2026· Proceedings of the 23rd International Conference on Security and Cryptography· 0 citations· 27 references
TL;DR
LogSanitizer is proposed, a family of input sanitization defenses operating at two levels: a pre-prompt log-transformation pipeline that disrupts trigger patterns in the structured log representation, and a post-tokenizer perturbation strategy that corrupts trigger-bearing token configurations before they reach the model.
Abstract
: The integration of Large Language Models (LLMs) into Security Operations Centers (SOC) introduces a novel cross-layer attack surface that has not been previously studied: adversary-generated log injection (AGLI), where an external attacker sends crafted network packets that are blocked and logged by the firewall, producing structured log entries with attacker-controlled fields. When these logs are forwarded by the SIEM to a trojaned LLM for analysis, the model recognizes the embedded trigger and generates malicious recommendations disguised within legitimate security advice. We propose LogSanitizer, a family of input sanitization defenses operating at two levels: a pre-prompt log-transformation pipeline that disrupts trigger patterns in the structured log representation, and a post-tokenizer perturbation strategy that corrupts trigger-bearing token configurations before they reach the model. We evaluate both approaches against a multidimensional backdoor embedded in Foundation-Sec-8B. Through iterative refinement we addressed three adversarial phenomena discovered during defense development: Out-of-Distribution (OOD) failures from type-altering transformations, pattern collision via entropy loss, and the truncation trap in temporal jittering. The final pre-prompt pipeline achieves complete trigger neutralization (0.0% attack success) with 100.0% task utility retention, while post-tokenizer token substitution at a 10% perturbation rate achieves comparable results on a smaller evaluation sample.
This paper presents a framework for evaluating prompt injection attacks against LLM-based log interpretation using log traces generated during real cyber attacks, and creates adversarial examples through generic injection generation, refinement, and attack-specific optimization.
Max Landauer, Florian Skopik, Markus Wurzenberger et al.· 0 citations
The results establish that LLM-based log analysis creates an inherent confused deputy vulnerability where untrusted data and trusted instructions compete indistinguishably for model attention, requiring defense in-depth architectures and continued human oversight for security-critical decisions.
Rabimba Karanjai, Yang Lu, H. Madhavarao et al.· 2 citations
Multi-Host Multi-Stage (MHMS) cyberattacks are increasingly sophisticated, spanning multiple systems through coordinated stages and evading traditional single-host detection approaches. Such attacks leave correlated traces across diverse log sources, including system, audit, and authentication logs. However, research on MHMS intrusion detection is constrained by the scarcity of realistic multi-host log datasets, as real-world data are difficult to share due to sensitivity and the operational complexity of reproducing attacks in controlled environments. To address this challenge, we present AttackLogGen, a framework for benchmarking Large Language Models (LLMs) in generating realistic MHMS logs. Malicious activities are modeled using the MITRE ATT&CK knowledge base, while benign background behavior is synthesized from generic event patterns across interconnected hosts. Leveraging LLM contextual reasoning, AttackLogGen produces logs tat preserve causal dependencies, temporal ordering, and cross-host interactions characteristic of complex attacks. The framework integrates coordinated modules to generate time-aligned and semantically coherent system behavior. For validation, we built a small-scale MHMS testbed executing end-to-end multi-stage attacks to collect ground-truth logs, complemented by single-system data from the LogHub dataset. Evaluation across semantic similarity, distributional consistency, discriminability tests, and structural fidelity shows that LLM-generated logs—particularly using GPT-4o-mini, closely approximate real MHMS activity, enabling safe and scalable experimentation for intrusion-detection research.
Ajeet Kumar, Jatin Manoj Mudiraj, Geeta Yadav· Digital Threats: Research an...· 0 citations
Large Language Model (LLM)-based agents automate complex tasks by integrating external tools such as web browsers, e-mail clients, file readers, and APIs, but this same integration exposes them to indirect prompt injection (IPI) attacks, in which malicious instructions hidden in tool content hijack the agent. A central but often overlooked question is how defending against such attacks affects the LLM and its own task performance and computational efficiency. In this study, we design a comprehensive testbed and a layered defense, Spotlight-Guard, that combines spotlighting-based input isolation, an LLM detection-and-quarantine pipeline, and instruction integrity based on a Hash-based Message Authentication Code (HMAC) into a single framework, and we evaluate it jointly along two axes: security and LLM performance. Experiments on locally hosted 7B-class open-weight models (Qwen-2.5-7B, Mistral-7B, and DeepSeek-Coder) use Attack Success Rate (ASR) for security and benign-task success rate together with confusion-matrix-based metrics (precision, recall, and F1) for task performance, all with bootstrap 95% confidence intervals. Across a stratified, fixed-seed benchmark of 250 adversarial and 250 benign cases per configuration, the full system reduces the ASR from 36.0% to 17.2% while preserving a 97.2% benign-task success rate and raising the detection F1 from 0.749 to 0.892, demonstrating that strong protection need not degrade the model’s task performance. A component ablation isolates each layer’s contribution, an adaptive-attack evaluation confirms a low ASR (6.7%) under attacks crafted to target the pipeline, and an analysis of computational cost (model invocations per request) quantifies the efficiency overhead, characterizing the security–performance trade-off of layered defenses on open-weight LLMs.
Doygun Demirol, Murat Aydoğan· Applied Sciences· 0 citations
Code-level backdoors-stealthy code changes that grant hidden privileges via secret triggers-pose a persistent threat to opensource software. Known attempts to inject such backdoors into widely used projects through malicious commits, tampered release packages, or compromised third-party dependencies, were stopped only by luck and manual review. Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort. In this work, we present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection. Lily integrates a backdoor detection mechanism into (1) CI pipelines to block malicious commits, and (2) release vetting workflows to prevent tampered releases or compromised dependencies from entering large ecosystems, such as Linux distributions. Lily offers two key contributions. First, it enhances CI-compatible fuzzing with the capability to detect triggers of suspicious behavior based on historical and current software executions. This enables fast, precise backdoor detection suitable for both CI and update validation workflows. Second, it combines code change analysis with fuzzing data to precisely point maintainers to backdoor-revealing code regions, even when release updates modify millions of lines of code. We also outline five strategies attackers could use to evade Lily, and evaluate corresponding defenses. Our experiments across hundreds of benign and backdoored commits and releases show that Lily achieves high detection accuracy with low false alarm rates, reliably identifies malicious code, resists adversarial attempts, and would have prevented real-world backdoor incidents.
Dimitrios Kokkonis, M. Marcozzi, Stefano Zacchiroli· 0 citations
This paper proposes SecureMCP, a policy-enforced framework that integrates Role-Based Access Control with an MCP server to establish multi-layer defense for LLM-generated SQL execution, and evaluates filter performance—false positive rate (FPR) and false negative rate (FNR))—separately from LLM generation quality.
Wonbae Kim, Hee-Kyong Yoo, Nammee Moon· Applied Sciences· 0 citations