An Empirical Evaluation of Prompt Injection Vulnerabilities in Large Language Models Across Multilingual and Obfuscated Attack Scenarios

Large Language Model Vulnerabilities

Generating Attacks for LLMs with GFlowNets

This study proposes an automated, human-independent, and adaptive approach leveraging GFlowNets to identify LLM vulnerabilities by utilizing one large language model to test another, and introduces a model capable of generating attack inputs in the Turkish language.

Generating Attacks for LLM with GFlowNets

The rapid advancement of Large Language Models (LLMs) has facilitated their ubiquitous integration into various domains, leading to widespread adoption. However, this escalating trend has introduced significant security vulnerabilities, necessitating the identification and mitigation of flaws arising from malicious exploitation. Red teaming assessments, conducted to evaluate model robustness through diverse adversarial inputs, are essential for exposing security risks and implementing countermeasures. Currently, red teaming is performed either manually by experts or automatically using predefined attack datasets. Nevertheless, manual testing remains time-consuming, while existing automated methods suffer from limited creativity due to their inherent dependency on fixed datasets. In this study, we propose an automated, human-independent, and adaptive approach leveraging GFlowNets to identify LLM vulnerabilities by utilizing one large language model to test another. Within this framework, an attacker model is trained against a specified victim model to perform automated red teaming and provide a quantitative robustness score. This research aims to generate more effective adversarial attacks in English compared to existing benchmarks and, as a novel contribution to the literature, introduces a model capable of generating attack inputs in the Turkish language.

AI security beyond core domains: resume screening as a case study of adversarial vulnerabilities in specialized LLM applications

Large Language Models (LLMs) are increasingly used to automate high-stakes screening decisions, yet they can be manipulated by adversarial instructions hidden in the documents they evaluate. This paper introduces a benchmark for this vulnerability in LLM-based resume screening: 463 job-candidate pairs drawn from a 14-domain corpus, with the evaluated sample covering 13 domains, attacked through a taxonomy of four attack types and four injection positions (16 attack configurations). Across 12 model configurations covering open-weight and proprietary models, some attack types exceed 80% attack success rate (ASR) when the injected content reaches the model, and attacks upgrade up to 73.4% of candidates unanimously rejected by human annotators. The hidden-content attacks assume the resume text or HTML reaches the model; an end-to-end parser-layer analysis shows that style-aware sanitization removes most of them before classification, whereas visible-text attacks survive. We evaluate prompt-based defenses on all 12 model configurations and our proposed FIDS (Foreign Instruction Detection through Separation), a fine-tuning defense, on Qwen3-8B, the one base model we could fine-tune. On Qwen3-8B, in paired configuration-level comparisons against a common no-defense baseline, prompt-based defense reduces ASR by 10.1 percentage points (pp; 95% bootstrap CI [6.3, 14.3]), FIDS by 15.4 pp (95% CI [8.8, 23.4]), and their combination by 26.3 pp (95% CI [18.2, 35.0]), at the cost of also downgrading candidates the undefended model had accepted (a proxy for false rejections), by 12.5, 10.4, and 19.4 pp respectively. No defense eliminates the attacks, training-time and prompt-only defenses have comparable utility costs, and whether these trade-offs carry over to the proprietary models we cannot fine-tune is left to future work.

The Language of Security: How Prompt Syntax Shapes Secure Code Generation in Open LLMs

Large Language Models (LLMs) are increasingly used for source code generation despite their outputs often exhibiting security vulnerabilities. Prior work shows that prompt engineering can mitigate such risks, yet (1) they focused on high-level prompting strategies, neglecting recent evidence that fine-grained syntactic variations can substantially alter model behavior; and (2) predominantly evaluate proprietary LLMs, limiting the applicability of their findings in industrial settings where self-hosted, open models are preferred for privacy, compliance, and deployment control. In this paper, we study how fine-grained syntactic constituents of prompts influence the security of open LLM-generated code. Using a parser-driven approach, we systematically generate syntactic variants of security-relevant code generation prompts and evaluate their impact on code security across multiple open LLMs and programming languages. Our results show that specific syntactic elements, such as constraints, guards, conditions, and concept bindings, and their position within the prompt consistently affect the likelihood of generating insecure code. These findings identify prompt syntax as a concrete security control surface and provide actionable guidance for reducing vulnerability risk in LLM-assisted development.

Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation

Large Language Models are increasingly deployed in Security Operations Centers for log analysis tasks including summarization, alert triage, and threat investigation. These systems ingest logs from external-facing services and process network logs as natural language contexts to generate security insights. We demonstrate that this architectural pattern introduces a critical vulnerability: adversaries can embed prompt injection payloads in log-generating fields that persist in storage and are executed when analysts query the LLM, achieving what we term passive prompt injection. We present LogInject, a systematic framework for evaluating these threats. Using LogInject-1.0, a benchmark of 12,847 log entries including 2,569 adversarial samples, we evaluate three production LLMs across four attack objectives: activity concealment, false positive generation, information exfiltration, and output hijacking. Our findings reveal an up to 88.2% attack success rate (83.4% average across models) under the baseline conditions. We introduce Context Stitching, a novel technique that fragments payloads across multiple log entries to evade stateless filters while exploiting LLM long-context reasoning, achieving a 76.4% success rate. As mitigation, we evaluate layered defenses by combining input filtering, prompt hardening, and output validation, demonstrating a 90.4% attack reduction, although 8.4% residual vulnerability persists. Our results establish that LLM-based log analysis creates an inherent confused deputy vulnerability where untrusted data and trusted instructions compete indistinguishably for model attention, requiring defense in-depth architectures and continued human oversight for security-critical decisions.