mlsanityData to 14 Oct 2026

Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models

arXiv 2505.16957 ↗First posted 22 May 2025cs.CR cs.AIcited by 11

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

Large Language Models (LLMs) are increasingly equipped with capabilities of real-time web search and integrated with protocols like Model Context Protocol (MCP). This extension could introduce new security vulnerabilities. We present a systematic investigation of LLM vulnerabilities to hidden adversarial prompts through malicious font injection in external resources like webpages, where attackers manipulate code-to-glyph mapping to inject deceptive content which are invisible to users. We evaluate two critical attack scenarios: (1) "malicious content relay" and (2) "sensitive data leakage" through MCP-enabled tools. Our experiments reveal that indirect prompts with injected malicious font can bypass LLM safety mechanisms through external resources, achieving varying success rates based on data sensitivity and prompt design. Our research underscores the urgent need for enhanced security measures in LLM deployments when processing external content.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 12 of its 37 references that are in the map. First posted on arXiv 22 May 2025.

Builds on

12 of 37 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents21 Dec
  2. 2024FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks28 Oct
  3. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  4. 2024StruQ: Defending Against Prompt Injection with Structured Queries9 Feb

Other references · 8

  1. 2023Large Language Models for Information Retrieval: A Surveycited by 331
  2. 2024LayoutLLM: Layout Instruction Tuning with Large Language Models for Document Understandingcited by 95
  3. 2023"It's a Fair Game", or Is It? Examining How Users Navigate Disclosure Risks and Benefits When Using LLM-Based Conversational Agentscited by 60
  4. 2024WIPI: A New Web Threat for LLM-Driven Web Agentscited by 51
  5. 2025Open Deep Search: Democratizing Search with Open-source Reasoning Agentscited by 49
  6. 2024Voice Jailbreak Attacks Against GPT-4ocited by 42
  7. 2024Disentangling Logic: The Role of Context in Large Language Model Reasoning Capabilitiescited by 22
  8. 2025Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defensecited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 7.

11 papers.

  1. 2025A Survey of Context Engineering for Large Language Modelscited by 126
  2. 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attackscited by 90
  3. 2025When Your Reviewer is an LLM: Biases, Divergence, and Prompt Injection Risks in Peer Reviewcited by 19
  4. 2025Prompt Injection 2.0: Hybrid AI Threatscited by 13
  5. 2025Efficient and Stealthy Jailbreak Attacks via Adversarial Prompt Distillation from LLMs to SLMscited by 3
  6. 2026The Cognitive Firewall:Securing Browser Based AI Agents Against Indirect Prompt Injection Via Hybrid Edge Cloud Defensecited by 3
  7. 2026DoPE: Decoy Oriented Perturbation Encapsulation Human-Readable, AI-Hostile Documents for Academic Integritycited by 1
  8. 2026The Emerging AI Paper-Review Arms Race: Adversarial Co-Evolution in Scholarly Publishingcited by 1
  9. 2026CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFscited by 0
  10. 2026Beyond the Editing Canvas: Evidence Divergence in OOXML-to-LLM Ingestioncited by 0
  11. 2026PsyBer-Agent: A Psychology-Driven User Agent for Recommender Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models
  2. 2026An Empirical Evaluation of Prompt Injection Vulnerabilities in Large Language Models Across Multilingual and Obfuscated Attack Scenarios
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
  4. 2023Prompt Injection attack against LLM-integrated Applications
  5. 2026Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems
  6. 2023Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition
  7. 2025Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs
  8. 2025From ASR to ASP: Evaluating Prompt Attack Vulnerabilities Against Open-Source LLMs