Pith. sign in

REVIEW 4 major objections 4 minor 26 references

Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation

T0 review · 4 major / 4 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LLM-based log analysis can be hijacked by instructions hidden in ordinary log entries, with attack success averaging over 80 percent across production models.

desk verdict First systematic look at log-based prompt injection, with a useful benchmark and a real attack variant — but the headline ASRs are unvalidated and the tables don't reconcile. read the letter →

arxiv 2607.14493 v1 pith:OA2A2RHV submitted 2026-07-16 cs.CR

Rabimba Karanjai , Yang Lu , Hemanth Hegadehalli Madhavarao , Lei Xu , Weidong Shi This is my paper
classification cs.CR
keywords passivepromptinjectionLLMloganalysisconfuseddeputycontextcontaminationStitchingdefense-in-depthattacksuccessratesecurityoperationscenter
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that LLM-based security log analysis has an inherent confused deputy vulnerability: because a transformer attends to every token in its context window without tracking provenance, adversarial text written into ordinary log fields (User-Agent strings, SSH usernames, JSON fields) is treated as instruction-level content when an analyst queries the system. Using a benchmark of nearly 13,000 log entries, the authors measure attack success rates averaging 83.4% across three production LLMs, introduce Context Stitching to fragment payloads across entries and evade stateless filters, and show that layered defenses reduce but do not eliminate the risk, leaving an 8.4% residual. If correct, this means any SOC deployment that lets an LLM read raw logs is exploitable by any attacker who can write to a log, and that no single prompt or filter fix removes the vulnerability.

What carries the argument

The confused deputy mechanism: the LLM's self-attention computes over all tokens regardless of provenance, so there is no 'trust bit' marking log content as data rather than instructions; behavioral separation is only a probabilistic artifact of RLHF, not a guarantee. The paper operationalizes this through LogInject, a benchmark of 12,847 log entries with 2,569 adversarial samples across three sophistication levels (atomic, fragmented/Context Stitching, obfuscated) and four attack objectives (conceal, fabricate, exfiltrate, instruct). Context Stitching is the novel evasion technique: it splits a payload across multiple individually-benign log entries that concatenate into a full instruction

What would settle it

Re-run the LogInject-1.0 evaluations with the full set of outputs judged by humans only (or by an independent judge model that is not one of the three targets) and compare the attack success rates. If the independently measured baseline ASR falls well below 83.4%, the central quantitative claim is weakened; if it holds, the vulnerability is confirmed as a property of the target models rather than a measurement artifact.

Watch

Extended reading notes

Core claim

The central claim is that passive prompt injection—embedding instructions in log-generating fields that persist in storage and execute when an analyst queries the LLM—is a systematic, measurable vulnerability of LLM-based log analysis, not a one-off exploit. Because transformer attention has no architectural distinction between trusted instructions and untrusted data, any adversary who can write to a logged field can promote their text to instruction status. The authors quantify this with up to 88.2% baseline attack success (83.4% average across GPT-4o, Claude 3.5 Sonnet, and Llama-3-70B), show that fragmenting payloads across entries (Context Stitching) reaches 76.4% success, and demonstrat

Load-bearing premise

The reported attack success rates depend on an automated GPT-4o judge that screens all model outputs against success criteria; if that judge is itself influenced by injected instructions in the logs, the measured success rates could be systematically inflated, a risk the paper's own limitation section acknowledges.

Editorial extensions

If this is right

  • Any public-facing service that echoes client input into logs (HTTP User-Agent, SSH username, JSON body) becomes a viable injection vector; SOCs that rely on LLM summaries without human review can miss real attacks.
  • Stateless input filters (WAFs, regex blocklists) provide marginal protection (~10% relative reduction) because payloads can be fragmented or obfuscated and the LLM 'heals' them.
  • Spotlighting—delimiting untrusted log data—is the single most effective prompt-level defense but degrades sharply at long context windows, with ASR rising from ~30% at 1K tokens to over 70% at 16K.
  • Defense-in-depth cuts ASR from roughly 87% to 8.4%, but the residual risk justifies mandatory human review for high-stakes security decisions.
  • Context Stitching's success depends on fragment proximity within a retrieval batch, so retrieval architecture is a partial control: smaller batch windows reduce but do not eliminate the attack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The absolute ASR numbers should be treated as provisional: the paper's own limitation section concedes that the automated GPT-4o judge could share the target models' susceptibility to injected instructions, so an independent judge or full human review might shift the measured rates.
  • The confused-deputy framing points toward a structural fix—architectural provenance tracking (e.g., hard attention masking of untrusted fields)—rather than prompt-level band-aids, though the paper only gestures toward this direction.
  • A natural extension is to run the same benchmark on smaller or domain-fine-tuned models, which the paper explicitly excludes; success rates may differ substantially if a model has learned to treat log syntax strictly as data.
  • The 8.4% residual ASR under the best defense can serve as a practical floor: any deployment claiming 'safe' LLM log analysis should demonstrate residual risk below this threshold on a public benchmark.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper presents LogInject, a framework and benchmark (LogInject-1.0) for studying passive prompt injection into LLM-based SOC log analysis. It defines a threat model with four attack objectives (conceal, fabricate, exfiltrate, instruct), three attack sophistication levels (atomic, fragmented Context Stitching, obfuscated), and evaluates GPT-4o, Claude 3.5 Sonnet, and Llama-3-70B on 12,847 log entries including 2,569 adversarial samples. The reported headline results are a baseline ASR of up to 88.2% (83.4% average), a 76.4% Context Stitching success rate, and a reduction to 8.4% residual ASR under layered defenses. The paper argues that this reflects an inherent confused-deputy vulnerability arising from the transformer's inability to mark token provenance.

Significance. If the quantitative estimates are valid, this would be a valuable systematic characterization of a real and under-measured vulnerability class, and the Context Stitching technique is a useful new attack primitive against stateless log defenses. The defense ablation and concrete case studies are also useful for practitioners. However, every headline quantitative claim depends on a judgment protocol in which a GPT-4o instance serves both as a target model and as the automated judge, and the paper does not report full-sample judge-vs-human agreement. In addition, several headline numbers do not reproduce from the tables. The qualitative finding that log-based prompt injection is dangerous is credible and supported by the case studies, but the specific magnitudes claimed as the paper's advance over prior proof-of-concept work are not yet established.

major comments (4)
  1. [§5.3; Limitations(4)] All ASR estimates rest on the judgment protocol: a separate GPT-4o instance screens outputs, humans review all flagged successes and a 10% sample of flagged failures. GPT-4o is also one of the three target models. The paper reports human-human κ>0.85 but never reports judge-vs-human agreement on the full sample or on the un-flagged failure set, so the judge's recall and precision are unknown. Because the judge may share the target model's susceptibility to injected instructions, the 83.4% baseline and 8.4% residual ASR could be systematically biased in either direction. Limitations(4) acknowledges this risk but does not quantify it. This is load-bearing: the authors should report judge-vs-human agreement over a full human-adjudicated subset, per objective and per flag class, or replace the GPT-4o judge with an independent judge model.
  2. [Tables 6 and 7; abstract vs. Table 8] The headline numbers are internally inconsistent. Table 6 gives GPT-4o an overall baseline ASR of 87.3%, but Table 7, described as GPT-4o all objectives combined, has a vector average of exactly 83.6% (the mean of 86.2, 83.4, 81.3, 88.9, 78.3). No explanation is given for the discrepancy. Similarly, the abstract and §8 state Context Stitching achieves 76.4% success, while the model averages in Table 8 (74.1, 61.2, 77.7) average to approximately 71.0%. These are the paper's headline quantitative contributions; the authors must provide run-level data, weights, or corrected tables so that the reported numbers reproduce from the presented evidence.
  3. [Table 9; §6.1.3] The combined-defense residual and per-objective rows do not reconcile. Weighting Table 9's 'All' row by the objective counts in Table 4 (892/647/518/512) gives approximately 9.1% residual ASR, not the reported 8.4%; weighting the baseline row gives approximately 88.1%, not the reported 87.3%. Additionally, §6.1.3 states 'When combined with Spotlighting, ASR drops to 8.4%', but Table 9 reports Spot.+Val. as 18.6% and only the full input+spotlight+output-validation configuration as 8.4%. The defense-effectiveness claim needs a single, consistent configuration definition and explicit per-configuration sample compositions and weights.
  4. [§5.1] The artifact availability statement is a literal placeholder: 'available through the permanent artifact repository listed in Appendix??'. Since LogInject-1.0 and the evaluation code are central contributions and the paper's reproducibility mechanism, the missing link is not a minor formatting issue. The authors must either provide the permanent repository identifier or qualify the availability claim; without the artifact, the benchmark-based claims cannot be independently checked.
minor comments (4)
  1. [§8] The claim that 'semantic sanitization is undecidable' is stated as a formal result, but no theorem, proof, or citation is supplied. This strong claim is not needed for the empirical vulnerability finding; either provide a formalization or soften it to 'cannot be guaranteed by static filtering in general.'
  2. [Abstract and §8] The Discussion states the recommended layered configuration 'achieved 91.6% attack reduction', whereas §6.2 and Table 9 report 90.4% for the combined configuration. These numbers should be reconciled.
  3. [Table 3] The table header reads 'Contect Contamination Attack Surface Summary'; should be 'Context Contamination.'
  4. [§7.8] The statistical significance paragraph reports all 95% confidence intervals within ±2.6 points and Bonferroni-corrected pairwise t-tests, but no CIs or test statistics are shown in any table. Reporting the supporting values, at least in an appendix, would make the claim auditable.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the ASR and defense-effectiveness numbers are direct measurements, not derived quantities; the GPT-4o judge–target overlap is an acknowledged measurement limitation, not a construction-level circularity.

full rationale

The paper's load-bearing claims are empirical measurements: baseline ASR, per-model/per-objective ASR, Context Stitching success rates, and defense reductions are reported as experimental outcomes computed from defined success criteria (Section 5.3, Tables 6–9). No quantity is derived from a fitted parameter, and no prediction is a renamed input. The theoretical claim that transformer attention lacks per-token provenance is an architectural argument, not a conclusion obtained from the measured ASR. The references to prior work (Greshake et al., Volvovsky, Hines et al., etc.) are external and contextual; there is no self-citation chain or imported uniqueness theorem that forces the paper's conclusions. The one in-scope limitation is the judgment protocol (Section 5.3, Limitations item 4): automated screening uses a GPT-4o instance while GPT-4o is also a target model, so judge–target correlation could bias the reported rates, and the paper explicitly acknowledges this risk. That is a measurement-validity concern rather than circularity: ASR is not defined in terms of the judge's parameters, the judge is not fitted to the outcomes, and humans review flagged positives and a sample of negatives. The internal numerical inconsistencies (Table 7 average 83.6% vs. Table 6 87.3%, Table 8 average vs. abstract's 76.4%, Table 9 weighted average vs. 8.4%) are consistency errors, not evidence that results reduce to their inputs. Therefore, under the strict standard required for a circularity finding, no circular step is exhibited.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The paper's quantitative claims are measurements, not derivations, so the ledger contains threat-model assumptions rather than free parameters. P1–P5 are explicit premises; the 'no trust bit' claim is an architectural assumption. The 'semantic sanitization is undecidable' assertion is included as an ad hoc assumption because it is used to justify the inevitability of residual risk, but it is not proved.

assumptions (6)
  • domain assumption P1: Adversary can write arbitrary text to at least one logged field
    Threat model §3; satisfied by any service echoing client-controlled input. If false, no injection surface exists.
  • domain assumption P2: Logs containing payloads are retrieved into the LLM context on a legitimate query
    Threat model §3. The baseline experiments guarantee inclusion, so measured ASR is an upper bound for realistic retrieval; the §7.4 retrieval experiment shows degradation.
  • domain assumption P3: Analyst-initiated processing consumes the LLM output
    Threat model §3; the attack only matters if the output reaches an analyst or downstream system.
  • domain assumption P4: Fragments co-locate in a single retrieval batch (for Context Stitching)
    Threat model §3; §7.4 shows ASR drops from 81.4% to 34.2% when fragments span batches, so this is load-bearing for Level 2 claims.
  • domain assumption Transformer attention weights all tokens equally regardless of provenance (no per-token trust bit)
    §3 and §4; this is the architectural premise for the confused-deputy claim. True for standard attention, but behavioral separation could in principle be learned; the paper treats it as a guarantee.
  • ad hoc to paper Semantic sanitization is undecidable
    §8 lists this as a theoretical limitation, but the paper provides only a hand-wavy argument, not a proof. It is used to justify the inevitability of residual risk and the need for layered defenses.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation." pith.science (2026). https://pith.science/paper/OA2A2RHV

@misc{pith2026260714493,
  author       = {Pith},
  title        = {Pith review of: Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OA2A2RHV}},
  note         = {Machine review of arXiv:2607.14493}
}
read the original abstract

Large Language Models are increasingly deployed in Security Operations Centers for log analysis tasks including summarization, alert triage, and threat investigation. These systems ingest logs from external-facing services and process network logs as natural language contexts to generate security insights. We demonstrate that this architectural pattern introduces a critical vulnerability: adversaries can embed prompt injection payloads in log-generating fields that persist in storage and are executed when analysts query the LLM, achieving what we term passive prompt injection. We present LogInject, a systematic framework for evaluating these threats. Using LogInject-1.0, a benchmark of 12,847 log entries including 2,569 adversarial samples, we evaluate three production LLMs across four attack objectives: activity concealment, false positive generation, information exfiltration, and output hijacking. Our findings reveal an up to 88.2% attack success rate (83.4% average across models) under the baseline conditions. We introduce Context Stitching, a novel technique that fragments payloads across multiple log entries to evade stateless filters while exploiting LLM long-context reasoning, achieving a 76.4% success rate. As mitigation, we evaluate layered defenses by combining input filtering, prompt hardening, and output validation, demonstrating a 90.4% attack reduction, although 8.4% residual vulnerability persists. Our results establish that LLM-based log analysis creates an inherent confused deputy vulnerability where untrusted data and trusted instructions compete indistinguishably for model attention, requiring defense in-depth architectures and continued human oversight for security-critical decisions.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

26 extracted references · 8 linked inside Pith

  1. [1]

    Invarllm: Llm-assisted physical invariant extraction for cyber-physical systems anomaly detection.arXiv preprint arXiv:2411.10918,

    Danial Abshari, Peiran Shi, Chenglong Fu, Meera Sridhar, and Xiaojiang Du. Invarllm: Llm-assisted physical invariant extraction for cyber-physical systems anomaly detection.arXiv preprint arXiv:2411.10918,

    arXiv

  2. [5]

    Min Du and Feifei Li

    URLhttps://arxiv.org/abs/2408.05061. Min Du and Feifei Li. Spell: Streaming parsing of system event logs. InIEEE ICDM,

    arXiv

  3. [7]

    URLhttps://arxiv.org/abs/2403.14720. Paul R. B. Houssel, Priyanka Singh, Siamak Layeghy, and Marius Portmann. Towards explainable network intrusion detection using large language models. In2024 IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT), page 67–72. IEEE, December

    arXiv

  4. [8]

    URLhttp://dx.doi.org/10.1109/BDCAT63179.2024.00021

    doi: 10.1109/bdcat63179.2024.00021. URLhttp://dx.doi.org/10.1109/BDCAT63179.2024.00021. Junjie Huang, Minghua He, Jinyang Liu, Yintong Huo, Domenico Bianculli, and Michael R Lyu. Codead: Synthesize code of rules for log-based anomaly detection with llms.arXiv preprint arXiv:2510.22986,

    arXiv 2024

  5. [10]

    ISBN 979-8-89176-334-0

    Association for Computational Linguistics. ISBN 979-8-89176-334-0. doi: 10.18653/v1/2025.emnlp-demos.55. URLhttps://aclanthology.org/2025.emnlp-demos.55/. Nelson F Liu, Kevin Lin, John Hewitt, et al. Lost in the middle: How language models use long contexts.Transactions of the Association for Computational Linguistics, 2024a. Yi Liu, Gelei Deng, Yuekang L...

    arXiv 2025

  6. [12]

    doi: 10.1109/SP61157.2025

    Institute of Electrical and Electronics Engineers Inc. doi: 10.1109/SP61157.2025. 00250. Publisher Copyright:©2025 IEEE.; 46th IEEE Symposium on Security and Privacy, SP 2025 ; Conference date: 12-05-2025 Through 15-05-2025. Paolo Notaro, Carmelo Runza, Hamid Arabnejad, and Javid Taheri. A survey on aiops: Concepts, use cases, and tools. Applied Sciences,...

    arXiv 2025

  7. [14]

    Rodrigo Pedro, Miguel E

    URLhttps://arxiv.org/abs/2311.05261. Rodrigo Pedro, Miguel E. Coimbra, Daniel Castro, Paulo Carreira, and Nuno Santos.Prompt-to-SQL Injections in LLM-Integrated Web Applications: Risks and Defenses, page 1768–1780. IEEE Press,

    arXiv

  8. [15]

    URLhttps://doi.org/10.1109/ICSE55347.2025.00007

    ISBN 9798331505691. URLhttps://doi.org/10.1109/ICSE55347.2025.00007. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models. InConference on Empirical Methods in Natural Language Processing,

    arXiv 2025

Show all 26 references
  1. [17]

    ISBN 978-3-031-70878-7

    Springer-Verlag. ISBN 978-3-031-70878-7. doi: 10.1007/978-3-031-70879-4_6. URLhttps://doi.org/10.1007/978-3-031-70879-4_6. Julien Piet, Vivian Fang, Rishi Khare, Scott Coull, Vern Paxson, Raluca Ada Popa, and David Wagner. Semantic-aware parsing for security logs,

    doi

  2. [18]

    Jiaxing Qi, Shaohan Huang, Zhongzhi Luan, Shu Yang, Carol Fung, Hailong Yang, Depei Qian, Jing Shang, Zhiwen Xiao, and Zhihui Wu

    URLhttps://arxiv.org/abs/2506.17512. Jiaxing Qi, Shaohan Huang, Zhongzhi Luan, Shu Yang, Carol Fung, Hailong Yang, Depei Qian, Jing Shang, Zhiwen Xiao, and Zhihui Wu. Loggpt: Exploring chatgpt for log-based anomaly detection. In2023 IEEE International Conference on High Perfor...

  3. [19]

    Greg Robison

    doi: 10.1109/HPCC-DSS-SmartCity-DependSys60770.2023.00045. Greg Robison. The crisis of agency: A comprehensive analysis of prompt injection and the security architecture of autonomous ai. Medium,

    2023

  4. [20]

    ISBN 9798400718953

    Association for Computing Machinery. ISBN 9798400718953. doi: 10.1145/3733799. 3762963. URLhttps://doi.org/10.1145/3733799.3762963. Jiawen Shi, Zenghui Yuan, Yinuo Liu, Yue Huang, Pan Zhou, Lichao Sun, and Neil Zhenqiang Gong. Optimization-based prompt injection attack to llm-...

    2024

  5. [21]

    ISBN 9798400706363

    Association for Computing Machinery. ISBN 9798400706363. doi: 10.1145/3658644.3690291. URLhttps://doi.org/10.1145/3658644.3690291. Shai Volvovsky. When your logs lie: Prompt poisoning & injection risks in xdr ai summaries. Sygnia Blog,

  6. [22]

    Reachal Wang, Yuqi Jia, and Neil Zhenqiang Gong

    URL https://www.sygnia.co/blog/log-prompt-poisoning-xdr-ai-risks/. Reachal Wang, Yuqi Jia, and Neil Zhenqiang Gong. Obliinjection: Order-oblivious prompt injection attack to llm agents with multi-source data, 2025a. URLhttps://arxiv.org/abs/2512.09321. Xilong Wang, John Bloch,...

    2025

  7. [23]

    ISBN 9798400712456

    Association for Computing Machinery. ISBN 9798400712456. doi: 10.1145/3690624.3709179. URL https://doi.org/10.1145/3690624.3709179. Wanhao Zhang, Qianli Zhang, Enyu Yu, Yuxiang Ren, Yeqing Meng, Mingxi Qiu, and Jilong Wang. Leveraging rag- enhanced large language model for sem...

    2024

  8. [24]

    Wenjie Zhang, Yun Lin, Chun Fung Amos Kwok, Xiwen Teoh, Xiaofei Xie, Frank Liauw, Hongyu Zhang, and Jin Song Dong

    URLhttps://api.semanticscholar.org/ CorpusID:274469245. Wenjie Zhang, Yun Lin, Chun Fung Amos Kwok, Xiwen Teoh, Xiaofei Xie, Frank Liauw, Hongyu Zhang, and Jin Song Dong. Mines: Explainable anomaly detection through web api invariant inference.arXiv preprint arXiv:2512.06906,

    arXiv

  9. [25]

    Robust log-based anomaly detection on unstable log data

    Xu Zhang, Yong Xu, Qingwei Lin, Bo Qiao, Hongyu Zhang, Yingnong Dang, Chunyu Xie, Xinsheng Yang, Qian Cheng, Ze Li, Junjie Chen, Xiaoting He, Randolph Yao, Jian-Guang Lou, Murali Chintalapati, Furao Shen, and Dongmei Zhang. Robust log-based anomaly detection on unstable log da...

    2019

  10. [27]

    Wei Zou, Yupei Liu, Yanting Wang, Ying Chen, Neil Gong, and Jinyuan Jia

    URLhttps://arxiv.org/abs/2008.06448. Wei Zou, Yupei Liu, Yanting Wang, Ying Chen, Neil Gong, and Jinyuan Jia. Pishield: Detecting prompt injection attacks via intrinsic llm features,

    2008 arXiv

  11. [28]

    routine vulnerability scanning by internal IT team

    URLhttps://arxiv.org/abs/2510.14005. 22 A Extended Qualitative Case Studies To ground the threat model in operational reality, we present extended, end-to-end examples ofLogInject attacks. Theseexamplesillustratetherawlogformatsexactlyastheyappearinstandardsecurityinfrastructu...

    2025

  12. [2016]

    Deeplog: Anomaly detection and diagnosis from system logs through deep learning

    Min Du, Feifei Li, Guineng Zheng, and Vivek Srikumar. Deeplog: Anomaly detection and diagnosis from system logs through deep learning. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 1285–1298. ACM,

    2017

  13. [2019]

    ISBN 9781450355728

    Association for Computing Machinery. ISBN 9781450355728. doi: 10.1145/3338906.3338931. URLhttps://doi.org/10.1145/3338906.3338931. Jieming Zhu, Shilin He, Pinjia He, Jinyang Liu, and Michael R. Lyu. Loghub: A large collection of system log datasets for ai-driven log analytics,

  14. [2021]

    Owasp top 10 for large language model applications 2025,

    OWASP Foundation. Owasp top 10 for large language model applications 2025,

    2025

  15. [2022]

    Julien Piet, Maha Alrashed, Chawin Sitawarin, Sizhe Chen, Zeming Wei, Elizabeth Sun, Basel Alomair, and David Wag- ner

    URLhttps://api.semanticscholar.org/CorpusID:246634238. Julien Piet, Maha Alrashed, Chawin Sitawarin, Sizhe Chen, Zeming Wei, Elizabeth Sun, Basel Alomair, and David Wag- ner. Jatmo: Prompt injection defense by task-specific finetuning. InComputer Security – ESORICS 2024: 29th ...

    2024

  16. [2023]

    Logprompt: Prompt engineering towards zero-shot and interpretable log analysis

    Yilun Liu, Shimin Tao, Weibin Meng, Feiyu Yao, Xiaofeng Zhao, and Hao Yang. Logprompt: Prompt engineering towards zero-shot and interpretable log analysis. InProceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings, ICSE-Com...

    2024

  17. [2024]

    Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner

    URLhttps://arxiv.org/abs/2410.22284. Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. Struq: defending against prompt injection with structured queries. InProceedings of the 34th USENIX Conference on Security Symposium, SEC ’25, USA, 2025a. USENIX Association. ISBN...

    arXiv

  18. [2025]

    ISBN 9798400714764

    Association for Computing Machinery. ISBN 9798400714764. doi: 10.1145/3714393.3726501. URLhttps://doi.org/10.1145/3714393.3726501. 20 Sam Johnson, Viet Pham, and Thai Le. The dangers of indirect prompt injection attacks on LLM-based autonomous web navigation agents: A demonstr...

    2025

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.