Prompt injection defenses create a security-fidelity tradeoff with no model or defense achieving both high security and high fidelity on the SecFid benchmark across 1,168 examples.
Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents
5 Pith papers cite this work. Polarity classification is still indexing.
5
Pith papers citing it
years
2026 5representative citing papers
GIF introduces a Jacobian-based upper bound on input-output mutual information in LLMs with formal Lean proof and strong empirical recall on injection and leakage benchmarks.
Controlled experiments show adversarial feeds can tip uncertain LLM agent decisions from 5% to 100% alignment with the feed while leaving firmly held defaults unchanged, following a dose-response pattern across multiple models and domains.
Seven cross-domain prompt-injection detectors are introduced; three are shipped and d028 raises F1 on paraphrased attacks from 0.033 to 0.378, while adaptive-attack support remains unevaluated.
Prompt injection works because models internally treat text that sounds like a trusted role as if it were tagged as that role, and this confusion can be measured before generation.
citing papers explorer
-
Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense
Prompt injection defenses create a security-fidelity tradeoff with no model or defense achieving both high security and high fidelity on the SecFid benchmark across 1,168 examples.
-
GIF: Locally Sound Geometric Information Flow Control for LLMs
GIF introduces a Jacobian-based upper bound on input-output mutual information in LLMs with formal Lean proof and strong empirical recall on injection and leakage benchmarks.
-
Adversarial Feeds Steer LLM Agent Decisions Against Their Defaults
Controlled experiments show adversarial feeds can tip uncertain LLM agent decisions from 5% to 100% alignment with the feed while leaving firmly held defaults unchanged, following a dose-response pattern across multiple models and domains.
-
Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection
Seven cross-domain prompt-injection detectors are introduced; three are shipped and d028 raises F1 on paraphrased attacks from 0.033 to 0.378, while adaptive-attack support remains unevaluated.
-
Prompt Injection as Role Confusion
Prompt injection works because models internally treat text that sounds like a trusted role as if it were tagged as that role, and this confusion can be measured before generation.