TensorCommitments proposes a tensor-native proof-of-inference scheme for verifiable LLM inference, reducing the need for trust in remote GPU execution and improving robustness to LLM attacks.

This paper explores a novel method of inducing vulnerabilities in large language models (LLMs) using 'drunk language', which can lead to jailbreaking and privacy leaks. The researchers found that LLMs are more susceptible to these vulnerabilities than previously reported approaches.

Researchers evaluated 7 TDD methods on 8 CodeLLMs, introducing CodeSnitch, a function-level benchmark dataset. The study assessed robustness under code clone detection taxonomy.

Researchers propose UniGuardian, a training-free detector for Large Language Models (LLMs) that identifies prompt injection, backdoor, and adversarial attacks without knowing the attack type. UniGuardian measures how prompt perturbations shift the model's output distribution and uses a single-forward strategy for efficient detection and text generation.

Researchers propose POEF, an automated red-teaming framework to bridge the intent-behavior gap in LLM-based robot jailbreaks, demonstrating an 80% behavior jailbreak success rate.

KaliBench is a fine-grained benchmark for evaluating the ability of language models to generate executable commands for real-world cybersecurity tools. It includes 8,504 query-command pairs across 1,642 tools and enables precise and reproducible assessment of tool selection and argument construction.

SourceLearn, a new learning mechanism for developing reusable source-specific competence in large language model agents, improves understanding of persistent authoritative sources by representing this competence with a persistent source model and using two complementary learning mechanisms: Self-Directed Source Learning and Task-Guided Source Learning.

Researchers introduced Latent Frequency Masking, an attack that erases AI-generated image watermarks by manipulating the image's latent representation. The attack preserves image quality and is more efficient than existing methods. This highlights the need for robust watermarking methods and includes latent-frequency manipulation in security evaluations.

Researchers introduced VeriSpec, a novel approach to detect inconsistencies in model specifications using large language models as verifiers. VeriSpec extracts rules from the specification text, clusters related rules, and applies LLM-as-verifier reasoning to identify inconsistencies. The approach achieved high precision and efficiency in detecting defects in the OpenAI Model Spec, outperforming several baselines.

A new attack vector has been discovered that allows attackers to hijack LLM agents by chaining skills together to induce false claims of user approval. This can be done by creating a record of task progress that is used by downstream skills to direct the attacker-selected action.

A study finds that safety routing in LLMs can be broken by distribution shift and that the current evaluation methods may not accurately reflect the true safety of the models. The study suggests that safety routing should be evaluated under shift and against a baseline chosen without test labels, and that recognition-based defenses should be scored on harm against an attacker who chooses what the model sees.

Researchers propose a new approach to mitigating model collapse in iterative fine-tuning using a non-parametric entropy rate estimator. The approach does not require a model or external data and shows significant improvements in text diversity metrics.

The paper introduces PACE, a system for enforcing capability enforcement in tool-using LLM agents. It mediates every tool call before execution, verifying schema-defined effects against authority and preventing malicious influence. PACE shows significant security gains in agent-security benchmarks, with full-benchmark native utility losing at most three points relative to the undefended agent.

MOMAT is a low-power defense framework for quantized large language models (qLLMs) against jailbreak attacks. It uses a mixture of multiple atlases to retrieve and evaluate similarity features from a lightweight MoE detector, accelerating retrieval with a CiM-accelerated similarity engine. MOMAT achieves a 4.69 million times speedup and 2.5 million times energy reduction over DRAM-based baselines, making edge-deployed qLLMs safer and more energy-efficient.

A study of open-source LLM-based multi-agent systems identifies common issues, their causes, and potential solutions. The most common issue is orchestration and execution, with causes including workflow problems, tool integration issues, and memory problems. The study suggests optimizing workflows as a solution.

Researchers introduce the concept of memetic trojans, a type of attack that exploits agents' tendency to retransmit and amplify content, potentially leading to network-wide exposure. The study finds that these attacks can be highly effective, with some simulations showing a 3.19x amplification of exposure.

Researchers developed DART, a runtime framework that detects and attributes representation shifts in multi-turn LLM agents, reducing attack success rates and outperforming existing defenses. The framework uses denoising to identify and intervene in potentially harmful behavior.

Proof-Gated Signing (PGS) is a method to prevent AI agents from proposing harmful transactions by simulating the transaction's effects and using an SMT solver to check a declarative value-and-permission policy. PGS has been tested on 260 scenarios and prevented 93.6% of harmful scenarios while passing 97.5% of benign ones.

The paper proposes a claim-anchored execution contract to address the issue of unverified claims in tool-agent auditing. The contract binds claims, evidence, and execution to ensure the integrity of tool usage. It exposes seven testable properties and achieves high attack-detection rates.

A new access control mechanism, Locket, is proposed to prevent private data leakage in large language models (LLMs) by embedding fine-grained access control into LLM generation. Locket trains lightweight adapters with distinct access policies and a gating module to associate a learned keyed entry token with a specific adapter, ensuring compatibility with off-the-shelf LLMs and satisfying regulatory and privacy requirements.