Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.
The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.
AbstractLAAF does LPCI red teaming with taxonomy plus stage seeding.
The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
AbstractBlindfold jailbreaks embodied LLMs with action-level proxy planning, and the authors claim it can bypass semantic checks and is effective in both simulation and real-world settings.
Blindfold is a no-box attack against embodied LLM planning modules, rewriting malicious intent into seemingly benign action sequences.
AbstractThought Virus spreads a single-point bias downstream.
Thought Virus puts subliminal prompting into multi-agent communication, to see whether a single-point deviation spreads across the network without naming the target concept.
AbstractSkillJect poisons skills using dual channels and closed-loop refinement.
SkillJect is an automated prompt injection framework targeting installable agent skills. The authors address the problem that malicious instructions placed in publicly available or manually installed skills are often rejected or ignored, yet once a skill is installed, it is repeatedly loaded as trusted guidance.