{"total":106,"rows":[{"id":"2402.06363","title":"StruQ: Defending Against Prompt Injection with Structured Queries","created":"2024-02-09","cited_by_count":375,"area":"safety"},{"id":"2504.19793","title":"Prompt Injection Attack to Tool Selection in LLM Agents","created":"2025-04-28","cited_by_count":158,"area":"agents"},{"id":"2504.18575","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","created":"2025-04-22","cited_by_count":157,"area":"agents"},{"id":"2403.17710","title":"Optimization-based Prompt Injection Attack to LLM-as-a-Judge","created":"2024-03-26","cited_by_count":143,"area":"alignment"},{"id":"2504.11358","title":"DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks","created":"2025-04-15","cited_by_count":143,"area":"safety"},{"id":"2510.09023","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","created":"2025-10-10","cited_by_count":129,"area":"safety"},{"id":"2503.00061","title":"Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents","created":"2025-02-27","cited_by_count":125,"area":"agents"},{"id":"2401.17256","title":"Weak-to-Strong Jailbreaking on Large Language Models","created":"2024-01-30","cited_by_count":107,"area":"safety"},{"id":"2412.16682","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","created":"2024-12-21","cited_by_count":99,"area":"agents"},{"id":"2409.19091","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","created":"2024-09-27","cited_by_count":96,"area":"safety"},{"id":"2411.00348","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","created":"2024-11-01","cited_by_count":95,"area":"safety"},{"id":"2403.06833","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","created":"2024-03-11","cited_by_count":81,"area":null},{"id":"2402.18649","title":"A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems","created":"2024-02-28","cited_by_count":77,"area":null},{"id":"2406.00799","title":"Get my drift? Catching LLM Task Drift with Activation Deltas","created":"2024-06-02","cited_by_count":72,"area":"rag"},{"id":"2405.03644","title":"When LLMs Meet Cybersecurity: A Systematic Literature Review","created":"2024-05-06","cited_by_count":71,"area":null},{"id":"2407.01599","title":"JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Models","created":"2024-06-26","cited_by_count":70,"area":"mllm"},{"id":"2410.09102","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","created":"2024-10-09","cited_by_count":67,"area":"safety"},{"id":"2502.05206","title":"Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety","created":"2025-02-02","cited_by_count":67,"area":"mllm"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2503.24370","title":"Effectively Controlling Reasoning Models through Thinking Intervention","created":"2025-03-31","cited_by_count":65,"area":"lr"},{"id":"2504.20984","title":"ACE: A Security Architecture for LLM-Integrated App Systems","created":"2025-04-29","cited_by_count":55,"area":null},{"id":"2503.12188","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","created":"2025-03-15","cited_by_count":53,"area":"agents"},{"id":"2402.16965","title":"WIPI: A New Web Threat for LLM-Driven Web Agents","created":"2024-02-26","cited_by_count":51,"area":"agents"},{"id":"2402.04247","title":"Risks of AI Scientists: Prioritizing Safeguarding Over Autonomy","created":"2024-02-06","cited_by_count":49,"area":null},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2405.01229","title":"Boosting Jailbreak Attack with Momentum","created":"2024-05-02","cited_by_count":40,"area":"safety"},{"id":"2502.12197","title":"A Closer Look at System Prompt Robustness","created":"2025-02-15","cited_by_count":32,"area":"safety"},{"id":"2510.12252","title":"PromptLocate: Localizing Prompt Injection Attacks","created":"2025-10-14","cited_by_count":28,"area":"safety"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2406.08689","title":"Security of AI Agents","created":"2024-06-12","cited_by_count":26,"area":"agents"},{"id":"2402.15152","title":"On the Duality Between Sharpness-Aware Minimization and Adversarial Training","created":"2024-02-23","cited_by_count":24,"area":null},{"id":"2503.10566","title":"ASIDE: Architectural Separation of Instructions and Data in Language Models","created":"2025-03-13","cited_by_count":24,"area":"safety"},{"id":"2511.20597","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","created":"2025-11-25","cited_by_count":24,"area":"safety"},{"id":"2404.06921","title":"GoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Applications","created":"2024-04-10","cited_by_count":23,"area":null},{"id":"2602.09222","title":"MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks","created":"2026-02-09","cited_by_count":21,"area":"agents"},{"id":"2510.14005","title":"PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Features","created":"2025-10-15","cited_by_count":20,"area":"safety"},{"id":"2410.00296","title":"VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wild","created":"2024-10-01","cited_by_count":18,"area":"mllm"},{"id":"2502.13141","title":"UniGuardian: A Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Models","created":"2025-02-18","cited_by_count":16,"area":"safety"},{"id":"2504.20472","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","created":"2025-04-29","cited_by_count":16,"area":"safety"},{"id":"2503.11517","title":"Prompt Injection Detection and Mitigation via AI Multi-Agent NLP Frameworks","created":"2025-03-14","cited_by_count":15,"area":"safety"},{"id":"2406.03805","title":"AutoJailbreak: Exploring Jailbreak Attacks and Defenses through a Dependency Lens","created":"2024-06-06","cited_by_count":14,"area":"safety"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2408.07291","title":"Evaluating LLM-based Personal Information Extraction and Countermeasures","created":"2024-08-14","cited_by_count":12,"area":"safety"},{"id":"2506.15170","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2507.05630","title":"How Not to Detect Prompt Injections with an LLM","created":"2025-07-08","cited_by_count":12,"area":"safety"},{"id":"2510.11203","title":"TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detection","created":"2025-10-13","cited_by_count":12,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2512.08417","title":"Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs","created":"2025-12-09","cited_by_count":10,"area":"agents"},{"id":"2502.15427","title":"Adversarial Prompt Evaluation: Systematic Benchmarking of Guardrails Against Prompt Input Attacks on LLMs","created":"2025-02-21","cited_by_count":9,"area":"safety"},{"id":"2509.25926","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","created":"2025-09-30","cited_by_count":9,"area":"agents"},{"id":"2511.05797","title":"When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins","created":"2025-11-08","cited_by_count":9,"area":"safety"},{"id":"2601.09625","title":"The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism","created":"2026-01-14","cited_by_count":9,"area":"safety"},{"id":"2508.20890","title":"PromptSleuth: Detecting Prompt Injection via Semantic Intent Invariance","created":"2025-08-28","cited_by_count":8,"area":"safety"},{"id":"2409.13331","title":"Applying Pre-trained Multilingual BERT in Embeddings for Improved Malicious Prompt Injection Attacks Detection","created":"2024-09-20","cited_by_count":7,"area":"safety"},{"id":"2501.07927","title":"Gandalf the Red: Adaptive Security for LLMs","created":"2025-01-14","cited_by_count":7,"area":null},{"id":"2508.03793","title":"AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption","created":"2025-08-05","cited_by_count":7,"area":"rag"},{"id":"2510.05052","title":"Proactive defense against LLM Jailbreak","created":"2025-10-06","cited_by_count":7,"area":"alignment"},{"id":"2604.17562","title":"SafeAgent: A Runtime Protection Architecture for Agentic Systems","created":"2026-04-19","cited_by_count":7,"area":"agents"},{"id":"2606.07943","title":"Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents","created":"2026-06-06","cited_by_count":7,"area":"agents"},{"id":"2507.05288","title":"A Survey on Proactive Defense Strategies Against Misinformation in Large Language Models","created":"2025-07-05","cited_by_count":6,"area":null},{"id":"2507.10610","title":"LaSM: Layer-wise Scaling Mechanism for Defending Pop-up Attack on GUI Agents","created":"2025-07-13","cited_by_count":6,"area":"mllm"},{"id":"2509.03787","title":"Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain","created":"2025-09-04","cited_by_count":6,"area":"rag"},{"id":"2404.02532","title":"Learn to Disguise: Avoid Refusal Responses in LLM's Defense via a Multi-agent Attacker-Disguiser Game","created":"2024-04-03","cited_by_count":5,"area":"safety"},{"id":"2506.06384","title":"Detection Method for Prompt Injection by Integrating Pre-trained Model and Heuristic Feature Engineering","created":"2025-06-05","cited_by_count":5,"area":"safety"},{"id":"2603.15408","title":"TrinityGuard: A Unified Framework for Safeguarding Multi-Agent Systems","created":"2026-03-16","cited_by_count":5,"area":"agents"},{"id":"2410.06287","title":"Non-Halting Queries: Exploiting Fixed Points in LLMs","created":"2024-10-08","cited_by_count":4,"area":null},{"id":"2410.23678","title":"Goal Hijacking Attack on Large Language Models via Pseudo-Conversation Injection","created":"2024-10-31","cited_by_count":4,"area":null},{"id":"2505.12368","title":"CAPTURE: Context-Aware Prompt Injection Testing and Robustness Enhancement","created":"2025-05-18","cited_by_count":4,"area":"safety"},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2503.23250","title":"Encrypted Prompt: Securing LLM Applications Against Unauthorized Actions","created":"2025-03-29","cited_by_count":3,"area":"safety"},{"id":"2509.14608","title":"Enterprise AI Must Enforce Participant-Aware Access Control","created":"2025-09-18","cited_by_count":3,"area":null},{"id":"2510.03705","title":"Backdoor-Powered Prompt Injection Attacks Nullify Defense Methods","created":"2025-10-04","cited_by_count":3,"area":"safety"},{"id":"2607.14493","title":"Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation","created":"2026-07-16","cited_by_count":3,"area":"safety"},{"id":"2402.06922","title":"Whispers in the Machine: Confidentiality in Agentic Systems","created":"2024-02-10","cited_by_count":2,"area":"agents"},{"id":"2504.21228","title":"CachePrune: Teaching LLMs What Not to Follow via KV-Cache Editing","created":"2025-04-29","cited_by_count":2,"area":"inference"},{"id":"2601.19051","title":"Proactive Hardening of LLM Defenses with HASTE","created":"2026-01-27","cited_by_count":2,"area":"safety"},{"id":"2604.23593","title":"When AI reviews science: Can we trust the referee?","created":"2026-04-26","cited_by_count":2,"area":null},{"id":"2608.19982","title":"COPA: Continual Preference Optimization for Adaptive Prompt Injection Defense","created":"2026-08-20","cited_by_count":2,"area":"alignment"},{"id":"2403.10559","title":"Generative Models and Connected and Automated Vehicles: A Survey in Exploring the Intersection of Transportation and AI","created":"2024-03-14","cited_by_count":1,"area":null},{"id":"2406.18783","title":"Psychological Profiling in Cybersecurity: A Look at LLMs and Psycholinguistic Features","created":"2024-06-26","cited_by_count":1,"area":null},{"id":"2410.18114","title":"Bridging Today and the Future of Humanity: AI Safety in 2024 and Beyond","created":"2024-10-09","cited_by_count":1,"area":null},{"id":"2505.00843","title":"OET: Optimization-based prompt injection Evaluation Toolkit","created":"2025-05-01","cited_by_count":1,"area":"safety"},{"id":"2506.19109","title":"Enhancing Security in LLM Applications: A Performance Evaluation of Early Detection Systems","created":"2025-06-23","cited_by_count":1,"area":"safety"},{"id":"2512.01326","title":"Securing Large Language Models (LLMs) from Prompt Injection Attacks","created":"2025-12-01","cited_by_count":1,"area":"safety"},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2604.16532","title":"Beyond Attack Success Rate: A Multi-Metric Evaluation of Adversarial Transferability in Medical Imaging Models","created":"2026-04-16","cited_by_count":1,"area":null},{"id":"2607.12406","title":"Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions","created":"2026-07-14","cited_by_count":1,"area":"agents"},{"id":"2607.24343","title":"Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls","created":"2026-07-27","cited_by_count":1,"area":"agents"},{"id":"2608.22248","title":"Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds","created":"2026-08-23","cited_by_count":1,"area":"safety"},{"id":"2602.08062","title":"Efficient and Adaptable Detection of Malicious LLM Prompts via Bootstrap Aggregation","created":"2026-02-08","cited_by_count":0,"area":"synth"},{"id":"2605.18133","title":"An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments","created":"2026-05-18","cited_by_count":0,"area":"safety"},{"id":"2605.19159","title":"On the Geometric Limits of Transformer Defenses against Obfuscation Attacks: Latent Embedding Collapse & Performance Robustness Gap","created":"2026-05-18","cited_by_count":0,"area":"safety"},{"id":"2606.10860","title":"Training LLMs to Enforce Multi-Level Instruction Hierarchies via Gravity-Weighted Direct Preference Optimization","created":"2026-06-09","cited_by_count":0,"area":"alignment"},{"id":"2607.02857","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","created":"2026-07-03","cited_by_count":0,"area":"agents"},{"id":"2607.19595","title":"Twin Agent: Context Residual Compression for Privilege Separated Agents","created":"2026-07-21","cited_by_count":0,"area":"agents"},{"id":"2608.27092","title":"The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2609.02265","title":"CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents","created":"2026-09-02","cited_by_count":0,"area":"agents"},{"id":"2609.17648","title":"Trust propagation and structural containment in Multi-agent LLM pipelines","created":"2026-09-15","cited_by_count":0,"area":"agents"},{"id":"2609.20188","title":"ResumeShield: Channel Separation and an Open Benchmark for Indirect Prompt Injection in AI Resume Screening","created":"2026-07-24","cited_by_count":0,"area":"safety"},{"id":"2609.21088","title":"Origin Is All You Need: Provenance-Aware Transformers for Structural Trust-Boundary Separation","created":"2026-09-17","cited_by_count":0,"area":"safety"}],"next_cursor":"100"}