{"total":364,"rows":[{"id":"2402.06363","title":"StruQ: Defending Against Prompt Injection with Structured Queries","created":"2024-02-09","cited_by_count":375,"area":"safety"},{"id":"2410.02644","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","created":"2024-10-03","cited_by_count":369,"area":"agents"},{"id":"2504.19793","title":"Prompt Injection Attack to Tool Selection in LLM Agents","created":"2025-04-28","cited_by_count":158,"area":"agents"},{"id":"2504.18575","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","created":"2025-04-22","cited_by_count":157,"area":"agents"},{"id":"2406.13352","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","created":"2024-06-19","cited_by_count":145,"area":"agents"},{"id":"2504.11358","title":"DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks","created":"2025-04-15","cited_by_count":143,"area":"safety"},{"id":"2510.09023","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","created":"2025-10-10","cited_by_count":129,"area":"safety"},{"id":"2405.06823","title":"PLeak: Prompt Leaking Attacks against Large Language Model Applications","created":"2024-05-10","cited_by_count":127,"area":null},{"id":"2505.23643","title":"Securing AI Agents with Information-Flow Control","created":"2025-05-29","cited_by_count":121,"area":null},{"id":"2403.04957","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","created":"2024-03-07","cited_by_count":119,"area":"safety"},{"id":"2312.17673","title":"Jatmo: Prompt Injection Defense by Task-Specific Finetuning","created":"2023-12-29","cited_by_count":106,"area":"safety"},{"id":"2601.10338","title":"Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale","created":"2026-01-15","cited_by_count":105,"area":"agents"},{"id":"2502.02542","title":"OverThink: Slowdown Attacks on Reasoning LLMs","created":"2025-02-04","cited_by_count":96,"area":"lr"},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73,"area":"agents"},{"id":"2502.08966","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","created":"2025-02-13","cited_by_count":69,"area":"agents"},{"id":"2406.05498","title":"SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Manner","created":"2024-06-08","cited_by_count":63,"area":"safety"},{"id":"2501.17070","title":"Contextual Agent Security: A Policy for Every Purpose","created":"2025-01-28","cited_by_count":59,"area":null},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2311.16153","title":"Identifying and Mitigating Vulnerabilities in LLM-Integrated Applications","created":"2023-11-07","cited_by_count":54,"area":null},{"id":"2401.07612","title":"Signed-Prompt: A New Approach to Prevent Prompt Injection Attacks Against LLM-Integrated Applications","created":"2024-01-15","cited_by_count":54,"area":"safety"},{"id":"2602.06547","title":"\"Do Not Mention This to the User\": Detecting and Understanding Malicious Agent Skills in the Wild","created":"2026-02-06","cited_by_count":50,"area":"agents"},{"id":"2602.15654","title":"Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections","created":"2026-02-17","cited_by_count":48,"area":"agents"},{"id":"2405.20446","title":"Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation","created":"2024-05-30","cited_by_count":44,"area":"rag"},{"id":"2504.14348","title":"Manipulating Multimodal Agents via Cross-Modal Prompt Injection","created":"2025-04-19","cited_by_count":44,"area":"mllm"},{"id":"2405.19103","title":"Voice Jailbreak Attacks Against GPT-4o","created":"2024-05-29","cited_by_count":42,"area":"safety"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2411.14110","title":"Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications","created":"2024-11-21","cited_by_count":37,"area":"rag"},{"id":"2506.09443","title":"LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge","created":"2025-06-11","cited_by_count":37,"area":"safety"},{"id":"2504.03957","title":"Practical Poisoning Attacks against Retrieval-Augmented Generation","created":"2025-04-04","cited_by_count":36,"area":"rag"},{"id":"2505.18333","title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","created":"2025-05-23","cited_by_count":36,"area":"safety"},{"id":"2510.04885","title":"RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection","created":"2025-10-06","cited_by_count":36,"area":"agents"},{"id":"2510.19207","title":"Defending Against Prompt Injection with DataFilter","created":"2025-10-22","cited_by_count":35,"area":"safety"},{"id":"2505.04806","title":"Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMs","created":"2025-05-07","cited_by_count":34,"area":"safety"},{"id":"2507.07974","title":"Defending Against Prompt Injection With a Few DefensiveTokens","created":"2025-07-10","cited_by_count":33,"area":"safety"},{"id":"2505.06311","title":"Defending against Indirect Prompt Injection by Instruction Detection","created":"2025-05-08","cited_by_count":32,"area":"rag"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2505.18889","title":"Security Concerns for Large Language Models: A Survey","created":"2025-05-24","cited_by_count":29,"area":null},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2509.11035","title":"Free-MAD: Consensus-Free Multi-Agent Debate","created":"2025-09-14","cited_by_count":29,"area":"lr"},{"id":"2510.12252","title":"PromptLocate: Localizing Prompt Injection Attacks","created":"2025-10-14","cited_by_count":28,"area":"safety"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2506.01055","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","created":"2025-06-01","cited_by_count":26,"area":"agents"},{"id":"2511.05269","title":"TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems","created":"2025-11-07","cited_by_count":26,"area":"agents"},{"id":"2602.14211","title":"SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents","created":"2026-02-15","cited_by_count":25,"area":"agents"},{"id":"2410.15267","title":"When Machine Unlearning Meets Retrieval-Augmented Generation (RAG): Keep Secret or Forget Knowledge?","created":"2024-10-20","cited_by_count":24,"area":"rag"},{"id":"2510.01354","title":"WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents","created":"2025-10-01","cited_by_count":24,"area":"agents"},{"id":"2511.20597","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","created":"2025-11-25","cited_by_count":24,"area":"safety"},{"id":"2604.02623","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","created":"2026-04-03","cited_by_count":24,"area":"agents"},{"id":"2410.14827","title":"Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignment","created":"2024-10-18","cited_by_count":21,"area":"safety"},{"id":"2504.05408","title":"Frontier AI's Impact on the Cybersecurity Landscape","created":"2025-04-07","cited_by_count":21,"area":null},{"id":"2602.09222","title":"MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks","created":"2026-02-09","cited_by_count":21,"area":"agents"},{"id":"2406.07954","title":"Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition","created":"2024-06-12","cited_by_count":20,"area":null},{"id":"2501.14940","title":"CASE-Bench: Context-Aware SafEty Benchmark for Large Language Models","created":"2025-01-24","cited_by_count":20,"area":"alignment"},{"id":"2506.01333","title":"ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control","created":"2025-06-02","cited_by_count":20,"area":null},{"id":"2507.02778","title":"Self-Correction Bench: Uncovering and Addressing the Self-Correction Blind Spot in Large Language Models","created":"2025-07-03","cited_by_count":20,"area":"lr"},{"id":"2510.14005","title":"PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Features","created":"2025-10-15","cited_by_count":20,"area":"safety"},{"id":"2602.12194","title":"MalTool: Malicious Tool Attacks on LLM Agents","created":"2026-02-12","cited_by_count":20,"area":"agents"},{"id":"2510.25025","title":"Secure Retrieval-Augmented Generation against Poisoning Attacks","created":"2025-10-28","cited_by_count":19,"area":"rag"},{"id":"2505.18543","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","created":"2025-05-24","cited_by_count":18,"area":"rag"},{"id":"2509.21011","title":"Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools","created":"2025-09-25","cited_by_count":18,"area":"agents"},{"id":"2510.05244","title":"Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?","created":"2025-10-06","cited_by_count":18,"area":"safety"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2504.20472","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","created":"2025-04-29","cited_by_count":16,"area":"safety"},{"id":"2601.07072","title":"Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems","created":"2026-01-11","cited_by_count":16,"area":"safety"},{"id":"2602.05746","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","created":"2026-02-05","cited_by_count":16,"area":"agents"},{"id":"2603.13026","title":"PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses","created":"2026-03-13","cited_by_count":16,"area":"safety"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2408.03515","title":"A Study on Prompt Injection Attack Against LLM-Integrated Mobile Robotic Systems","created":"2024-08-07","cited_by_count":15,"area":"safety"},{"id":"2503.11517","title":"Prompt Injection Detection and Mitigation via AI Multi-Agent NLP Frameworks","created":"2025-03-14","cited_by_count":15,"area":"safety"},{"id":"2505.12567","title":"A Survey of Attacks on Large Language Models","created":"2025-05-18","cited_by_count":15,"area":"agents"},{"id":"2506.05739","title":"To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt","created":"2025-06-06","cited_by_count":15,"area":"agents"},{"id":"2507.07417","title":"May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks","created":"2025-07-10","cited_by_count":15,"area":"safety"},{"id":"2508.19843","title":"SoK: Large Language Model Copyright Auditing via Fingerprinting","created":"2025-08-27","cited_by_count":15,"area":null},{"id":"2505.00976","title":"Attack and defense techniques in large language models: A survey and new perspectives","created":"2025-05-02","cited_by_count":14,"area":null},{"id":"2601.12560","title":"Agentic Artificial Intelligence (AI): Architectures, Taxonomies, and Evaluation of Large Language Model Agents","created":"2026-01-18","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2506.04202","title":"TracLLM: A Generic Framework for Attributing Long Context LLMs","created":"2025-06-04","cited_by_count":13,"area":null},{"id":"2604.02837","title":"Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis","created":"2026-04-03","cited_by_count":13,"area":"agents"},{"id":"2606.15242","title":"Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems","created":"2026-06-13","cited_by_count":13,"area":"agents"},{"id":"2408.07291","title":"Evaluating LLM-based Personal Information Extraction and Countermeasures","created":"2024-08-14","cited_by_count":12,"area":"safety"},{"id":"2503.23804","title":"DrunkAgent: Stealthy Memory Corruption in LLM-Powered Recommender Agents","created":"2025-03-31","cited_by_count":12,"area":"agents"},{"id":"2505.17767","title":"Position: The Real Barrier to LLM Agent Usability is Agentic ROI","created":"2025-05-23","cited_by_count":12,"area":"agents"},{"id":"2507.05630","title":"How Not to Detect Prompt Injections with an LLM","created":"2025-07-08","cited_by_count":12,"area":"safety"},{"id":"2509.13772","title":"Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation","created":"2025-09-17","cited_by_count":12,"area":"rag"},{"id":"2404.00486","title":"Dialectical Alignment: Resolving the Tension of 3H and Security Threats of LLMs","created":"2024-03-30","cited_by_count":11,"area":"alignment"},{"id":"2509.14285","title":"A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks","created":"2025-09-16","cited_by_count":11,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2601.10440","title":"AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior","created":"2026-01-15","cited_by_count":11,"area":null},{"id":"2602.03792","title":"WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents","created":"2026-02-03","cited_by_count":11,"area":"agents"},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11,"area":"agents"},{"id":"2402.15727","title":"LLMs Can Defend Themselves Against Jailbreaking in a Practical Manner: A Vision Paper","created":"2024-02-24","cited_by_count":10,"area":"safety"},{"id":"2402.19200","title":"PRSA: Prompt Stealing Attacks against Real-World Prompt Services","created":"2024-02-29","cited_by_count":10,"area":null},{"id":"2505.12981","title":"From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents","created":"2025-05-19","cited_by_count":10,"area":"agents"},{"id":"2505.16934","title":"In-Context Watermarks for Large Language Models","created":"2025-05-22","cited_by_count":10,"area":"safety"},{"id":"2507.02735","title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","created":"2025-07-03","cited_by_count":10,"area":"agents"},{"id":"2510.13842","title":"ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking","created":"2025-10-11","cited_by_count":10,"area":"rag"},{"id":"2512.08417","title":"Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs","created":"2025-12-09","cited_by_count":10,"area":"agents"},{"id":"2609.31142","title":"JevAdvBench: A Benchmark and Black-Box Attacks for Reinforcement Learning for Calibrated Decisions Models","created":"2026-09-25","cited_by_count":10,"area":"lr"}],"next_cursor":"100"}