Pith. sign in

REVIEW 3 major objections 6 minor 5 cited by

Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Malicious fonts can hide adversarial prompts in webpages and PDFs that LLMs process, letting hidden instructions bypass safety filters and exfiltrate user data through MCP-enabled tools.

desk verdict Novel font-injection attack, but the engine-room assumption—that LLM pipelines read character codes while users see different glyphs—is never validated; needs a baseline and extraction-path evidence before the numbers mean what the paper says. read the letter →

arxiv 2505.16957 v1 pith:IMCIQRSZ submitted 2025-05-22 cs.CR cs.AI

Junjie Xiong , Changjia Zhu , Shuhang Lin , Chong Zhang , Yongfeng Zhang , Yao Liu , Lingyao Li This is my paper
classification cs.CRcs.AI
keywords maliciousfontinjectionpromptindirectModelContextProtocolLLMsecuritydataexfiltrationTrueTypemanipulationdocument
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that embedding a font whose character codes no longer match their displayed glyphs can hide adversarial instructions inside webpages and PDFs in a way that is invisible to human readers but fully readable by large language models. If the claim holds, attackers can get a model to relay harmful or biased content to a user, or use the Model Context Protocol (MCP) to email the user's private data to an attacker-controlled address, without the user ever seeing an instruction. The authors test both scenarios across several Claude and GPT models, measure how prompt design, placement, repetition, and document format change success, and report that indirectly worded hidden prompts reach near-100% success for low-sensitivity data while high-sensitivity data still leaks in about a third of attempts when phrased indirectly.

What carries the argument

The key mechanism is the malicious font, built by editing the TrueType code-segment table. In a TrueType font, the glyph index for a code is computed as $G = d + c$, where $d$ is the segment's idDelta; by changing $d$ for a code, and splitting a code segment when multiple codes share one idDelta, an attacker makes the displayed glyph come from one character while the code belongs to another. The hidden prompt lives in the codes, so it remains invisible to the reader but is decoded by the LLM's text-extraction step. The attack also relies on standard font-delivery paths, embedded fonts in PDFs and the CSS @font-face rule for webpages, so no unusual file type is involved.

What would settle it

Run a controlled test: make a PDF with a font that displays the character '3' as the glyph 'a', embed a hidden instruction in those codes, and ask the model to quote the exact character at a given position. If the model reads the rendered page, it will report 'a'; if it reads the character codes, it will report '3'. A parser that resolves the font's ToUnicode CMap to the displayed text, or a model that consumes rendered screenshots, would show that the hidden prompt is not exposed and the attack fails.

Watch

Extended reading notes

Core claim

The central discovery is that a font file's code-to-glyph mapping can be edited so that one character, say the digit '3', is rendered with the visual glyph of another character, say the letter 'a', while the underlying code remains the digit. LLM content-processing pipelines read the underlying codes, not the visual shapes, so a document can display one thing while conveying different instructions to the model. The paper shows this works in both HTML, through remote @font-face loading, and PDF, through font embedding, and that the resulting hidden prompts can redirect a model's output or direct it to send previously shared user data to an attacker-controlled email address via MCP.

Load-bearing premise

The attack works only if the LLM's content pipeline extracts the underlying character codes of a page or document rather than reading the rendered glyph shapes a human sees.

Editorial extensions

If this is right

  • PDF documents give higher attack success than HTML, up to 70% in the relay scenario, so static documents are a more reliable carrier than webpages with markup.
  • Hidden prompts placed near the top of a document succeed more often than those in the middle or bottom, consistent with LLMs weighting early content more heavily.
  • Repeating the hidden prompt raises success rates from about 10% at a single injection to about 50% at higher frequencies.
  • Newer models such as GPT-4.1 showed higher vulnerability than earlier Claude models in the relay tests, suggesting improved instruction-following may widen the attack surface.
  • Indirectly phrased hidden prompts, which disguise the request as a routine backup or retrieval task, can exfiltrate low-sensitivity data with up to 100% success and high-sensitivity data up to 30%, whereas direct prompts were blocked entirely for SSNs and credit card numbers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same code/glyph mismatch could also affect retrieval-augmented generation pipelines, since hidden text in an indexed PDF would be ingested as normal tokens; a defense would need to detect font-table anomalies or render pages to images before classification.
  • If LLM providers shift to visual tokenization, where the model reads a rendered screenshot rather than extracted character codes, the attack would likely fail; that suggests a concrete testable countermeasure.
  • The paper's success-rate differences between direct and indirect prompts imply safety filters are largely lexical: obfuscated intent is enough to bypass them, so models that reason about the user's likely intent in addition to surface wording would be harder to trick.
  • Malicious fonts currently evade 60 antivirus scanners, so existing endpoint defenses do not block the delivery channel; combining font-table validation with document sandboxing would close this gap.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper proposes a new indirect prompt injection attack that uses maliciously modified fonts in external resources (webpages and PDFs) so that the text shown to users is benign while the character codes processed by the LLM contain hidden adversarial prompts. The authors evaluate two scenarios: malicious content relay, where the LLM repeats hidden harmful content, and sensitive data leakage, where the LLM exfiltrates user data via an MCP-enabled email tool. Experiments across six LLMs and various document formats report success rates, and a logistic regression is used to analyze factors affecting leakage success. The paper includes appendices with font modification details and sensitivity classifications.

Significance. If the central assumption holds, this is a novel and practically relevant attack surface for indirect prompt injection, particularly for MCP-enabled agents that process untrusted documents. The threat model is clearly defined, the two scenarios are realistic, and the detailed construction of malicious fonts in Appendix A is a useful technical contribution. The study also makes a reasonable effort to test multiple models and formats, and the ethical handling of synthetic data is commendable. However, the main claim depends on an unverified assumption about how LLM pipelines extract text versus how humans see rendered glyphs; without validation of that premise, the reported success rates cannot be attributed to malicious font injection specifically. The paper's significance is therefore conditional on additional evidence.

major comments (3)
  1. [§3.2, Appendix A] The attack's core premise—that LLM ingestion pipelines receive the original character codes while users see the benign glyphs produced by the modified code-to-glyph mapping—is asserted but never validated. The paper does not report which PDF extractor, web parser, or multimodal rendering path was used in the experiments, nor does it show raw extracted text samples. If the pipeline uses a ToUnicode CMap rather than the rendering cmap, or if the model receives rendered images through OCR or a vision encoder, the hidden text may disappear and the attack would fail. To make the central claim credible, the authors should provide extractor names and versions, show actual extracted text for the injected documents, and test at least one rendering/OCR-based ingestion path. Without this, the success rates in §4.1 and §4.2 could reflect ordinary text extraction of visible content, or could fail entirely in other deployments.
  2. [§4.2.2, §4.2.3, Table 1] The logistic regression in Table 1 reports nonsignificant coefficients for Prior Email Request (p = 0.180) and Hidden Prompt Type (p = 0.755), yet the text in §4.2.2 states that the presence of prior email requests 'significantly altered the model's response' and §4.2.3 states that hidden prompt design 'plays a decisive role.' These claims are directly contradicted by the regression results. The authors need to reconcile this inconsistency: either the regression is mis-specified or underpowered, or the qualitative claims should be tempered. They should report confidence intervals and effect sizes, and clarify whether the 60 tests per column in Figure 8 support the claimed differences when analyzed jointly.
  3. [§4.1, §4.2, Figures 4–8] No control condition is reported that would distinguish malicious font injection from ordinary invisible text. A baseline using white-on-white text, zero-opacity CSS, or other established concealment methods (e.g., HTML comments) is necessary to demonstrate that the results are attributable to the font-based glyph/code separation rather than to the general phenomenon of LLMs processing text that is not visible to users. Without such a comparison, the claimed novelty and the 'malicious font' mechanism are not empirically supported.
minor comments (6)
  1. [Figure 8] Figure 8 lacks a detailed caption that explains the experimental design; the text says 'each column represents 60 independent tests,' but the figure does not show error bars, confidence intervals, or axis annotations that would let readers verify the claimed differences.
  2. [Appendix A.3] The claim that all 60 antivirus tools failed to detect the malicious font is presented without naming the tools, versions, or detection methodology, and without data. This strong claim should either be substantiated with a table of results or removed.
  3. [References] Several references are incomplete or malformed: 'et al., 2025' appears without author names, 'Anonymous for Double-Blind Review' has a placeholder arXiv ID (arXiv:2406.XXXXX), and 'Qian Wang et al. 2025' is inconsistently formatted.
  4. [Appendix B] The text refers to the 'NISI framework'; this should be 'NIST'.
  5. [§4.1] The sentence 'The improvement in success rates across multiple attempts indicates that well-designed hidden prompts can maintain their effectiveness' is ambiguous; it is unclear what 'multiple attempts' refers to in this context.
  6. [Reproducibility] No code, data, prompt templates, or model version/date details are provided. For a security evaluation whose conclusions depend on exact experimental conditions, releasing these artifacts or at least giving precise prompts and API versions is important for verification.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: attack success rates are direct black-box observations, and the only fitted model is a post-hoc logistic regression that does not feed back into the attack.

full rationale

The paper's central claim is that malicious-font-injected hidden prompts can bypass LLM safety mechanisms in external resources. The derivation chain is empirical rather than analytical: the font construction in Section 3.1 and Appendix A computes idDelta offsets so that one character code renders with another glyph, and then Section 3.2 describes experiments that measure whether LLMs act on the hidden character codes. The reported success rates (e.g., 70% for PDF corporate slogan redirection, 30% for high-sensitivity indirect prompt leakage) are direct observations from black-box API and MCP tool tests, not quantities derived from prior fitted parameters. No parameter is fitted to a subset of outcomes and then renamed as a prediction; the logistic regression in Table 1 is a post-hoc summary of already measured success rates and is not used to generate the attack or to define the dependent variable. The few self-citations (e.g., Xiong et al. 2024) appear only as background on hidden-link threats and do not supply a load-bearing premise, uniqueness theorem, or ansatz. The weakest point in the paper is empirical validity rather than circular reasoning: the attack's effectiveness depends on the untested assumption that real LLM ingestion pipelines receive the underlying character codes rather than resolved glyphs or rendered images (Sections 3.2 and Appendix A). That is a correctness and reproducibility concern about whether the experiments isolate font injection, but it is not a case where a claim reduces to its own inputs by definition or by construction. Therefore the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no fitted constants into the attack mechanism and no new postulated entities. Its central empirical claim rests on unverified assumptions about two external systems: how LLM pipelines extract text, and how MCP authorization scopes tool use.

assumptions (3)
  • domain assumption LLM document and web pipelines expose underlying character codes, not rendered glyphs, when parsing HTML and PDF content.
    Central mechanism of the attack; assumed in Section 3.2 and Appendix A, but not validated against PDF ToUnicode CMap behavior or browser rendering pipelines.
  • domain assumption Once a user authorizes an MCP tool such as Gmail, the LLM can send emails autonomously from text instructions without per-action confirmation.
    Stated in Section 3.4 threat model and needed for Scenario 2; it aligns with MCP design but is an external-system property, not demonstrated by the paper.
  • domain assumption Modifying idDelta and splitting or merging TrueType code segments yields a valid, loadable font that preserves the deceptive mapping in target PDFs and webpages.
    Appendix A gives the arithmetic but does not report validation that the modified fonts load identically in the target document parsers and rendering engines.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models." pith.science (2026). https://pith.science/paper/IMCIQRSZ

@misc{pith2026250516957,
  author       = {Pith},
  title        = {Pith review of: Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IMCIQRSZ}},
  note         = {Machine review of arXiv:2505.16957}
}
read the original abstract

Large Language Models (LLMs) are increasingly equipped with capabilities of real-time web search and integrated with protocols like Model Context Protocol (MCP). This extension could introduce new security vulnerabilities. We present a systematic investigation of LLM vulnerabilities to hidden adversarial prompts through malicious font injection in external resources like webpages, where attackers manipulate code-to-glyph mapping to inject deceptive content which are invisible to users. We evaluate two critical attack scenarios: (1) "malicious content relay" and (2) "sensitive data leakage" through MCP-enabled tools. Our experiments reveal that indirect prompts with injected malicious font can bypass LLM safety mechanisms through external resources, achieving varying success rates based on data sensitivity and prompt design. Our research underscores the urgent need for enhanced security measures in LLM deployments when processing external content.

Figures

Figures reproduced from arXiv: 2505.16957 by the authors.

Figure 1
Figure 1. Illustration of malicious font creation through code segment modification. The figure demonstrates how [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Overview of the experimental framework investigating two critical attack scenarios: [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Threat model of sensitive data Leakage [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Success rates (%) with different injection frequencies (with moving averages of window sizes 2-5). [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Success rates (%) of adversarial attacks in [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Success rates (%) of adversarial attacks across [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Success rate (%) of email transmissions with [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Representative example of “Malicious Content Relay.” [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Representative example of “Sensitive Data Leakage.” [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs

    cs.AI 2026-07 conditional novelty 6.0 of 10

    A document-aware hybrid detector that inspects PDF structure before text flattening outperforms text-only guardrails and structural-only models on a new 29,322-file controlled hidden-prompt-injection benchmark.

  2. Towards Trustworthy AI: Characterizing User-Reported Risks across LLMs "In the Wild"

    cs.CY 2025-09 conditional novelty 6.0 of 10

    Across seven AI chatbots, Reddit users report mostly reliability failures, with each chatbot showing a distinct pattern of safety, privacy, and security complaints.

  3. When Your Reviewer is an LLM: Biases, Divergence, and Prompt Injection Risks in Peer Review

    cs.CY 2025-09 conditional novelty 4.0 of 10

    GPT-5-mini gives weaker papers systematically higher scores than human reviewers, and hidden field-specific prompts in PDFs can force it to assign perfect scores or suppress weaknesses.

  4. When LLMs Copy to Think: Uncovering Copy-Guided Attacks in Reasoning LLMs

    cs.CR 2025-07 conditional novelty 4.0 of 10

    Hidden strings in code exploit a reasoning model's tendency to copy tokens into its own thinking, enabling output length and result manipulation.

  5. Prompt Injection 2.0: Hybrid AI Threats

    cs.CR 2025-07 reject novelty 2.0 of 10

    A structured taxonomy of hybrid prompt injection attacks shows how XSS, CSRF, and SQL injection vectors converge with LLM manipulation to bypass traditional controls.

Reference graph

Works this paper leans on

34 extracted references · 14 canonical work pages · cited by 5 Pith papers

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Salaheddin Alzubi, Creston Brooks, Purva Chiniya, Edoardo Contente, Chiara von Gerlach, Lucas Irwin, Yihan Jiang, Arda Kaz, Windsor Nguyen, Sewoong Oh, and 1 others. 2025. Open deep search: Democratizing search with open-source reasoning agents. arXiv preprint arXiv:2503.20201

    arXiv 2025

  4. [4]

    Anthropic. 2025. https://www.anthropic.com/news/model-context-protocol Model context protocol . Accessed: 5 April 2025

    work page 2025

  5. [5]

    Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. 2024. Struq: Defending against prompt injection with structured queries. arXiv preprint arXiv:2402.06363

    arXiv 2024

  6. [6]

    Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2025. Security and privacy challenges of large language models: A survey. ACM Computing Surveys, 57(6):1--39

    2025

  7. [7]

    Qian Wang et al. 2025. Jbshield: Defending large language models from jailbreak attacks. In Proceedings of the USENIX Security Symposium, pages 1--16

    work page 2025

  8. [8]

    Nick Evershed. 2024. https://www.theguardian.com/technology/2024/dec/24/chatgpt-search-tool-vulnerable-to-manipulation-and-deception-tests-show Chatgpt search tool vulnerable to manipulation and deception, tests show . The Guardian. Accessed: 5 April 2025

    work page 2024

Show all 34 references
  1. [9]

    Anonymous for Double-Blind Review. 2024. https://doi.org/10.48550/arXiv.2406.XXXXX Llm whisperer: An inconspicuous attack to bias llm responses . arXiv preprint arXiv:2406.XXXXX

    2024 doi

  2. [10]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. More than you’ve asked for: A comprehensive analysis of novel prompt injection threats to application-integrated large language models. arXiv preprint arXiv:2302.12173, 27

    2023 arXiv

  3. [11]

    Xinyi Hou, Yanjie Zhao, Shenao Wang, and Haoyu Wang. 2025. Model context protocol (mcp): Landscape, security threats, and future research directions. arXiv preprint arXiv:2503.23278

    2025 arXiv

  4. [12]

    Feiran Jia, Tong Wu, Xin Qin, and Anna Squicciarini. 2024. The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents. arXiv preprint arXiv:2412.16682

    2024 arXiv

  5. [13]

    Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and 1 others. 2023. Prompt injection attack against llm-integrated applications. arXiv preprint arXiv:2306.05499

    2023 arXiv

  6. [14]

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1831--1847

    2024

  7. [15]

    Juan-Miguel L \'o pez-Gil and Juanan Pereira. 2025. Turning manual web accessibility success criteria into automatic: an llm-based approach. Universal Access in the Information Society, 24(1):837--852

    2025

  8. [16]

    Chuwei Luo, Yufan Shen, Zhaoqing Zhu, Qi Zheng, Zhi Yu, and Cong Yao. 2024. Layoutllm: Layout instruction tuning with large language models for document understanding. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 15630--15640

    2024

  9. [17]

    Erika McCallister, Tim Grance, and Karen Scarfone. 2010. Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) . https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf

    2010

  10. [18]

    OpenAI. 2023. https://openai.com/index/march-20-chatgpt-outage/ March 20 chatgpt outage: Here’s what happened . Accessed: 14 May 2025

    2023

  11. [19]

    OpenAI. 2024. Openai web search api documentation. https://platform.openai.com/docs/guides/tools-web-search?api-mode=chat. Accessed: 2024-04-26

    2024

  12. [20]

    OpenAI . 2025. Tools: Web search. https://platform.openai.com/docs/guides/tools-web-search?api-mode=chat. Accessed: April 2025

    2025

  13. [21]

    Xudong Pan, Mi Zhang, Shouling Ji, and Min Yang. 2022. https://www.usenix.org/conference/usenixsecurity22/presentation/pan-hidden Hidden trigger backdoor attacks on nlp models via linguistic style manipulation . In Proceedings of the USENIX Security Symposium, pages 3611--3628

    2022

  14. [22]

    Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red teaming language models with language models. arXiv preprint arXiv:2202.03286

    2022 arXiv

  15. [23]

    Xiatong Sang, Min Gu, and Haojun Chi. 2024. Evaluating prompt injection safety in large language models using the promptbench dataset

    2024

  16. [24]

    Xinyue Shen, Yixin Wu, Michael Backes, and Yang Zhang. 2024. https://doi.org/10.48550/arXiv.2405.19103 Voice jailbreak attacks against gpt-4o . arXiv preprint arXiv:2405.19103

    2024 doi arXiv

  17. [25]

    Aditi Singh, Abul Ehtesham, Saket Kumar, and Tala Talaei Khoei. 2025. A survey of the model context protocol (mcp): Standardizing context to enhance large language models (llms)

    2025

  18. [26]

    Jiongxiao Wang, Fangzhou Wu, Wendi Li, Jinsheng Pan, Edward Suh, Z Morley Mao, Muhao Chen, and Chaowei Xiao. 2024. Fath: Authentication-based test-time defense against indirect prompt injection attacks. arXiv preprint arXiv:2410.21492

    2024 arXiv

  19. [27]

    Fangzhou Wu, Shutong Wu, Yulong Cao, and Chaowei Xiao. 2024. Wipi: A new web threat for llm-driven web agents. arXiv preprint arXiv:2402.16965

    2024 arXiv

  20. [28]

    Junjie Xiong, Mingkui Wei, Zhuo Lu, and Yao Liu. 2024. https://doi.org/10.1016/j.hcc.2024.100292 Assessing the effectiveness of crawlers and large language models in detecting adversarial hidden link threats in meta computing . High-Confidence Computing, page 100292

    2024

  21. [29]

    Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. 2023. Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv preprint arXiv:2312.14197

    2023 arXiv

  22. [30]

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. https://doi.org/10.18653/v1/2024.findings-acl.624 I njec A gent: Benchmarking indirect prompt injections in tool-integrated large language model agents . In Findings of the Association for Computational Linguistics...

    2024 doi

  23. [31]

    Chong Zhang, Mingyu Jin, Dong Shu, Taowen Wang, Dongfang Liu, and Xiaobo Jin. 2024 a . Target-driven attack for large language models. In ECAI 2024, pages 1752--1759. IOS Press

    2024

  24. [32]

    Chong Zhang, Mingyu Jin, Qinkai Yu, Chengzhi Liu, Haochen Xue, and Xiaobo Jin. 2024 b . https://doi.org/10.1109/ICDM59182.2024.00119 Goal-guided generative prompt injection attack on large language models . In 2024 IEEE International Conference on Data Mining (ICDM), pages 941--946

    2024

  25. [33]

    it's a fair game

    Zhiping Zhang, Michelle Jia, Hao-Ping (Hank) Lee, Bingsheng Yao, Sauvik Das, Ada Lerner, Dakuo Wang, and Tianshi Li. 2024 c . https://doi.org/10.1145/3613904.3642385 “it's a fair game”, or is it? examining how users navigate disclosure risks and benefits when using llm-based c...

    2024

  26. [34]

    Yutao Zhu, Huaying Yuan, Shuting Wang, Jiongnan Liu, Wenhan Liu, Chenlong Deng, Haonan Chen, Zheng Liu, Zhicheng Dou, and Ji-Rong Wen. 2023. Large language models for information retrieval: A survey. arXiv preprint arXiv:2308.07107

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.