mlsanityData to 14 Oct 2026

Decoding Latent Attack Surfaces in LLMs: Prompt Injection via HTML in Web Summarization

arXiv 2509.05831 ↗First posted 6 Sep 2025cs.CR cs.AIcited by 0

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

Large Language Models (LLMs) are increasingly integrated into web-based systems for content summarization, yet their susceptibility to prompt injection attacks remains a pressing concern. In this study, we explore how non-visible HTML elements such as <meta>, aria-label, and alt attributes can be exploited to embed adversarial instructions without altering the visible content of a webpage. We introduce a novel dataset comprising 280 static web pages, evenly divided between clean and adversarial injected versions, crafted using diverse HTML-based strategies. These pages are processed through a browser automation pipeline to extract both raw HTML and rendered text, closely mimicking real-world LLM deployment scenarios. We evaluate two state-of-the-art open-source models, Llama 4 Scout (Meta) and Gemma 9B IT (Google), on their ability to summarize this content. Using both lexical (ROUGE-L) and semantic (SBERT cosine similarity) metrics, along with manual annotations, we assess the impact of these covert injections. Our findings reveal that over 29% of injected samples led to noticeable changes in the Llama 4 Scout summaries, while Gemma 9B IT showed a lower, yet non-trivial, success rate of 15%. These results highlight a critical and largely overlooked vulnerability in LLM driven web pipelines, where hidden adversarial content can subtly manipulate model outputs. Our work offers a reproducible framework and benchmark for evaluating HTML-based prompt injection and underscores the urgent need for robust mitigation strategies in LLM applications involving web content.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 5 of its 28 references that are in the map. First posted on arXiv 6 Sep 2025.

Builds on

5 of 28 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt6 Jun
  2. 2024Automatic and Universal Prompt Injection Attacks against Large Language Models7 Mar
  3. 2023Prompt Injection attack against LLM-integrated Applications8 Jun
  4. 2022Red Teaming Language Models with Language Models7 Feb

Other references · 1

  1. 2023Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectorscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Multilingual Hidden Prompt Injection Attacks on LLM-Based Academic Reviewing
  2. 2025Helping Large Language Models Protect Themselves: An Enhanced Filtering and Summarization System
  3. 2025Paper Summary Attack: Jailbreaking LLMs through LLM Safety Papers
  4. 2024Securing Large Language Models: Addressing Bias, Misinformation, and Prompt Attacks
  5. 2024Breaking Down the Defenses: A Comparative Survey of Attacks on Large Language Models
  6. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space
  7. 2026Shifting from Injection to Interaction: Rethinking Web Security in the Age of LLMs and Beyond
  8. 2025Misleading Large Language Models used (or misused) in Scientific Peer-Reviewing via Hidden Prompt-Injection Attacks