Jun 2026· 2026 IEEE 2nd International Conference on Electronics, Energy Systems and Power Engineering (EESPE)· pp. 392-396· 0 citations· 11 references
Abstract
Large language model (LLM) applications deployed in regulated and high-risk environments face two coupled runtime risks: input-side prompt injection and output-side content compliance violations. Existing defenses are often either model-centric (alignment or fine-tuning) or application-local (keywords and regex), which limits auditability, policy agility, and cross-model portability. This paper proposes a gateway-centric framework that externalizes safety enforcement into a security side-chain. The framework integrates a unified LLM gateway with an external semantic guardrail service to perform bidirectional inspection before and after model invocation. We formalize the architecture with input-risk and output-compliance functions, define a comprehensive threat model and trust boundary, and present a reproducible evaluation protocol. To validate our approach, a prototype implementation based on LiteLLM and Prisma AIRS was evaluated on a rigorously balanced 2,000-sample adversarial dataset merged from diverse sources, including Deepset, wildjailbreak, and jailbreak-classification. Results demonstrate that the proposed architecture achieves an exceptional balance in detection capability, yielding an F1-score of 0.8322, a recall of 0.8531, and effectively maintaining a low False Positive Rate (FPR), thereby outperforming multiple state-of-the-art baselines including Llama Prompt Guard and Deepset DeBERTa. Furthermore, performance testing confirms practical deployability, showing an average added latency of only 320 ms under a 50-concurrent-user load. The paper concludes by discussing the side-chain advantages over model alignment mechanisms, guardrail bypass risks, and adaptive policy-evolution strategies for enterprise AI governance.
Jailbreak attacks remain a critical threat to the safe deployment of large language models (LLMs). While prior work has primarily studied attacks and defenses at the prompt level, we show that this prompt-centric paradigm overlooks a structural vulnerability in stateful, function-calling environments. In such applications, developer-defined schemas, structured arguments, and untrusted tool outputs are interleaved into a single shared model context. This architecture expands the attack surface by blurring the boundary between trusted control logic and untrusted data, allowing adversarial intent to be distributed across a multi-turn execution path. We exploit this architectural flaw through SMT, a black-box attack framework based on Simulated Moderation Traces. Departing from purely prompt-based interactions, SMT constructs a multi-turn trajectory that simulates a legitimate moderation-auditing workflow. Within this trajectory, a fabricated moderation frame leverages red-team testing as a pretext to elicit harmful generations. The subsequent validation feedback treats safety refusals as execution failures, prompting refinements that gradually weaken the model's safety constraints and ultimately trigger harmful outputs. Extensive empirical evaluations on prominent commercial LLMs from five different providers across two standardized safety benchmarks show that SMT consistently achieves the highest average attack success rate and HarmScore while requiring a near-minimal number of queries, substantially outperforming existing baselines. These findings demonstrate that prompt-level sanitization alone is fundamentally insufficient for defending tool-enabled LLM systems and highlight the urgent need for context-aware validation across schemas, arguments, tool outputs, and accumulated conversation state. The code is available at https://github.com/liujlong27/SMT.
Junlong Liu, Haobo Wang, Weiqi Luo et al.· 0 citations
Vision--Language Models (VLMs) are increasingly deployed through a model supply chain in which pretrained checkpoints, architecture definitions, text encoders, and exported computation graphs are distributed by third parties and reused across downstream services. This reuse model creates a security-critical trust boundary: VLM deployments inherit not only learned parameters but also executable behavior encoded in shared model artifacts. In this paper, we show that a malicious provider can exploit this trust boundary by embedding architectural backdoors into VLM supply chains through representation steering. Our attack introduces dormant steering logic into the model architecture through a trigger-gated additive modification of an intermediate representation, without poisoning training data, controlling downstream fine-tuning, or modifying prompts at deployment time. When the trigger is absent, the modification reduces to zero and the model follows its normal computation, preserving clean utility. When the trigger is present, a steering direction shifts the internal representation toward an attacker-defined objective. We evaluate the attack across multiple VLM families and downstream tasks, including visual question answering, text-to-image generation, retrieval, and semantic response biasing. The results show that the proposed architectural steering backdoor compromises integrity, safety enforcement, and ranking fairness while preserving normal behavior on clean inputs. We further show that shared VLM artifacts can carry dormant steering logic against downstream services, and we propose an auditing defense that inspects the executable logic distributed with model artifacts rather than only their learned weights.
M. Briglia, Igor Maljkovic, A. E. Cinà et al.· 0 citations
Large language models (LLMs) are increasingly embedded as core components of data-centric systems, supporting analytical decision making, and automated reasoning over large-scale, heterogeneous datasets. Yet their deployment in open-world environments raises fundamental challenges to security and trustworthiness: LLMs can leak sensitive data, fall prey to prompt injection and jailbreaks, generate misinformation, and behave unpredictably under adversarial inputs, failures that propagate through data pipelines and affect downstream decisions. The rise of LLM-based agents further amplifies these risks through unsafe tool use and autonomous decision-making. The 2nd SeT-LLM Workshop on Secure and Trustworthy Large Language Models brings together researchers and practitioners from data mining, machine learning, security, and responsible AI to address these issues from a data-centric, system-level perspective, spanning robust defenses, trustworthy evaluation, privacy and copyright protection, robustness, alignment and safety, agent security, and high-stakes applications. Through invited talks, contributed papers, a poster session, and a panel discussion, the workshop prioritizes early-stage ideas, system experiences, and open problems across the lifecycle of LLM-based systems.
Lu Lin, Jinghui Chen, Ting Wang et al.· Proceedings of the 32nd ACM...· 0 citations
Configuring 5G networks through standardized exposure interfaces—the Network Exposure Function (NEF) and the Common API Framework (CAPIF)—remains operationally burdensome, requiring manual navigation of 3 GPP parameter schemas, OAuth2 authentication, and live network state. This paper presents a modular, intent-driven architecture that translates natural language operator goals into schema-compliant NEF API configurations using a compact, locally deployed Large Language Model (LLM), Qwen3-4B (4 billion parameters). A deterministic pre-classification layer reserves LLM inference for semantically complex requests, while a six-stage pipeline produces near-deterministic, conflict-aware JSON output. Two complementary validation paths are provided: a Standard Mode with closed-loop Quality of Service (QoS) feedback via a NEF emulator, and a Free5GC Mode that validates the same translation logic against a Free5GC-based experimental environment with real user-plane traffic. Demonstration across five vertical scenarios confirms end-to-end correctness in both the emulated NEF environment and the Free5GC-based experimental environment.
Hao You, Chathura Galkandage, Naércio Magaia et al.· IEEE Conference on Network S...· 0 citations
The deployment of large language models (LLMs) in real-world applications introduces a compounding security problem: detecting adversarial inputs such as prompt injection and jailbreak-driven data leakage while simultaneously preventing the detection mechanism itself from becoming a source of data exposure. Existing approaches address either detection effectiveness or privacy preservation, but rarely both in a unified, deployable architecture. This paper proposes and evaluates a privacy-preserving hybrid middleware architecture that enforces a local trust boundary as its primary design constraint. The architecture combines deterministic rule-based screening, a fine-tuned small language model (SLM) operating entirely within the local processing environment, and a sensitivity-aware routing mechanism that invokes external LLM reasoning only for prompts all local components have assessed as non-sensitive. Evaluation on a 120-prompt benchmark spanning benign, jailbreak, and sensitive categories (including 20 hard negatives constructed to be lexically adjacent to genuine secrets) shows that the routed architecture attains 95.83% accuracy with complete recall, retaining 95% of sensitive prompts within the local boundary, at the cost of a 12.5% false-positive rate. Comparison against two published detectors reveals a systematic asymmetry: an injection-specific classifier reaches 82.5% recall on jailbreak prompts but 25% on sensitive ones, while a content-safety model inverts that profile, confirming empirically that the two risks are addressed separately by current tooling. The framework is model-agnostic, requires no retraining of the underlying LLM, and is compatible with black-box API deployments. The evaluation dataset and fine-tuned model are released publicly.
Adam Ait Hsine, A. Arabo· Electronics· 0 citations
The Model Context Protocol (MCP) is an open source JSON-RPC protocol that standardizes how large language models (LLMs) interact with external systems through programmatic functions known as tools. Attackers or malicious agents can exploit certain modalities of these MCP tools to degrade the overall quality of service of agent-based applications. For example, an agent may request an excessively large search radius or very long videos, overloading backend systems and potentially causing slowdowns or denial-of-service. Each modality including text, images, video, and location introduces distinct vectors for resource abuse, complicating the development of consistent mitigation strategies. Moreover, multimodal and crossdomain tools expose diverse request schemas and parameters, making it difficult to define policies that are both generalizable and precise enough to enforce meaningful resource constraints. In this paper, we present AEGIS, a policy enforcement component that enables administrators to define fine-grained safeguards against resource abuse across heterogeneous MCP tools and modalities. AEGIS leverages the reasoning capabilities of large language models to analyze, categorize, and normalize diverse tool invocations into a unified, policy-friendly representation accessible to security practitioners. Integrated with the Open Policy Agent and the ContextForge AI Gateway, AEGIS detects and mitigates abusive behaviors while preserving the flexibility of MCP-based agent ecosystems.