copied to clipboard
Zhiyuan Chang, Mingyang Li, Yuekai Huang, Ziyou Jiang, Xiaojun Jia, Qian Xiong, Junjie Wang, Zhaoyang Li, Qing Wang
| Challenge: | Large language model (LLM)-integrated applications face security vulnerabilities from prompt injection (PI) attacks. |
| Approach: | They propose a model enhancement method that synthesizes diverse training data and employs instruction-level chain-of-thought fine-tuning to enable LLMs to effectively identify and reject malicious instructions regardless of their source or position in the context. |
| Outcome: | The proposed method outperforms baselines in three critical dimensions while maintaining utility performance without degradation. |
The Dangers of Indirect Prompt Injection Attacks on LLM-based Autonomous Web Navigation Agents: A Demonstration (2025.emnlp-demos)
Copied to clipboard
| Challenge: | Large Language Model (LLM)-integrated applications are becoming more popular to support, augment, and automate tasks. |
| Approach: | They propose to embed universal adversarial triggers in webpage HTML to hijack agents . they also use a browser-gym agent powered by Llama-3.1 to test their system . |
| Outcome: | The proposed system software is released under the MIT License . |
StealthGraph: Exposing Domain-Specific Risks in LLMs through Knowledge-Graph-Guided Harmful Prompt Generation (2026.acl-long)
Copied to clipboard
| Challenge: | Domain-specific datasets of harmful prompts are scarce and often rely on manual construction. Existing efforts to improve domain knowledge and reduce harmful prompt generation are lacking. |
| Approach: | They propose a framework that transforms domain knowledge into actionable constraints and increases the implicitness of generated harmful prompts. |
| Outcome: | The proposed framework yields high-quality datasets combining strong domain relevance with implicitness, enabling more realistic red-teaming and advancing LLM safety research. |
IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for detecting Indirect Prompt Injection (IPI) attacks rely on assumptions about the model's inherent security, which lacks structural constraints on agent behaviors. |
| Approach: | They propose a novel task execution paradigm that models the agents’ task execution process as a traversal over a planned Tool Dependency Graph (TDG). |
| Outcome: | The proposed model reduces unintended tool invocations triggered by injected instructions, enhancing robustness against IPI attacks. |
InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents (2024.findings-acl)
Copied to clipboard
| Challenge: | Recent work has embodied LLMs as agents, but external content introduces the risk of indirect prompt injection (IPI) attacks. |
| Approach: | They propose a benchmark to assess the vulnerability of tool-integrated LLM agents to IPI attacks. |
| Outcome: | The proposed benchmark assesses the vulnerability of tool-integrated LLM agents to IPI attacks. |
LLMs are Privacy Erasable (2025.findings-emnlp)
Copied to clipboard
| Challenge: | a new study examines the privacy of large language models and their capabilities . the study aims to address the balance between the convenience of LLMs and user privacy concerns . |
| Approach: | They propose a strategy that safeguards user prompt while accessing LLM cloud services . they evaluate the efficacy of their method across prominent LLM benchmarks . |
| Outcome: | The proposed method thwarts reconstruction attacks and improves model performance . it also surpasses the results reported in official model cards . |
TopicAttack: An Indirect Prompt Injection Attack via Topic Transition (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent attacks have demonstrated potential, but their abrupt instruction injection often undermines their effectiveness. |
| Approach: | They propose a method that prompts the LLM to generate a fabricated conversational transition prompt that gradually shifts the topic toward the injected instruction. |
| Outcome: | The proposed method achieves state-of-the-art performance with an attack success rate (ASR) over 90% in most cases, even when various defense methods are applied. |
Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are increasingly equipped with capabilities of real-time web search and integrated with protocols like the Model Context Protocol (MCP). |
| Approach: | They investigate the vulnerability of Large Language Models to hidden adversarial prompts . they evaluate two critical attack scenarios: malicious content relay and sensitive data leakage . |
| Outcome: | The proposed extension could introduce new security vulnerabilities. |