2026· International Conference on Security and Cryptography· pp. 807-816· 0 citations· 27 references
Computer Science
TL;DR
LogSanitizer is proposed, a family of input sanitization defenses operating at two levels: a pre-prompt log-transformation pipeline that disrupts trigger patterns in the structured log representation, and a post-tokenizer perturbation strategy that corrupts trigger-bearing token configurations before they reach the model.
Abstract
: The integration of Large Language Models (LLMs) into Security Operations Centers (SOC) introduces a novel cross-layer attack surface that has not been previously studied: adversary-generated log injection (AGLI), where an external attacker sends crafted network packets that are blocked and logged by the firewall, producing structured log entries with attacker-controlled fields. When these logs are forwarded by the SIEM to a trojaned LLM for analysis, the model recognizes the embedded trigger and generates malicious recommendations disguised within legitimate security advice. We propose LogSanitizer, a family of input sanitization defenses operating at two levels: a pre-prompt log-transformation pipeline that disrupts trigger patterns in the structured log representation, and a post-tokenizer perturbation strategy that corrupts trigger-bearing token configurations before they reach the model. We evaluate both approaches against a multidimensional backdoor embedded in Foundation-Sec-8B. Through iterative refinement we addressed three adversarial phenomena discovered during defense development: Out-of-Distribution (OOD) failures from type-altering transformations, pattern collision via entropy loss, and the truncation trap in temporal jittering. The final pre-prompt pipeline achieves complete trigger neutralization (0.0% attack success) with 100.0% task utility retention, while post-tokenizer token substitution at a 10% perturbation rate achieves comparable results on a smaller evaluation sample.
This paper presents a framework for evaluating prompt injection attacks against LLM-based log interpretation using log traces generated during real cyber attacks, and creates adversarial examples through generic injection generation, refinement, and attack-specific optimization.
Max Landauer, F. Skopik, Markus Wurzenberger et al.· arXiv.org· 0 citations
The results establish that LLM-based log analysis creates an inherent confused deputy vulnerability where untrusted data and trusted instructions compete indistinguishably for model attention, requiring defense in-depth architectures and continued human oversight for security-critical decisions.
Rabimba Karanjai, Yang Lu, H. Madhavarao et al.· 2 citations
Evaluation across semantic similarity, distributional consistency, discriminability tests, and structural fidelity shows that LLM-generated logs—particularly using GPT-4o-mini, closely approximate real MHMS activity, enabling safe and scalable experimentation for intrusion-detection research.
Ajeet Kumar, Jatin Manoj Mudiraj, Geeta Yadav· Digital Threats: Research an...· 0 citations
This study designs a comprehensive testbed and a layered defense, Spotlight-Guard, that combines spotlighting-based input isolation, an LLM detection-and-quarantine pipeline, and instruction integrity based on a Hash-based Message Authentication Code into a single framework, and it is evaluated jointly along two axes: security and LLM performance.
Doygun Demirol, Murat Aydoğan· Applied Sciences· 0 citations
Code-level backdoors-stealthy code changes that grant hidden privileges via secret triggers-pose a persistent threat to opensource software. Known attempts to inject such backdoors into widely used projects through malicious commits, tampered release packages, or compromised third-party dependencies, were stopped only by luck and manual review. Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort. In this work, we present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection. Lily integrates a backdoor detection mechanism into (1) CI pipelines to block malicious commits, and (2) release vetting workflows to prevent tampered releases or compromised dependencies from entering large ecosystems, such as Linux distributions. Lily offers two key contributions. First, it enhances CI-compatible fuzzing with the capability to detect triggers of suspicious behavior based on historical and current software executions. This enables fast, precise backdoor detection suitable for both CI and update validation workflows. Second, it combines code change analysis with fuzzing data to precisely point maintainers to backdoor-revealing code regions, even when release updates modify millions of lines of code. We also outline five strategies attackers could use to evade Lily, and evaluate corresponding defenses. Our experiments across hundreds of benign and backdoored commits and releases show that Lily achieves high detection accuracy with low false alarm rates, reliably identifies malicious code, resists adversarial attempts, and would have prevented real-world backdoor incidents.
Dimitrios Kokkonis, M. Marcozzi, Stefano Zacchiroli· arXiv.org· 0 citations
This paper proposes SecureMCP, a policy-enforced framework that integrates Role-Based Access Control with an MCP server to establish multi-layer defense for LLM-generated SQL execution, and evaluates filter performance—false positive rate (FPR) and false negative rate (FNR))—separately from LLM generation quality.
Wonbae Kim, Hee-Kyong Yoo, Nammee Moon· Applied Sciences· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
