Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces

LogSanitizer: Defending LLM-Integrated SOCs against Backdoor Triggers Delivered through Firewall Logs

LogSanitizer is proposed, a family of input sanitization defenses operating at two levels: a pre-prompt log-transformation pipeline that disrupts trigger patterns in the structured log representation, and a post-tokenizer perturbation strategy that corrupts trigger-bearing token configurations before they reach the model.

Breaking the Assumptions: Auditing Input-Side Jailbreak Defenses Against Semantic Attacks

Locally deployed Large Language Models (LLMs) via inference engines such as Ollama run without the moderation and abuse detection present in API-served models. Therefore, the safety of LLMs depends on the defense mechanisms used, and their effectiveness depends on the assumptions on which they were designed. This paper does an audit of defense mechanisms under jailbreak attacks on locally deployed models. Some defenses provide formal guarantees (SmoothLLM, Erase-and-Check, Sequential Monitors), while others rely on empirical detection results (Semantic Smoothing, Self-Denoised Smoothing, Perplexity Filtering). Instead of merely observing that defenses fail, we trace each failure back to the specific assumption: for every defense, we extract the condition it relies on, derive the empirical pattern a violation should produce, and test that prediction on six open-weight models (14B to 35B parameters) with a corpus of 100 jailbreak prompts taken from more than 40 public sources, totalling 13,800 evaluation records.

Confused Deputy Attack Against Model Context Protocol

The model context protocol (MCP) has rapidly emerged as a standard framework for integrating large language models (LLMs) with external tools and resources. However, its metadata-driven and non-deterministic tool selection mechanism introduces a previously overlooked security threat. Leveraging this weakness, we uncover the confused deputy attack, where an adversarial server with subtly manipulated metadata covertly overshadows a benign one, intercepting tool invocations without exhibiting overtly malicious behavior. To systematically study this threat, we develop Puppet, the first automated security evaluation framework that: (i) enriches benign tool descriptions through selective requirement engineering to maximize semantic expressiveness, (ii) restructures them into LLM-preferred formats using description schema transformation, and (iii) applies name prioritization to introduce complementary lexical bias. Furthermore, Puppet synthesizes valid user queries to enable systematic attack evaluation. We comprehensively evaluate Puppet across 14 models from 6 providers on 2 MCP hosts, demonstrating tool selection hijacking rates up to 90.89% and end-to-end malicious payload execution rates up to 86.46%, while remaining undetectable by representative security scanners (MCP-Scan and McpSafetyScanner), which are architecturally incapable of detecting metadata-level manipulation attacks. Counterintuitively, we find that reasoning-enabled models are significantly more vulnerable than their non-reasoning counterparts. Our findings expose a critical design-level attack surface in the MCP ecosystem and highlight the urgent need for principled security safeguards.

The Anatomy of a Prompt Injection: A Component Model for Structured Analysis

This paper formalizes the structure of prompt-injection artifacts, enabling defenders, red teamers, and cyber threat intelligence (CTI) teams to label, compare, and mutate attacks without relying on fragile string matching.

Large Language Model Vulnerabilities

A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks

This work proposes a self-evolving test-time defense built around a persistent, cross-interaction rule memory that substantially reduces attack success rates while preserving benign utility, remains robust under an adaptive composite-wrapper attack, and does not increase over-refusal as the memory grows.