First reported aclanthology.org
Research · latest
First reported sciencedirect.com
A systematic analysis of LLM backdoor-integrated cyberattacks: Feasibility, impact factors, and realistic case studies in agent systems
A peer-reviewed study in Applied Soft Computing proposes an LLM backdoor-integrated cyberattack framework with a five-stage attack flow, from poisoned data construction to final execution, and empirically validates it across 5 LLM-based agent configurations and multiple models in realistic scenarios including flight control and database interaction. The authors analyze how backdoor vulnerabilities in LLMs propagate into agent systems and identify six key factors affecting attack success. Details →First reported arxiv.org
The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection
The paper 'The Injection Paradox' by Hyunseok Paeng documents a reproducible failure mode in RAG-based LLM recommendation systems where indirect prompt injections embedded in retrieved documents backfire, suppressing the injected brand below its injection-free baseline. In safety-trained Claude models (e.g., Claude Opus 4.6), a single injected document drops the target brand from a 54% baseline to zero top-2 recommendations and propagates suppression to the brand's uninjected documents, while GPT models instead show increased recommendations. The authors note this enables a reverse-attack scenario where an adversary injects a competitor's documents to suppress that competitor, and release code, prompts, and results. Details →First reported arxiv.org
Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems
CareAttack is a model-centric attack framework that edits the parameters of open-source dense retrievers (Qwen3-Embedding-0.6B and BGE-M3) to promote malicious passages into the top-k retrieved evidence of RAG systems, bypassing detectable corpus-manipulation approaches. Evaluated on three benchmark datasets, it uses conflict-aware retriever editing and attack-preserving anchor repair to inject malicious knowledge for batches of target prompts while preserving behavior on non-target prompts; code is published. Details →First reported acm.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
A SIGIR 2026 paper introduces D-SCAN (Document-level Signal Collapse Analysis), a lightweight detection framework that identifies RAG poisoning attacks by monitoring 'Attention Collapse' — a drop in attention entropy as the generator concentrates on injected adversarial documents. The authors show that output-side signals like perplexity fail because poisoned outputs can exhibit false confidence with even lower perplexity than benign ones, and that D-SCAN detects attacks even when they do not alter the final answer. Code is available at github.com/yingtaoren/D-Scan. Details →First reported arxiv.org
A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
A research paper by Gulshan Saleem and colleagues presents a three-layer middleware framework to defend RAG-based chatbots against both direct and indirect prompt injection, combining input screening, a provenance-based instruction hierarchy during context assembly, and output auditing. Evaluated on 5,080 samples across GPT-4o, Llama 3, and Mistral 7B, the framework reduced Attack Success Rate from 71.4% to 11.3% while maintaining a 4.8% false positive rate and 61.2 ms median latency overhead. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector