Aug 2026· Electronics· Vol 15, pp. 3739· 0 citations· 25 references
TL;DR
This work proposes Architectural Intent Collapse (AIC), a formal framework capturing the systematic loss of communicative intent when text from heterogeneous sources is flattened into a single context window, and introduces Intent Separation Degree (ISD) as a measurable metric.
Abstract
Tool-level attacks on Large Language Model (LLM) agents—poisoned tool descriptions, prompt injection, and capability misrepresentation—are universally effective, yet no existing defense provides comprehensive protection. We propose Architectural Intent Collapse (AIC), a formal framework capturing the systematic loss of communicative intent when text from heterogeneous sources is flattened into a single context window. Grounded as a novel instantiation of the Confused Deputy Problem, AIC reveals that the missing boundary is not permission but intent: the architecture cannot distinguish descriptive statements from prescriptive commands. We formalize AIC via an architectural collapse operator, introduce Intent Separation Degree (ISD) as a measurable metric, and develop a mechanism-based taxonomy of five intent-disguise attack types, including two previously undescribed (Conditional Latency and Inference Inducement). Experiments across 25 framework–model combinations (employing GPT-4o, Claude-4-Sonnet, Gemini-2.5-Pro, DeepSeek-V3, and Qwen3-32B as LLM backends) confirm that ISD degrades with description verbosity, strongly predicts defense effectiveness (r=−0.97), and is uniformly low across all current frameworks. Three root-cause defense principles are derived; one retains substantial protection against adaptive attackers. This research is useful for agent framework designers, security practitioners, and researchers seeking a principled understanding of why tool-level attacks succeed and how architectural defenses can address their root cause.
Puppet is developed, the first automated security evaluation framework that enriches benign tool descriptions through selective requirement engineering to maximize semantic expressiveness, restructures them into LLM-preferred formats using description schema transformation, and applies name prioritization to introduce complementary lexical bias.
Zhiyuan Li, Jingzheng Wu, Yuhao Peng et al.· ACM Transactions on Software...· 0 citations
This paper formalizes the structure of prompt-injection artifacts, enabling defenders, red teamers, and cyber threat intelligence (CTI) teams to label, compare, and mutate attacks without relying on fragile string matching.
This paper presents ToolGuardian, a policy-driven framework for securing agent-tool interactions through pre-admission vetting and task-aware runtime authorization, and compares ASP against heuristic and LLM-based policy realizations using identical inputs and output contracts.
Large language models (LLMs) are increasingly deployed in safety-critical applications, yet jailbreak attacks can conceal harmful intent through role-playing, fictional scenarios, or seemingly benign motivations. Existing inference-time defenses may miss disguised attacks or excessively refuse legitimate requests. We propose SRD-GUARD, a parameter-free, black-box defense framework that exposes concealed intent through semantic rewriting and consensus-based risk assessment. Given an input prompt, SRD-GUARD generates five semantically related rewrites that preserve the underlying objective while removing unnecessary contextual packaging. The original prompt and rewrites are jointly evaluated by multiple independent LLM-based safety scorers on a continuous risk scale. A decision module combines absolute risk thresholds with relative risk changes between the original and rewritten prompts to adaptively intercept, preserve, or warn on requests. We evaluate SRD-GUARD against UNIATTACK, CIPHER, and DeepInception on Llama-3-8B-Uncensored and DeepSeek-V4-Flash using AdvBench and OR-Bench-Hard. SRD-GUARD achieves average DSRs of 91.44% and 100%, with ORRs of 8.00% and 12.00%, respectively. Compared with evaluated baselines, it provides a more favorable DSR--ORR trade-off. Ablation studies show that rewriting exposes concealed harmful intent, joint scoring improves robustness to individual evaluator behavior, and risk-adaptive decision making enables selective handling of ambiguous inputs. These results demonstrate that semantic intent exposure, consensus-based risk assessment, and relative-risk-aware routing provide an effective and selective approach to black-box jailbreak defense. The artifact is available at https://anonymous.4open.science/status/CICD-Guard-D648.
Large language model (LLM) agents extend generative models with planning, memory, and external tool access, but
this capability creates a security path in which untrusted content can alter instructions, hijack an agent's operational goal, and
trigger harmful tool actions. This paper proposes TRACER-AI, a four-layer explainable defense-in-depth framework that
combines (i) semantic prompt-injection detection, (ii) continuous goal-integrity monitoring, (iii) contextual tool-risk control, and
(iv) structured explainable security decisions. The framework is designed around the attack progression prompt injection -> goal
hijacking -> tool misuse rather than treating prompt filtering as the only enforcement boundary. A dynamic risk score fuses
prompt-injection probability, goal deviation, tool risk, and contextual anomaly before action execution. A controlled proof-ofconcept evaluation was conducted on a 3,500-case synthetic adversarial testbed containing benign interactions and five attack
families: direct prompt injection, indirect prompt injection, goal hijacking, tool misuse, and chained attacks. The held-out test set
comprised 1,050 cases with previously unseen attack wording and benign security-text decoys. The standalone prompt detector
achieved 0.679 accuracy, 0.575 F1-score, and 0.760 ROC-AUC, illustrating the weakness of relying on prompt detection alone
under distribution shift. In contrast, the full TRACER-AI configuration achieved a 96.4% attack detection rate, reduced attack
success rate to 3.6%, preserved 99.0% benign task success, and limited false positives to 1.0% in the controlled testbed. The
results support the central hypothesis that agent security benefits from multiple independent checkpoints spanning instruction
intake, goal continuity, and execution-time tool authorization. The study also maps the framework to contemporary agentic-AI
security guidance and benchmark research, and provides a reproducible experimental protocol for subsequent validation on
AgentDojo, InjecAgent, AgentDyn, and domain-specific agent benchmarks.
Pallavi Singh, Khushboo Gupta, Pratibha Singh· International Journal for Re...· 0 citations
: Large language models are increasingly being deployed in safety-critical domains, yet remain vulnerable to jailbreak attacks that circumvent safety alignments. This systematic review synthesizes empirical jailbreak research published between 2024 and 2025, using a PRISMA-guided search protocol, followed by BERTopic-based topic modeling. The analysis identifies eight main jailbreak categories: optimization-based, ge-netic/evolutionary, iterative refinement, semantic/persuasion-based, decomposition, context/generation-level, visual/encoding and fuzzing attacks, and characterizes their effectiveness, efficiency, and transferability across open-source and proprietary models, including Llama-2/3, Vicuna, GPT-3.5/4, Claude, Gemini, and DeepSeek-V3. Results show that simple configuration and context-level attacks can match the near-perfect attack success rates of sophisticated white-box optimization methods on models such as Llama-2, while requiring far fewer queries and no parameter access, highlighting a gap between research focus and practical threat severity. The review further identifies five recurring vulnerability mechanisms: representation-level gaps, execution-priority manipulation, semantic fragmentation, gradient-space exploitation and persuasion susceptibility, and documents family-specific vulnerability patterns, with open-source Llama-based models consistently more exposed than safety-enhanced architectures such as Claude. Diverse methods, uneven focus on models and publication bias limit how broadly results apply. Nonetheless, the review reveals that weaknesses in safety alignment persist across successive LLM generations, urging that effective defenses must address all eight attack categories rather than isolated techniques.
Meda Račaitytė, Hélder Bastos, R. Ribeiro et al.· International Conference on...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
