mlsanityData to 14 Oct 2026

UniGuardian: A Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Models

arXiv 2502.13141 ↗First posted 18 Feb 2025cs.CL cs.AI cs.LGcited by 16

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Large Language Models (LLMs) are vulnerable to attacks like prompt injection, backdoor attacks, and adversarial attacks, which manipulate prompts or models to generate harmful outputs. In this paper, departing from traditional deep learning attack paradigms, we explore their intrinsic relationship and collectively term them Prompt Trigger Attacks (PTA). This raises a key question: Given a prompt, can we tell whether a hidden trigger is steering the model's behavior? We propose UniGuardian, to the best of our knowledge the first training-free LLM detector to jointly detect successfully activated prompt injection, backdoor, and adversarial attacks without knowing the attack type. Its shared mechanism measures how structured prompt perturbations shift the model's output distribution. Additionally, we introduce a single-forward strategy to optimize the detection pipeline, enabling simultaneous attack detection and text generation within a shared batched forward pass at each decoding step. Our experiments confirm that UniGuardian accurately and efficiently identifies trigger-activated prompts in LLMs.

Key facts. Cited by 16 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 51 of its 76 references that are in the map. First posted on arXiv 18 Feb 2025.

Builds on

51 of 76 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024BadEdit: Backdooring large language models by model editing20 Mar
  2. 2024Instruction Backdoor Attacks Against Customized LLMs14 Feb
  3. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models20 Jan
  4. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning11 Jan
  5. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection31 Jul
  6. 2023Backdoor Attacks for In-Context Learning with Language Models27 Jul
  7. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct

Other references · 44

  1. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,485
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  6. 2016On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minimacited by 1,352
  7. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  8. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  9. 2017Visualizing the Loss Landscape of Neural Netscited by 1,130
  10. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  11. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  12. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
32 more
  1. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  2. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  3. 2023Detecting Language Model Attacks with Perplexitycited by 431
  4. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 375
  5. 2019Hidden Trigger Backdoor Attackscited by 371
  6. 2017Adversarial Attacks on Neural Network Policiescited by 320
  7. 2023Certifying LLM Safety against Adversarial Promptingcited by 266
  8. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  9. 2023Prompting Large Language Model for Machine Translation: A Case Studycited by 250
  10. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 234
  11. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 194
  12. 2023Large Language Models for Code: Security Hardening and Adversarial Testingcited by 155
  13. 2024Optimization-based Prompt Injection Attack to LLM-as-a-Judgecited by 143
  14. 2024Attacks, Defenses and Evaluations for LLM Conversation Safety: A Surveycited by 130
  15. 2024Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessmentcited by 126
  16. 2022Pretrained Language Models for Text Generation: A Surveycited by 122
  17. 2023An LLM can Fool Itself: A Prompt-Based Adversarial Attackcited by 116
  18. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agentscited by 115
  19. 2024Efficient Adversarial Training in LLMs with Continuous Attackscited by 113
  20. 2023Jatmo: Prompt Injection Defense by Task-Specific Finetuningcited by 106
  21. 2024A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systemscited by 77
  22. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothingcited by 74
  23. 2018Smooth Loss Functions for Deep Top-k Classificationcited by 46
  24. 2024The Ethics of Interaction: Mitigating Security Threats in LLMscited by 33
  25. 2023Are Large Language Models Really Robust to Word-Level Perturbations?cited by 32
  26. 2023Mitigating Over-smoothing in Transformers via Regularized Nonlocal Functionalscited by 32
  27. 2020Smoothness and Stability in GANscited by 27
  28. 2023Revisit Input Perturbation Problems for LLMs: A Unified Robustness Evaluation Framework for Noisy Slot Filling Taskcited by 23
  29. 2024Efficiently Exploring Large Language Models for Document-Level Machine Translation with In-context Learningcited by 23
  30. 2024Token-wise Influential Training Data Retrieval for Large Language Modelscited by 20
  31. 2024Lightweight Safety Classification Using Pruned Language Modelscited by 5
  32. 2024DMin: Scalable Training Data Influence Estimation for Diffusion Modelscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 8; 2026: 8.

16 papers.

Sort:

By area:

  1. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
  2. 2025Defending Against Prompt Injection with DataFiltercited by 35
  3. 2025Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMscited by 34
  4. 2025Defending Against Prompt Injection With a Few DefensiveTokenscited by 33
  5. 2025Oyster-I: Beyond Refusal -- Constructive Safety Alignment for Responsible Language Modelscited by 19
  6. 2025JailDAM: Jailbreak Detection with Adaptive Memory for Vision-Language Modelcited by 10
  7. 2025VTBench: Evaluating Visual Tokenizers for Autoregressive Image Generationcited by 6
  8. 2026Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injectioncited by 3
  9. 2025Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMscited by 2
  10. 2026Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromisecited by 2
  11. 2026Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Modelscited by 2
  12. 2026COPA: Continual Preference Optimization for Adaptive Prompt Injection Defensecited by 2
4 more
  1. 2026Recursive language models for jailbreak detection: a procedural defense for tool-augmented agentscited by 0
  2. 2026Covert Visual Prompt Injection against Commercial Multimodal Large Language Modelscited by 0
  3. 2026On the Geometric Limits of Transformer Defenses against Obfuscation Attacks: Latent Embedding Collapse & Performance Robustness Gapcited by 0
  4. 2026Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Automated jailbreak attack targeting multiple defense strategies
  2. 2026Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
  3. 2024Automatic and Universal Prompt Injection Attacks against Large Language Models
  4. 2024UniGuard: Towards Universal Safety Guardrails for Jailbreak Attacks on Multimodal Large Language Models
  5. 2024Universal and Context-Independent Triggers for Precise Control of LLM Outputs
  6. 2022Exploring the Universal Vulnerability of Prompt-based Learning Paradigm
  7. 2023Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition
  8. 2023PoisonPrompt: Backdoor Attack on Prompt-based Large Language Models