{"total":56,"rows":[{"id":"2302.12173","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","created":"2023-02-23","cited_by_count":1443,"area":"safety"},{"id":"2306.05499","title":"Prompt Injection attack against LLM-integrated Applications","created":"2023-06-08","cited_by_count":605,"area":"safety"},{"id":"2312.14197","title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models","created":"2023-12-21","cited_by_count":264,"area":"safety"},{"id":"2401.17263","title":"Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks","created":"2024-01-30","cited_by_count":156,"area":"safety"},{"id":"2409.19091","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","created":"2024-09-27","cited_by_count":96,"area":"safety"},{"id":"2505.02077","title":"Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents","created":"2025-05-04","cited_by_count":71,"area":"safety"},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2503.15754","title":"AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integration","created":"2025-03-20","cited_by_count":43,"area":"safety"},{"id":"2507.07974","title":"Defending Against Prompt Injection With a Few DefensiveTokens","created":"2025-07-10","cited_by_count":33,"area":"safety"},{"id":"2604.09378","title":"BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning","created":"2026-04-10","cited_by_count":27,"area":"safety"},{"id":"2412.18693","title":"Diverse and Effective Red Teaming with Auto-generated Rewards and Multi-step Reinforcement Learning","created":"2024-12-24","cited_by_count":25,"area":"safety"},{"id":"2511.20597","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","created":"2025-11-25","cited_by_count":24,"area":"safety"},{"id":"2410.21492","title":"FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks","created":"2024-10-28","cited_by_count":22,"area":"safety"},{"id":"2311.09763","title":"Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrations","created":"2023-11-16","cited_by_count":21,"area":"safety"},{"id":"2501.16466","title":"Incalmo: An Autonomous LLM-assisted System for Red Teaming Multi-Host Networks","created":"2025-01-27","cited_by_count":17,"area":"safety"},{"id":"2410.20911","title":"Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks","created":"2024-10-28","cited_by_count":15,"area":"safety"},{"id":"2411.16736","title":"ChemSafetyBench: Benchmarking LLM Safety on Chemistry Domain","created":"2024-11-23","cited_by_count":15,"area":"safety"},{"id":"2507.06908","title":"MIND: A Multi-agent Framework for Zero-shot Harmful Meme Detection","created":"2025-07-09","cited_by_count":15,"area":"safety"},{"id":"2507.07417","title":"May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks","created":"2025-07-10","cited_by_count":15,"area":"safety"},{"id":"2602.11416","title":"Optimizing Agent Planning for Security and Autonomy","created":"2026-02-11","cited_by_count":10,"area":"safety"},{"id":"2503.20279","title":"sudo rm -rf agentic_security","created":"2025-03-26","cited_by_count":8,"area":"safety"},{"id":"2601.05445","title":"Knowledge-Driven Multi-Turn Jailbreaking on Large Language Models","created":"2026-01-09","cited_by_count":7,"area":"safety"},{"id":"2601.22136","title":"StepShield: When, Not Whether to Intervene on Rogue Agents","created":"2026-01-29","cited_by_count":7,"area":"safety"},{"id":"2407.00075","title":"Logicbreaks: A Framework for Understanding Subversion of Rule-based Inference","created":"2024-06-21","cited_by_count":4,"area":"safety"},{"id":"2410.02220","title":"Data to Defense: The Role of Curation in Customizing LLMs Against Jailbreaking Attacks","created":"2024-10-03","cited_by_count":3,"area":"safety"},{"id":"2503.23250","title":"Encrypted Prompt: Securing LLM Applications Against Unauthorized Actions","created":"2025-03-29","cited_by_count":3,"area":"safety"},{"id":"2606.10813","title":"RedAct: Redacting Agent Capability Traces for Procedural Skill Protection","created":"2026-06-09","cited_by_count":3,"area":"safety"},{"id":"2412.10423","title":"Look Before You Leap: Enhancing Attention and Vigilance Regarding Harmful Content with GuidelineLLM","created":"2024-12-10","cited_by_count":2,"area":"safety"},{"id":"2510.05169","title":"From Poisoned to Aware: Fostering Backdoor Self-Awareness in LLMs","created":"2025-10-05","cited_by_count":2,"area":"safety"},{"id":"2604.15579","title":"Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agents","created":"2026-04-16","cited_by_count":2,"area":"safety"},{"id":"2505.22852","title":"Operationalizing CaMeL: Strengthening LLM Defenses for Enterprise Deployment","created":"2025-05-28","cited_by_count":1,"area":"safety"},{"id":"2602.07107","title":"ShallowJail: Steering Jailbreaks against Large Language Models","created":"2026-02-06","cited_by_count":1,"area":"safety"},{"id":"2603.25176","title":"Prompt Attack Detection with LLM-as-a-Judge and Mixture-of-Models","created":"2026-03-26","cited_by_count":1,"area":"safety"},{"id":"2605.25073","title":"Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions","created":"2026-05-24","cited_by_count":1,"area":"safety"},{"id":"2606.09890","title":"PreAct-Bench: Benchmarking Predictive Monitoring in LLMs","created":"2026-06-03","cited_by_count":1,"area":"safety"},{"id":"2606.19242","title":"Runtime Compliance Verification for AI Agents","created":"2026-06-17","cited_by_count":1,"area":"safety"},{"id":"2609.21793","title":"CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation","created":"2026-09-18","cited_by_count":1,"area":"safety"},{"id":"2610.04985","title":"Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use","created":"2026-10-04","cited_by_count":1,"area":"safety"},{"id":"2601.00867","title":"The Silicon Psyche: Anthropomorphic Vulnerabilities in Large Language Models","created":"2025-12-30","cited_by_count":0,"area":"safety"},{"id":"2605.02940","title":"PrismAgent: Illuminating Harm in Memes via a Zero-Shot Interpretable Multi-Agent Framework","created":"2026-05-01","cited_by_count":0,"area":"safety"},{"id":"2605.03095","title":"Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses","created":"2026-05-04","cited_by_count":0,"area":"safety"},{"id":"2605.18133","title":"An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments","created":"2026-05-18","cited_by_count":0,"area":"safety"},{"id":"2606.05787","title":"SentinelRAG: Synthetic Sentinel Knowledge for RAG Database Copyright Protection","created":"2026-06-04","cited_by_count":0,"area":"safety"},{"id":"2607.00361","title":"ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Models","created":"2026-07-01","cited_by_count":0,"area":"safety"},{"id":"2607.21958","title":"Efficient Online LLM Watermark Detection via Rao-Blackwellized E-Processes","created":"2026-07-24","cited_by_count":0,"area":"safety"},{"id":"2608.08795","title":"Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection","created":"2026-08-09","cited_by_count":0,"area":"safety"},{"id":"2608.22061","title":"MEMORY Wins All: Indirect Bias Injection Attacks via Social Media Feeds","created":"2026-08-22","cited_by_count":0,"area":"safety"},{"id":"2608.28646","title":"BiasMix-Finance: Post-Generation KYC Guardrails for LLM Portfolio Advice","created":"2026-08-14","cited_by_count":0,"area":"safety"},{"id":"2608.29030","title":"Learning to Follow In-Context Watermark Instructions via Self-Distillation","created":"2026-08-29","cited_by_count":0,"area":"safety"},{"id":"2608.30362","title":"Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents","created":"2026-08-31","cited_by_count":0,"area":"safety"},{"id":"2609.04495","title":"Rethinking Indirect Prompt Injection as a Test-Time Search Problem","created":"2026-09-03","cited_by_count":0,"area":"safety"},{"id":"2609.10854","title":"No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers","created":"2026-09-09","cited_by_count":0,"area":"safety"},{"id":"2609.36121","title":"Render Before Reading: Visual Rendering as a Prompt Injection Defense","created":"2026-09-28","cited_by_count":0,"area":"safety"},{"id":"2610.00348","title":"Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation","created":"2026-09-29","cited_by_count":0,"area":"safety"},{"id":"2610.05163","title":"Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection","created":"2026-10-04","cited_by_count":0,"area":"safety"},{"id":"2610.16305","title":"ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs","created":"2026-10-12","cited_by_count":0,"area":"safety"}],"next_cursor":null}