TSA: A Two-Stage Jailbreak Attack Exploiting Logical Consistency of Large Language Models

A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks

Large language models (LLMs) remain vulnerable to jailbreak attacks that exploit techniques such as role-playing, obfuscation, code transformation, and multi-step indirection to elicit harmful outputs. As jailbreak strategies keep emerging, defenses have proliferated in an ongoing cat-and-mouse game, yet most remain static: their safety behavior is fixed at deployment, so they cannot accumulate defensive experience or adapt to unseen strategies. We propose a self-evolving test-time defense built around a persistent, cross-interaction rule memory: when an attack succeeds, the framework abstracts that failure into a method-level rule capturing the structural attack wrapper rather than the harmful topic, and reuses it against future inputs. Because rules are method-level, one induced rule generalizes across an entire attack family, and the label space expands as novel wrappers appear. The mechanism operates entirely through external memory and prompting, with no parameter updates, and applies to both open-weight and black-box API models. We realize it as four cooperating modules, but the contribution is the memory-based adaptation mechanism, not the module decomposition. Across four black-box jailbreak families and multiple models, our method substantially reduces attack success rates while preserving benign utility, remains robust under an adaptive composite-wrapper attack, and does not increase over-refusal as the memory grows.

Large Language Model Vulnerabilities

DeepSeek Under Attack: An Analysis of Jailbreak Attacks and Prompt-Level Defenses

The reasoning model DeepSeek-R1 was more susceptible to jailbreak attacks than the non-reasoning model DeepSeek-V3, and different prompt-level defenses were effective against static jailbreaks.

On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models

A four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers is contributed, and seven open problems centered on containment are identified.

Recent Advances and Open Challenges in Mitigating Inference-Time Attacks on Large Language Models

A defense taxonomy spanning three axes, namely prompt-level, inference-time, and training-time interventions, is proposed, within which 30 mitigation mechanisms published from 2024 onwards are systematically analyzed, demonstrating that no single defense mechanism provides comprehensive protection, and that robust deployment mandates layered, complementary strategies.

AI security beyond core domains: resume screening as a case study of adversarial vulnerabilities in specialized LLM applications

Large Language Models (LLMs) are increasingly used to automate high-stakes screening decisions, yet they can be manipulated by adversarial instructions hidden in the documents they evaluate. This paper introduces a benchmark for this vulnerability in LLM-based resume screening: 463 job-candidate pairs drawn from a 14-domain corpus, with the evaluated sample covering 13 domains, attacked through a taxonomy of four attack types and four injection positions (16 attack configurations). Across 12 model configurations covering open-weight and proprietary models, some attack types exceed 80% attack success rate (ASR) when the injected content reaches the model, and attacks upgrade up to 73.4% of candidates unanimously rejected by human annotators. The hidden-content attacks assume the resume text or HTML reaches the model; an end-to-end parser-layer analysis shows that style-aware sanitization removes most of them before classification, whereas visible-text attacks survive. We evaluate prompt-based defenses on all 12 model configurations and our proposed FIDS (Foreign Instruction Detection through Separation), a fine-tuning defense, on Qwen3-8B, the one base model we could fine-tune. On Qwen3-8B, in paired configuration-level comparisons against a common no-defense baseline, prompt-based defense reduces ASR by 10.1 percentage points (pp; 95% bootstrap CI [6.3, 14.3]), FIDS by 15.4 pp (95% CI [8.8, 23.4]), and their combination by 26.3 pp (95% CI [18.2, 35.0]), at the cost of also downgrading candidates the undefended model had accepted (a proxy for false rejections), by 12.5, 10.4, and 19.4 pp respectively. No defense eliminates the attacks, training-time and prompt-only defenses have comparable utility costs, and whether these trade-offs carry over to the proprietary models we cannot fine-tune is left to future work.