{"total":264,"rows":[{"id":"2403.02691","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","created":"2024-03-05","cited_by_count":538,"area":"agents"},{"id":"2404.13208","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","created":"2024-04-19","cited_by_count":493,"area":"safety"},{"id":"2402.06363","title":"StruQ: Defending Against Prompt Injection with Structured Queries","created":"2024-02-09","cited_by_count":375,"area":"safety"},{"id":"2410.02644","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","created":"2024-10-03","cited_by_count":369,"area":"agents"},{"id":"2401.10019","title":"R-Judge: Benchmarking Safety Risk Awareness for LLM Agents","created":"2024-01-18","cited_by_count":288,"area":"agents"},{"id":"2403.14720","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","created":"2024-03-20","cited_by_count":267,"area":"safety"},{"id":"2410.05451","title":"SecAlign: Defending Against Prompt Injection with Preference Optimization","created":"2024-10-07","cited_by_count":210,"area":"alignment"},{"id":"2504.18575","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","created":"2025-04-22","cited_by_count":157,"area":"agents"},{"id":"2409.11295","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","created":"2024-09-17","cited_by_count":150,"area":"agents"},{"id":"2406.13352","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","created":"2024-06-19","cited_by_count":145,"area":"agents"},{"id":"2504.11358","title":"DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks","created":"2025-04-15","cited_by_count":143,"area":"safety"},{"id":"2407.19354","title":"The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies","created":"2024-07-28","cited_by_count":131,"area":"agents"},{"id":"2404.08144","title":"LLM Agents can Autonomously Exploit One-day Vulnerabilities","created":"2024-04-11","cited_by_count":128,"area":"agents"},{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2505.23643","title":"Securing AI Agents with Information-Flow Control","created":"2025-05-29","cited_by_count":121,"area":null},{"id":"2403.04957","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","created":"2024-03-07","cited_by_count":119,"area":"safety"},{"id":"2401.02906","title":"MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance","created":"2024-01-05","cited_by_count":117,"area":"mllm"},{"id":"2402.13494","title":"GradSafe: Detecting Jailbreak Prompts for LLMs via Safety-Critical Gradient Analysis","created":"2024-02-21","cited_by_count":96,"area":"safety"},{"id":"2409.19091","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","created":"2024-09-27","cited_by_count":96,"area":"safety"},{"id":"2406.01637","title":"Teams of LLM Agents can Exploit Zero-Day Vulnerabilities","created":"2024-06-02","cited_by_count":95,"area":"agents"},{"id":"2503.15547","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","created":"2025-03-17","cited_by_count":87,"area":"agents"},{"id":"2403.06833","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","created":"2024-03-11","cited_by_count":81,"area":null},{"id":"2402.18649","title":"A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems","created":"2024-02-28","cited_by_count":77,"area":null},{"id":"2402.17840","title":"Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems","created":"2024-02-27","cited_by_count":76,"area":"rag"},{"id":"2403.08730","title":"Strengthening Multimodal Large Language Model with Bootstrapped Preference Optimization","created":"2024-03-13","cited_by_count":75,"area":"mllm"},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73,"area":"agents"},{"id":"2406.00799","title":"Get my drift? Catching LLM Task Drift with Activation Deltas","created":"2024-06-02","cited_by_count":72,"area":"rag"},{"id":"2502.05206","title":"Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety","created":"2025-02-02","cited_by_count":67,"area":"mllm"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2412.17686","title":"Large Language Model Safety: A Holistic Survey","created":"2024-12-23","cited_by_count":59,"area":"safety"},{"id":"2502.16580","title":"Can Indirect Prompt Injection Attacks Be Detected and Removed?","created":"2025-02-23","cited_by_count":52,"area":"safety"},{"id":"2402.16965","title":"WIPI: A New Web Threat for LLM-Driven Web Agents","created":"2024-02-26","cited_by_count":51,"area":"agents"},{"id":"2508.13220","title":"MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols","created":"2025-08-17","cited_by_count":51,"area":"agents"},{"id":"2505.21936","title":"RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments","created":"2025-05-28","cited_by_count":46,"area":"agents"},{"id":"2504.14348","title":"Manipulating Multimodal Agents via Cross-Modal Prompt Injection","created":"2025-04-19","cited_by_count":44,"area":"mllm"},{"id":"2411.00459","title":"Defense Against Prompt Injection Attack by Leveraging Attack Techniques","created":"2024-11-01","cited_by_count":40,"area":"safety"},{"id":"2411.14110","title":"Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications","created":"2024-11-21","cited_by_count":37,"area":"rag"},{"id":"2410.08968","title":"Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirements","created":"2024-10-11","cited_by_count":36,"area":"alignment"},{"id":"2505.18333","title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","created":"2025-05-23","cited_by_count":36,"area":"safety"},{"id":"2510.04885","title":"RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection","created":"2025-10-06","cited_by_count":36,"area":"agents"},{"id":"2510.19207","title":"Defending Against Prompt Injection with DataFilter","created":"2025-10-22","cited_by_count":35,"area":"safety"},{"id":"2505.04806","title":"Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMs","created":"2025-05-07","cited_by_count":34,"area":"safety"},{"id":"2507.07974","title":"Defending Against Prompt Injection With a Few DefensiveTokens","created":"2025-07-10","cited_by_count":33,"area":"safety"},{"id":"2502.12197","title":"A Closer Look at System Prompt Robustness","created":"2025-02-15","cited_by_count":32,"area":"safety"},{"id":"2505.06311","title":"Defending against Indirect Prompt Injection by Instruction Detection","created":"2025-05-08","cited_by_count":32,"area":"rag"},{"id":"2409.11365","title":"CoCA: Regaining Safety-awareness of Multimodal Large Language Models with Constitutional Calibration","created":"2024-09-17","cited_by_count":31,"area":"mllm"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2506.23844","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","created":"2025-06-30","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2410.22284","title":"Embedding-based classifiers can detect prompt injection attacks","created":"2024-10-29","cited_by_count":27,"area":"safety"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2605.15338","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","created":"2026-05-14","cited_by_count":27,"area":"agents"},{"id":"2406.03589","title":"Ranking Manipulation for Conversational Search Engines","created":"2024-06-05","cited_by_count":26,"area":"safety"},{"id":"2511.05269","title":"TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems","created":"2025-11-07","cited_by_count":26,"area":"agents"},{"id":"2503.10566","title":"ASIDE: Architectural Separation of Instructions and Data in Language Models","created":"2025-03-13","cited_by_count":24,"area":"safety"},{"id":"2503.16248","title":"Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents","created":"2025-03-20","cited_by_count":24,"area":"safety"},{"id":"2507.20526","title":"Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition","created":"2025-07-28","cited_by_count":24,"area":"lr"},{"id":"2404.06921","title":"GoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Applications","created":"2024-04-10","cited_by_count":23,"area":null},{"id":"2410.16950","title":"Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In","created":"2024-10-22","cited_by_count":22,"area":"agents"},{"id":"2410.21492","title":"FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks","created":"2024-10-28","cited_by_count":22,"area":"safety"},{"id":"2507.14293","title":"WebGuard: Building a Generalizable Guardrail for Web Agents","created":"2025-07-18","cited_by_count":21,"area":"agents"},{"id":"2603.21019","title":"SkillProbe: Security Auditing for Emerging Agent Skill Marketplaces via Multi-Agent Collaboration","created":"2026-03-22","cited_by_count":21,"area":"agents"},{"id":"2503.15772","title":"Detecting LLM-Generated Peer Reviews","created":"2025-03-20","cited_by_count":20,"area":"safety"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2506.02040","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","created":"2025-05-31","cited_by_count":19,"area":"agents"},{"id":"2509.09912","title":"When Your Reviewer is an LLM: Biases, Divergence, and Prompt Injection Risks in Peer Review","created":"2025-09-12","cited_by_count":19,"area":"safety"},{"id":"2605.12015","title":"SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces","created":"2026-05-12","cited_by_count":19,"area":"agents"},{"id":"2410.00296","title":"VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wild","created":"2024-10-01","cited_by_count":18,"area":"mllm"},{"id":"2509.21011","title":"Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools","created":"2025-09-25","cited_by_count":18,"area":"agents"},{"id":"2602.11865","title":"Intelligent AI Delegation","created":"2026-02-12","cited_by_count":18,"area":null},{"id":"2405.19524","title":"AI Risk Management Should Incorporate Both Safety and Security","created":"2024-05-29","cited_by_count":17,"area":null},{"id":"2501.09798","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","created":"2025-01-16","cited_by_count":17,"area":"safety"},{"id":"2507.13686","title":"TopicAttack: An Indirect Prompt Injection Attack via Topic Transition","created":"2025-07-18","cited_by_count":17,"area":"safety"},{"id":"2405.14189","title":"Efficient Universal Goal Hijacking with Semantics-guided Prompt Organization","created":"2024-05-23","cited_by_count":16,"area":"safety"},{"id":"2406.06737","title":"Raccoon: Prompt Extraction Benchmark of LLM-Integrated Applications","created":"2024-06-10","cited_by_count":16,"area":null},{"id":"2502.04951","title":"Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Search","created":"2025-02-07","cited_by_count":16,"area":null},{"id":"2504.20472","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","created":"2025-04-29","cited_by_count":16,"area":"safety"},{"id":"2602.05746","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","created":"2026-02-05","cited_by_count":16,"area":"agents"},{"id":"2603.22928","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","created":"2026-03-24","cited_by_count":16,"area":"rag"},{"id":"2509.22040","title":"\"Your AI, My Shell\": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors","created":"2025-09-26","cited_by_count":15,"area":"agents"},{"id":"2504.07467","title":"Defense against Prompt Injection Attacks via Mixture of Encodings","created":"2025-04-10","cited_by_count":14,"area":"safety"},{"id":"2505.06493","title":"System Prompt Poisoning: Persistent Attacks on Large Language Models Beyond User Injection","created":"2025-05-10","cited_by_count":14,"area":"safety"},{"id":"2505.11063","title":"Think Twice Before You Act: Enhancing Agent Behavioral Safety with Thought Correction","created":"2025-05-16","cited_by_count":14,"area":"lr"},{"id":"2604.11806","title":"Detecting Safety Violations Across Many Agent Traces","created":"2026-04-13","cited_by_count":14,"area":null},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2505.24445","title":"Learning Safety Constraints for Large Language Models","created":"2025-05-30","cited_by_count":13,"area":"safety"},{"id":"2507.13169","title":"Prompt Injection 2.0: Hybrid AI Threats","created":"2025-07-17","cited_by_count":13,"area":"safety"},{"id":"2602.20720","title":"AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs","created":"2026-02-24","cited_by_count":13,"area":"agents"},{"id":"2506.15170","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2506.17318","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2507.05630","title":"How Not to Detect Prompt Injections with an LLM","created":"2025-07-08","cited_by_count":12,"area":"safety"},{"id":"2510.08829","title":"CommandSans: Securing AI Agents with Surgical Precision Prompt Sanitization","created":"2025-10-09","cited_by_count":12,"area":"agents"},{"id":"2510.18563","title":"The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability","created":"2025-10-21","cited_by_count":12,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2507.02735","title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","created":"2025-07-03","cited_by_count":10,"area":"agents"},{"id":"2512.08417","title":"Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs","created":"2025-12-09","cited_by_count":10,"area":"agents"},{"id":"2602.11416","title":"Optimizing Agent Planning for Security and Autonomy","created":"2026-02-11","cited_by_count":10,"area":"safety"}],"next_cursor":"100"}