Pith. sign in

REVIEW 3 major objections 4 minor 29 references

PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents

T0 review · 3 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PromptShield-Home finds that no single layer balances safety and utility against ambient prompt injection: detectors execute everything, MLLMs over-refuse, and only an oracle fusion passes 90%.

desk verdict Honest pilot with a useful metric split, but the disjoint-correct-sets oracle is largely an artifact of the idealized always-execute L0 proxy. read the letter →

arxiv 2608.05495 v1 pith:RUS37LF4 submitted 2026-08-06 cs.CR cs.HC

He Zhang , Feilong Li , Dingning Long , Yilin Cui , Peijun Zhang , Yuewen Zhang , Qianyao Xu , Xinyi Fu This is my paper · ORCID
classification cs.CRcs.HC
keywords ambientpromptinjectionsmart-homeagentsmultimodallargelanguagemodelsover-refusalunsafeexecutionsafe-completionratesensorfusionlearnedrouting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PromptShield-Home is a pilot benchmark for a safety question unique to smart homes: can an agent distinguish a genuine command from ambient content that merely looks like one, such as TV speech, on-screen text, or an overheard conversation? The paper compares three abstraction layers—traditional detectors, single multimodal LLMs, and multi-agent mediation—across 19 scenarios, evaluating unsafe-execution rate and safe-completion rate rather than aggregate accuracy, because a constant always-block predictor already scores 82%. The core finding is that the two paradigms fail in opposite directions: detectors execute all 17 decision cases, while every MLLM configuration completes none of the three action-required cases and misses a real fall. Their correct sets are disjoint, so an oracle that always picks the right layer reaches 94.1% accuracy versus 76.5% for the best single layer, reported as an upper bound because no router is implemented. The authors conclude that home-agent safety is best served by learned routing and sensor fusion, not by replacing detectors with an MLLM.

What carries the argument

The argument is carried by the ternary decision space execute/block/ask_user and the paired metrics UER (unsafe-execution rate, the share of no-action cases executed) and SCR (safe-completion rate, the share of action-required cases executed). The second load-bearing mechanism is the layer decomposition into traditional detectors, a single MLLM under vision, vision plus ASR, and audio-visual settings, and multi-agent mediation, together with the set analysis showing that the traditional-detector layer and the vision MLLM have disjoint correct sets. The oracle over these two layers produces the 94.1% upper bound; the authors explicitly note that the detector baseline is an idealized proxy annotation, so the complementarity overstates what a fielded detector stack would contribute.

What would settle it

Run the 19 PromptShield-Home scenarios through actual wake-word, pose, and OCR detectors with realistic miss and false-alarm rates, then recompute the union of decisions with the vision MLLM; if the real detector layer misses the fall case V11, fires on scenarios the annotation blocks, or shares correct cases with the MLLM, the 94.1% oracle figure collapses toward the best single-layer figure.

Watch

Extended reading notes

Core claim

The central claim is that no single abstraction layer can balance safety and utility for a home agent facing ambient multimodal prompt injection. Traditional detectors (wake-word, pose, OCR) execute every scenario, giving an unsafe-execution rate of 14/14 and a safe-completion rate of 3/3; every MLLM configuration collapses to the opposite corner, with unsafe execution near zero but safe completion 0/3, missing the genuine fall in every case. Because most scenarios are no-action cases, aggregate accuracy is degenerate: the highest-accuracy configuration, at 82.4%, is byte-identical to an always-block predictor. The decisive discovery is complementarity: the detector layer's correct set and the vision MLLM's correct set are disjoint—no case is solved by both—so an oracle over the two layers reaches 94.1% versus 76.5% for the best single layer. This is an upper bound, not an implemented system, and it motivates routing each decision to the appropriate layer and fusing physical sensors with MLLMs rather than replacing detectors.

Load-bearing premise

The load-bearing premise is that the traditional-detector layer can be represented by an idealized annotation of what a wake-word, pose, or OCR detector would fire on; if real detectors miss different cases or fire on different ones, the disjointness and the 94.1% oracle upper bound change.

Editorial extensions

If this is right

  • A single MLLM agent is not a safe standalone decision-maker in the home: it blocks nearly every genuine command and misses the real fall in every tested configuration.
  • Adding ASR transcripts to the vision model increases unsafe execution from 1/14 to 4/14 cases, so more modalities do not automatically improve safety; native audio only shifts decisions to ask_user.
  • Increasing frame count and per-frame resolution does not recover the missed action cases and can flip a spatial-injection case to unsafe execution at high frame counts, so denser sampling is not a remedy for over-refusal.
  • An oracle-style router over detectors and a vision MLLM suggests a 94.1% accuracy ceiling, but because no router is implemented, a learned router must be built and evaluated to see how much of that gap is reachable.
  • For fall detection, the paper recommends a high-sensitivity physical sensor trigger (for example IMU or radar) paired with an MLLM false-alarm filter rather than a camera-only agent.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extending the paper's logic, the difference between the 94.1% oracle and the 76.5% best single layer defines a 'routing headroom' of 17.6 points, giving future defense designs a concrete target to close.
  • Because the detector layer is an idealized annotation, a fielded detector stack would likely break the perfect disjointness; a trained router should be tested with measured sensor miss and false-alarm rates before treating complementarity as deployable.
  • The gold labels were fixed by author consensus, so an independent annotation pass on the same 19 scenarios would test whether the disjoint failure modes survive label variation, and a larger, more balanced scenario set would make the claimed complementarity more robust.
  • The over-refusal pattern may partly reflect the benchmark's strong prior toward inaction; a real deployment must set the cost asymmetry between a missed fall and an unwanted action explicitly, rather than inherit it from an always-block baseline.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper presents PromptShield-Home, a 19-scenario pilot benchmark (17 video clips plus 2 still images) for ambient multimodal prompt injection in smart-home agents. It compares a traditional-detector baseline (L0, annotated by the authors), a single-MLLM layer (L1: vision, vision+ASR, audio-visual), and multi-agent mediation (L2: voting, specialists, arbitration) on a ternary execute/block/ask_user decision. Because most labels are no-action, the paper argues aggregate accuracy is degenerate and reports UER (unsafe-execution rate) and SCR (safe-completion rate). The headline finding is that L0 and the vision MLLM have disjoint correct sets, so an oracle over {L0, VL} reaches 16/17 (94.1%) accuracy versus 13/17 (76.5%) for the best single layer; the authors explicitly label this an upper bound, since no router is implemented, and recommend routing and sensor fusion rather than MLLM replacement.

Significance. The paper's main methodological contribution is the insistence on reporting safety and utility separately: the always-block baseline reaches 82.4% accuracy, so accuracy alone is uninformative in this distribution. The UER/SCR decomposition is simple and correct. The paper also honestly reports its own limitations (small N, author-annotated L0, single-run inference, no router) and checks robustness with five seeds for selected configurations. If the complementarity result held with a real detector baseline, it would be a useful and falsifiable argument for layered routing in smart-home agents. As a pilot study, it is a reasonable first step, but the central empirical claim currently rests on an idealized proxy rather than on measured detector behavior.

major comments (3)
  1. [Section 3 (Traditional-detector annotation); Table 4] The central complementarity result is an arithmetic consequence of the L0 proxy annotation, not an empirical finding about real detectors. Because Section 3 assigns L0 execute on all 17 clips (every scenario is said to contain a surface cue), L0 is exactly an always-execute layer; its correct set is therefore precisely the three action-required cases. Since Table 3 shows VL has SCR=0/3, the correct sets are disjoint by construction, and the 94.1% oracle follows necessarily. The limitation paragraph concedes the proxy is idealized 'in both directions,' but the routing recommendation in §5.2 depends on L0 having perfect recall. A real detector that misses one of V11/V16/V17 lowers the oracle to at most 15/17 = 88.2%. To make the headline claim load-bearing, the authors should either run an actual wake-word/pose/OCR detector stack or explicitly present the result as conditional on an idealized perfect-recall baseline.
  2. [Section 4 (Finding 1); Table 3] The over-refusal finding is based on only three action-required cases (one real fall and two command-floor cases), so every MLLM's SCR=0/3 is three failures and a single decision flip changes SCR by 33.3 points. The paper acknowledges the small N, but the generalization 'every MLLM over-refuses' is asserted more strongly than the data support. In particular, Omni flips 16/17 decisions across seeds (Table 5), so at least one model's behavior is unstable rather than systematically cautious. I recommend either expanding the action-required set or softening the claim to 'in this pilot, all tested MLLM configurations failed to execute the available action-required cases.'
  3. [Section 5.2; Section 6] The 'route, don't replace' recommendation is a design hypothesis, not an outcome of the experiment: no router is implemented, and the oracle in Table 4 assumes the router always picks the correct layer. The paper does state this, but the discussion should go further and specify what would be needed to realize the 94.1% in practice (e.g., a calibrated confidence signal, a cost model balancing UER and SCR, and a failure analysis of router errors). Without that, the central recommendation is an interesting conjecture rather than a demonstrated result.
minor comments (4)
  1. [Table 4] Please show the count explicitly: the table reports 3 + 13 = 16 correct cases and 94.1%, but it never names the one case (V06?) that neither layer solves; adding that case to the table would make the complementarity easier to verify.
  2. [Section 3] Since the raw media are not released, please provide the per-scenario surface-cue annotation (or an appendix table) that justifies the claim that every scenario contains a cue the L0 proxy latches onto; otherwise the L0 baseline is not independently checkable.
  3. [Table 5] Please report the sampling temperature and decoding parameters used for Table 3 versus Table 5; the paper says inference is 'mostly single-run,' but without this detail the reader cannot tell whether the single-run results are greedy or sampled.
  4. [Header and Table 2] There is a likely typo in an author email ('outllook.com'), and the label 'ask_user_or_block' in Table 2 should be defined or written with spaces so it reads as a ternary gold decision rather than a code string.

Circularity Check

1 steps flagged · score 2.0 of 10

L0 is an author-annotated idealized proxy, so the disjoint-correct-sets oracle is partly by construction; the paper discloses this as an upper bound, so the circularity is minor.

  1. other [Section 3 'Traditional-detector annotation'; Table 3 note; Section 4 'Complementarity: route, don’t replace'; Table 4]
    "For each scenario, we also record what a conventional detector would do. Examples include execute_via_keyword ... execute_via_pose_threshold ... execute_via_ocr_keyword ... It provides the L0 traditional-detector baseline for comparison with the MLLM-based layers, without requiring us to run a separate detector stack. The proxy is idealised in both directions ... L0 fires on all 17 cases and so coincides with always-execute, since every scenario contains a surface cue a rule latches onto."

    L0 is not a measured detector; its decisions are author-assigned by a rule that fires whenever a surface cue (wake word, pose threshold, OCR keyword) is present. Since every scenario was annotated as containing such a cue, L0's execute set is all 17 by construction, so its correct set is exactly the gold execute set {V11,V16,V17}. Table 3 records VL's SCR as 0/3, so the disjointness in Table 4 and the 94.1% oracle are entailed by the proxy definition plus the MLLM's measured over-refusal, not discovered from a real detector stack. The paper explicitly labels this an upper bound and concedes a fielded detector would have misses and false alarms, which limits the severity; the circularity is confined to presenting an idealized annotation as a baseline layer.

full rationale

The paper's main measured content is the MLLM layer evaluation, which is genuinely empirical and reported with per-configuration UER/SCR/FBR/HCR. The L0 layer, however, is an idealized author-annotated proxy rather than a run detector stack, and because the annotation rule makes L0 fire on every scenario, its correct set is forced to coincide with the gold action-required set. The complementarity result and the 94.1% oracle therefore follow in part from the construction of L0 rather than from observation of real detector failures. The paper explicitly calls this an upper bound and states that 'a fielded detector has misses and false alarms of its own,' so the result is not overclaimed as a deployed-system measurement. There are no fitted parameters renamed as predictions, no load-bearing self-citations, and no imported uniqueness theorems; the design recommendation about routing and sensor fusion is an interpretation of the measured and annotated layers, not a circular derivation. The flagged step is a validity caveat with a mild self-definitional flavor, but it does not invalidate the benchmark or reduce the central claim to its inputs.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No free parameters are fitted; the analysis is a fixed benchmark comparison. The central claims rest on two domain assumptions: the author-consensus gold labels are correct, and the idealized L0 proxy captures how real detectors behave. Both are acknowledged in the paper.

assumptions (3)
  • domain assumption Gold decisions assigned by unanimous author consensus are correct ground truth for the 19 scenarios.
    Section 3: labels fixed by structured consensus protocol, not independent annotation, so errors would propagate to UER/SCR.
  • domain assumption The L0 proxy annotation faithfully represents what traditional detectors would do, including catching the real fall and firing on surface cues.
    Section 3: 'the proxy is idealised in both directions, a fielded detector has misses and false alarms of its own'.
  • domain assumption Zero-shot MLLM outputs with the fixed prompt template are representative of each model's decision behavior.
    Tables 3-5: single runs for most configs, 5-seed robustness only for VL and Omni variants.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents." pith.science (2026). https://pith.science/paper/RUS37LF4

@misc{pith2026260805495,
  author       = {Pith},
  title        = {Pith review of: PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RUS37LF4}},
  note         = {Machine review of arXiv:2608.05495}
}
read the original abstract

Smart-home assistants increasingly use multimodal large language models (MLLMs) that perceive video and audio directly. This raises a safety question specific to the home: can the agent tell a genuine user command from ambient or externally-sourced content, television speech, on-screen text, or an overheard conversation, that merely looks like a command? We introduce PromptShield-Home, a pilot benchmark of realistic smart-home scenarios spanning addressee ambiguity, screen/audio injection, health-monitor false triggers, mixed occupancy, and a legitimate-command floor, and use it to compare three abstraction layers: traditional detectors (L0), a single MLLM agent (L1; vision, vision+ASR, and audio-visual), and multi-agent mediation (L2; voting, role specialists, cross-model arbitration). Because the label distribution is skewed toward inaction, aggregate accuracy is misleading, a constant always-block predictor scores 82%, so we report unsafe-execution and safe-completion rates separately. The two paradigms fail in opposite ways: detectors act on everything, while every MLLM configuration over-refuses, completing almost no genuine command and missing a true fall in every case. Crucially, their correct sets are disjoint: an oracle that always picks the right layer reaches 94.1%, against 76.5% for the best single layer. We report this as an upper bound, not a system - no router is implemented - and argue that home-agent safety is best served by learned routing and sensor fusion, not by replacing detectors with an MLLM.

Figures

Figures reproduced from arXiv: 2608.05495 by the authors.

Figure 1
Figure 1. The safety–utility plane. Every single- and multi [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Complementarity. L0 and the vision MLLM have [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Example smart-home scenarios in the PromptShield-Home benchmark. The scenarios cover common sources of ambient multimodal content that may be misinterpreted as executable user intent, including TV/media speech, bystander conversation, on-screen text, and genuine user commands. Faces are blurred for privacy. 3 Dataset We designed a pilot benchmark to test whether smart-home agents can separate real user intent from a… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 13 canonical work pages

  1. [1]

    Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, and Vitaly Shmatikov. 2023. Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs. arXiv:2307.10490 [cs.CR] https://arxiv.org/abs/2307.10490

    arXiv 2023

  2. [2]

    Marie Chan, Daniel Estève, Christophe Escriba, and Eric Campo. 2008. A review of smart homes—Present state and future challenges.Computer methods and programs in biomedicine91, 1 (2008), 55–81. https://doi.org/10.1016/j.cmpb.2008. 02.001

    work page doi:10.1016/j.cmpb.2008 2008

  3. [3]

    Wiest, Carolin V

    Jan Clusmann, Dyke Ferber, Isabella C. Wiest, Carolin V. Schneider, Titus J. Brinker, Sebastian Foersch, Daniel Truhn, and Jakob Nikolas Kather. 2025. Prompt Injection Attacks on Vision Language Models in Oncology.Nature Communica- tions16 (2025), 1239. https://doi.org/10.1038/s41467-024-55631-x

    work page doi:10.1038/s41467-024-55631-x 2025

  4. [4]

    Xinyi Fu, He Zhang, Cheng Xue, and Tongxin Sun. 2023. A review of the frontier research on future smart home.Science & Technology Review41, 8 (2023), 36–52

    work page 2023

  5. [5]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not What You’ve Signed Up For: Compromis- ing Real-World LLM-Integrated Applications with Indirect Prompt Injection. InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec ’23). Association for Computing Machinery, New Yor...

    arXiv 2023

  6. [6]

    2017.IoT fundamentals: Networking technologies, protocols, and use cases for the internet of things

    David Hanes, Gonzalo Salgueiro, Patrick Grossetete, Robert Barton, and Jerome Henry. 2017.IoT fundamentals: Networking technologies, protocols, and use cases for the internet of things. Cisco Press

    work page 2017

  7. [7]

    Wenda Li, Tan Yigitcanlar, Isil Erol, and Aaron Liu. 2021. Motivations, barriers and risks of smart home adoption: From systematic literature review to conceptual framework.Energy Research & Social Science80 (2021), 102211. https://doi.org/ 10.1016/j.erss.2021.102211

    work page arXiv 2021

  8. [8]

    Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, Leo Yu Zhang, and Yang Liu. 2023. Prompt Injection Attack against LLM-Integrated Applications. https: //doi.org/10.48550/arXiv.2306.05499 arXiv:2306.05499 [cs.CR]

    arXiv doi:10.48550/arxiv.2306.05499 2023

Show all 29 references
  1. [9]

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and Benchmarking Prompt Injection Attacks and Defenses. InPro- ceedings of the 33rd USENIX Security Symposium(Philadelphia, PA, USA). USENIX Association, 1831–1847. https://doi.org/10.48...

    2024 doi

  2. [10]

    Dmitriy Rivkin, Francois Hogan, Amal Feriani, Abhisek Konar, Adam Sigal, Xue Liu, and Gregory Dudek. 2025. AIoT Smart Home via Autonomous LLM Agents. IEEE Internet of Things Journal12, 3 (2025), 2458–2472. https://doi.org/10.1109/ JIOT.2024.3471904

    2025

  3. [11]

    Lea Schönherr, Maximilian Golla, Thorsten Eisenhofer, Jan Wiele, Dorothea Kolossa, and Thorsten Holz. 2022. Exploring Accidental Triggers of Smart Speak- ers.Computer Speech & Language73 (2022), 101328. https://doi.org/10.1016/j.csl. 2021.101328

    2022

  4. [12]

    Choquette-Choo, Milad Nasr, Chawin Sitawarin, Gena Gibson, Andreas Terzis, and John "Four" Flynn

    Chongyang Shi, Sharon Lin, Shuang Song, Jamie Hayes, Ilia Shumailov, Itay Yona, Juliette Pluto, Aneesh Pappu, Christopher A. Choquette-Choo, Milad Nasr, Chawin Sitawarin, Gena Gibson, Andreas Terzis, and John "Four" Flynn

  5. [13]

    Jiawen Shi, Zenghui Yuan, Yinuo Liu, Yue Huang, Pan Zhou, Lichao Sun, and Neil Zhenqiang Gong. 2024. Optimization-based Prompt Injection Attack to LLM- as-a-Judge. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (CCS ’24). Association...

    2024

  6. [14]

    Marx Boyuan Wang, Daniel Manesh, Ruipu Hu, and Sang Won Lee. 2022. iThem: Programming Internet of Things Beyond Trigger-Action Pattern. InAdjunct Proceedings of the 35th Annual ACM Symposium on User Interface Software and Technology(Bend, OR, USA)(UIST ’22 Adjunct). Associatio...

    2022

  7. [15]

    Xueyi Wang, Joshua Ellul, and George Azzopardi. 2020. Elderly Fall Detection Systems: A Literature Survey.Frontiers in Robotics and AI7 (2020), 71. https: //doi.org/10.3389/frobt.2020.00071

    2020

  8. [16]

    Shihao Weng, Yang Feng, Jinrui Zhang, Xiaofei Xie, Jiongchi Yu, and Jia Liu

  9. [17]

    Charlie Wilson, Tom Hargreaves, and Richard Hauxwell-Baldwin. 2015. Smart homes and their users: a systematic analysis and key challenges.Personal and Ubiquitous Computing19 (2015), 463–476. https://doi.org/10.1007/s00779-014- 0813-0

    2015 doi

  10. [18]

    Jiayang Wu, Wensheng Gan, Zefeng Chen, Shicheng Wan, and Philip S. Yu. 2023. Multimodal Large Language Models: A Survey. In2023 IEEE International Confer- ence on Big Data (BigData). 2247–2256. https://doi.org/10.1109/BigData59044. 2023.10386743

    2023

  11. [19]

    Edward Suh

    Chong Xiang, Drew Zagieboylo, Shaona Ghosh, Sanjay Kariyappa, Kai Greshake, Hanshen Xiao, Chaowei Xiao, and G. Edward Suh. 2026. Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks. arXiv:2603.30016 [cs.CR] https://arx...

    2026

  12. [20]

    Xiao Xue, Xinyang Li, Boyang Jia, Jiachen Du, and Xinyi Fu. 2024. Who Should Hold Control? Rethinking Empowerment in Home Automation among Cohabi- tants through the Lens of Co-Design. InProceedings of the 2024 CHI Conference on Human Factors in Computing Systems(Honolulu, HI, ...

    2024

  13. [21]

    Haruki Yonekura, Fukuharu Tanaka, Teruhiro Mizumoto, and Hirozumi Yam- aguchi. 2024. Generating Human Daily Activities with LLM for Smart Home Simulator Agents. In2024 International Conference on Intelligent Environments (IE). 93–96. https://doi.org/10.1109/IE61493.2024.10599909

    2024

  14. [22]

    Sayyed Javad Asad Poor Zavei and Mahmud Mohd Jusan. 2012. Exploring housing attributes selection based on Maslow’s hierarchy of needs.Procedia-Social and Behavioral Sciences42 (2012), 311–319. https://doi.org/10.1016/j.sbspro.2012.04. 195

    2012 doi

  15. [23]

    He Zhang, Robin Ananda, Xinyi Fu, Zhe Sun, Xiaoyu Wang, Keqi Chen, and John Carroll. 2024. Multi-channel Sensor Network Construction, Data Fusion and Challenges for Smart Home. InProceedings of the Eleventh International Symposium of Chinese CHI(Denpasar, Bali, Indonesia)(CHCH...

    2024

  16. [24]

    He Zhang and Xinyi Fu. 2025. Zero-shot Emotion Annotation in Facial Images Using Large Multimodal Models: Benchmarking and Prospects for Multi-Class, Multi-Frame Approaches. InProceedings of the 3rd International Workshop on Multimodal and Responsible Affective Computing(Irela...

    2025

  17. [25]

    He Zhang, Yuewen Zhang, Bochen Li, Wen Chen, Yueyan Liu, Qianyao Xu, and Xinyi Fu. 2026. AIoT Smart Home Automation Architecture: Autonomous Decision-Making Powered by Multimodal Large Language Models (MLLMs). In Companion Proceedings of the 31st International Conference on In...

    2026

  18. [26]

    Wei Zou, Mingwen Dong, Miguel Romero Calvo, Shuaichen Chang, Jiang Guo, Dongkyu Lee, Xing Niu, Xiaofei Ma, Yanjun Qi, and Jiarong Jiang. 2026. Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents. arXiv:2604.02623 [cs.CR] https://arxiv.org/...

    2026 arXiv

  19. [27]

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. Poisone- dRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. In34th USENIX Security Symposium (USENIX Security 25). USENIX Association, Seattle, WA, 3827–3844. https://www.us...

    2025

  20. [2025]

    arXiv:2505.14534 [cs.CR] https://arxiv.org/abs/2505.14534

    Lessons from Defending Gemini Against Indirect Prompt Injections. arXiv:2505.14534 [cs.CR] https://arxiv.org/abs/2505.14534

    arXiv

  21. [2026]

    arXiv:2605.03378 [cs.CR] https://arxiv.org/abs/2605.03378

    ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection. arXiv:2605.03378 [cs.CR] https://arxiv.org/abs/2605.03378

    arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.