Agentic AI Security Papers: Big Four Conferences (2020–2025)

Overview

This repository contains an exhaustive collection of 77 papers from the Big Four cybersecurity conferences (IEEE S&P, USENIX Security, NDSS, and ACM CCS) addressing security and privacy challenges in agentic AI systems. These papers span foundational work on large language models (LLMs), voice assistants, AI agents, code completion systems, and generative AI applications.

The papers are categorized by their primary security problem. Each entry includes a concise summary grounded in the paper abstract and first-page framing, with exact title wording normalized where needed. A method matrix at the end summarizes the main approaches used across the corpus.

---

I. Prompt Injection & Manipulation Attacks

1. DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks

Conference: IEEE S&P 2025
Summary: Proposes a game-theoretic framework for detecting prompt injection attacks in LLM applications, modeling the interaction between attackers and defenders as a strategic game to identify malicious inputs before execution.

2. Formalizing and Benchmarking Prompt Injection Attacks and Defenses

Conference: USENIX Security 2024
Summary: Establishes formal definitions and evaluation benchmarks for prompt injection attacks and defenses, providing a standardized methodology for assessing LLM vulnerability to instruction manipulation.

3. Prompt Inversion Attack Against Collaborative Inference of Large Language Models

Conference: IEEE S&P 2025
Summary: Demonstrates attacks that invert prompts in distributed LLM inference scenarios where models collaborate across multiple servers, exposing vulnerabilities in federated inference architectures.

4. Optimization-based Prompt Injection Attack to LLM-as-a-Judge

Conference: ACM CCS 2024
Summary: Presents optimization-based techniques to craft prompts that manipulate LLMs when used as evaluators or judges in automated systems, demonstrating vulnerabilities in LLM-based decision-making pipelines.

5. Make a Feint to the East While Attacking in the West: Blinding LLM-Based Code Auditors with Flashboom Attacks

Conference: IEEE S&P 2025
Summary: Introduces "Flashboom" attacks that use obfuscation and misdirection to blind LLM-based code auditing systems into missing vulnerabilities, exploiting attention and reasoning limitations.

6. ImportSnare: Directed 'Code Manual' Hijacking in Retrieval-Augmented Code Generation

Conference: ACM CCS 2025
Summary: Attacks retrieval-augmented generation (RAG) systems by poisoning code documentation and retrieval indexes to inject malicious code suggestions into LLM-assisted code generation.

---

II. Jailbreaking & Safety Bypass Attacks

7. MASTERKEY: Automated Jailbreaking of Large Language Model Chatbots

Conference: NDSS 2024
Summary: Develops automated techniques to systematically generate jailbreak prompts that bypass safety mechanisms in LLM chatbots, revealing the brittleness of defense mechanisms.

8. "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models

Conference: ACM CCS 2024
Summary: Analyzes real-world jailbreak prompts found in the wild, categorizes attack patterns, and evaluates their effectiveness across multiple LLM systems to understand practical attack landscapes.

9. Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models

Conference: USENIX Security 2024
Summary: Comprehensively studies jailbreak prompt patterns and mechanisms, including instruction override, role-playing, and indirect refusal, to understand how safety training can be circumvented.

10. Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-to-Image Generation Models

Conference: IEEE S&P 2025
Summary: Combines fuzzing with LLM-based agents to automatically discover and systematize jailbreak attacks on text-to-image generation models, revealing multimodal safety gaps.

11. SurrogatePrompt: Bypassing the Safety Filter of Text-to-Image Models via Substitution

Conference: ACM CCS 2024
Summary: Uses LLMs and image-to-text modules to systematically substitute risky prompt segments and generate attack prompts that bypass closed-source text-to-image safety filters.

12. Here Comes the AI Worm: Preventing the Propagation of Adversarial Self-Replicating Prompts Within GenAI Ecosystems

Conference: ACM CCS 2025
Summary: Studies self-replicating adversarial prompts in generative AI systems that propagate across ecosystems, proposing mitigation strategies for containing prompt-based worms.

---

III. Prompt & Data Leakage Attacks

13. PLeak: Prompt Leaking Attacks against Large Language Model Applications

Conference: ACM CCS 2024
Summary: Demonstrates practical prompt leakage attacks that extract hidden system prompts and instructions from LLM applications through adversarial queries and inference-time manipulation.

14. On the Effectiveness of Prompt Stealing Attacks on In-the-Wild Prompts

Conference: IEEE S&P 2025
Summary: Evaluates the effectiveness of prompt stealing techniques on real-world LLM applications, identifying high success rates and practical implications for prompt confidentiality.

15. I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving

Conference: NDSS 2025
Summary: Discovers prompt leakage vulnerabilities in multi-tenant LLM serving systems where key-value caches are improperly shared, exposing one tenant's prompts to another.

16. What Was Your Prompt? A Remote Keylogging Attack on AI Assistants

Conference: USENIX Security 2024
Summary: Recovers encrypted AI-assistant responses through a token-length side channel and uses LLM-based reconstruction to infer the underlying content.

17. Prompt Inference Attack on Distributed Large Language Model Inference Frameworks

Conference: ACM CCS 2025
Summary: Exploits distributed inference architectures to infer user prompts through model behavior analysis and information leakage across inference nodes.

18. You Can't Steal Nothing: Mitigating Prompt Leakages in LLMs via System Vectors

Conference: ACM CCS 2025
Summary: Proposes "system vectors" as a defense mechanism to prevent prompt leakage in LLMs by obfuscating or separating prompt information from model computations.

19. Analyzing Leakage of Personally Identifiable Information in Language Models

Conference: IEEE S&P 2023
Summary: Analyzes and quantifies the leakage of personally identifiable information (PII) from language models, demonstrating privacy risks in pre-trained and fine-tuned models.

20. Extracting Training Data from Large Language Models

Conference: USENIX Security 2021
Summary: Presents methods to extract verbatim training data from LLMs through iterative prompting, establishing fundamental privacy risks in language model memorization.

21. AirGapAgent: Protecting Privacy-Conscious Conversational Agents

Conference: ACM CCS 2024
Summary: Proposes an architecture to protect privacy-sensitive information in conversational agents through air-gapped processing and minimized information retention.

---

IV. Backdoor & Trojan Attacks

22. BAIT: Large Language Model Backdoor Scanning by Inverting Attack Target

Conference: IEEE S&P 2025
Summary: Develops a scanning technique to detect backdoors in LLMs by inverting attack targets, enabling identification of hidden trigger-response pairs in potentially compromised models.

23. Instruction Backdoor Attacks Against Customized LLMs

Conference: USENIX Security 2024
Summary: Demonstrates backdoor attacks on customized and fine-tuned LLMs through instruction poisoning, showing vulnerabilities in model personalization pipelines.

24. LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors

Conference: NDSS 2024
Summary: Proposes defenses against task-agnostic backdoors in prompt-tuned models, introducing sanitization techniques to remove backdoor triggers while preserving model utility.

25. The Philosopher's Stone: Trojaning Plugins of Large Language Models

Conference: NDSS 2025
Summary: Demonstrates trojan attacks on LLM plugins and extensions, showing how attackers can inject malicious logic into plugin ecosystems that integrate with language models.

26. Safety Misalignment Against Large Language Models

Conference: NDSS 2025
Summary: Studies misalignment attacks that exploit divergence between a model's stated safety values and its actual behavior, enabling targeted backdoor and adversarial attacks.

27. Two-in-One: A Model Hijacking Attack Against Text Generation Models

Conference: USENIX Security 2023
Summary: Presents model hijacking attacks that enable attackers to control text generation model outputs by embedding triggers during training or fine-tuning.

---

V. Code Generation & Developer Security

28. Poisoned ChatGPT Finds Work for Idle Hands: Exploring Developers' Coding Practices with Insecure Suggestions from Poisoned AI Models

Conference: IEEE S&P 2024
Summary: Investigates how developers use code suggestions from AI assistants and demonstrates that poisoned models can reliably introduce security vulnerabilities into developer workflows.

29. You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion

Conference: USENIX Security 2021
Summary: Demonstrates data poisoning attacks on neural code completion systems, showing how malicious training data can introduce vulnerabilities into code suggested by AI assistants.

30. Lost at C: A User Study on the Security Implications of Large Language Model Code Assistants

Conference: USENIX Security 2023
Summary: Conducts user studies to understand how developers interact with LLM-based code assistants and whether their usage leads to insecure coding practices.

31. Do Users Write More Insecure Code with AI Assistants?

Conference: ACM CCS 2023
Summary: Empirically measures whether users produce more security-vulnerable code when using AI code assistants compared to traditional development workflows.

32. Large Language Models for Code: Security Hardening and Adversarial Testing

Conference: ACM CCS 2023
Summary: Proposes techniques to harden LLM-generated code against attacks and introduces adversarial testing methods to evaluate LLM security code generation capabilities.

33. PromSec: Prompt Optimization for Secure Generation of Functional Source Code with Large Language Models (LLMs)

Conference: ACM CCS 2024
Summary: Develops prompt optimization techniques that guide LLMs to generate functionally correct and secure code, improving code quality in LLM-assisted development.

34. Give LLMs a Security Course: Securing Retrieval-Augmented Code Generation via Knowledge Injection

Conference: ACM CCS 2025
Summary: Proposes injecting security knowledge into RAG systems for code generation to improve the security properties of LLM-generated code suggestions.

35. Codebreaker: Dynamic Extraction Attacks on Code Language Models

Conference: IEEE S&P 2025
Summary: Presents dynamic extraction attacks that recover sensitive code and algorithmic information from code language models through strategic querying.

---

VI. Voice Assistant Security

36. Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems

Conference: USENIX Security 2020
Summary: Demonstrates laser-based audio injection attacks on voice assistants, enabling attackers to issue commands without acoustic detection.

37. SkillExplorer: Understanding the Behavior of Skills in Large Scale

Conference: USENIX Security 2020
Summary: Provides comprehensive analysis of voice assistant skills/plugins, identifying security risks in third-party skill ecosystems and misuse potential.

38. Void: A Fast and Light Voice Liveness Detection System

Conference: USENIX Security 2020
Summary: Proposes a lightweight liveness detection system for voice assistants to detect and mitigate replay and spoofing attacks.

39. Hey Alexa, is this Skill Safe?: Taking a Closer Look at the Alexa Skill Ecosystem

Conference: NDSS 2021
Summary: Analyzes the Alexa skill ecosystem to identify security flaws in skill vetting processes, revealing vulnerable and malicious skills.

40. EarArray: Defending Against DolphinAttack via Acoustic Attenuation

Conference: NDSS 2021
Summary: Proposes acoustic-level defenses against ultrasonic attacks on voice assistants through selective frequency attenuation.

41. GhostTalk: Interactive Attack on Smartphone Voice System Through Power Line

Conference: NDSS 2022
Summary: Demonstrates an interactive attack on smartphone voice systems that leverages power-line coupling rather than a nearby speaker to issue unauthorized commands.

42. FakeWake: Understanding and Mitigating Fake Wake-up Words of Voice Assistants

Conference: ACM CCS 2021
Summary: Studies false wake-word triggers in voice assistants and proposes mitigation techniques to improve wake-word recognition accuracy and robustness.

43. CapSpeaker: Injecting Voices to Microphones via Capacitors

Conference: ACM CCS 2021
Summary: Demonstrates hardware-level attacks on microphones via capacitive coupling to inject malicious audio commands into voice assistants.

44. Learning Normality is Enough: A Software-Based Mitigation against Inaudible Voice Attacks

Conference: USENIX Security 2023
Summary: Proposes software-based defenses against ultrasonic and inaudible voice attacks by learning normal audio patterns and detecting anomalies.

45. Dangerous Skills Got Certified: Measuring the Trustworthiness of Skill Certification in Voice Personal Assistant Platforms

Conference: ACM CCS 2020
Summary: Analyzes skill certification processes in voice assistants, demonstrating that dangerous skills can be certified and deployed to users.

---

VII. Model Poisoning & Training Data Attacks

26. Spinning Language Models: Risks of Propaganda-as-a-Service and Countermeasures

Conference: IEEE S&P 2022
Summary: Analyzes risks of using LLMs for propaganda generation and develops countermeasures to detect and mitigate LLM-generated disinformation at scale.

27. Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models

Conference: IEEE S&P 2024
Summary: Presents poisoning attacks on generative models that introduce trigger-based defects into images, protecting artistic works from unauthorized use.

28. The Janus Interface: How Fine-Tuning in Large Language Models Amplifies the Privacy Risks

Conference: ACM CCS 2024
Summary: Demonstrates that fine-tuning amplifies privacy risks in LLMs, showing how attackers can extract more training data through fine-tuned models.

---

VIII. LLM-Based Security Tools (Offensive & Defensive)

46. Examining Zero-Shot Vulnerability Repair with Large Language Models

Conference: IEEE S&P 2023
Summary: Evaluates the effectiveness of LLMs for automated vulnerability repair, analyzing zero-shot code-fixing capabilities and identifying failure modes.

47. LLMIF: Augmented Large Language Model for Fuzzing IoT Devices

Conference: IEEE S&P 2024
Summary: Augments LLMs with domain-specific knowledge for fuzzing IoT devices, improving input generation and vulnerability discovery in resource-constrained systems.

48. PentestGPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing

Conference: USENIX Security 2024
Summary: Evaluates LLMs for automated penetration testing, demonstrating their capability to autonomously identify and exploit vulnerabilities in systems.

49. From One Thousand Pages of Specification to Unveiling Hidden Bugs: Large Language Model Assisted Fuzzing of Matter IoT Devices

Conference: USENIX Security 2024
Summary: Uses LLMs to parse specifications and automatically generate fuzzing inputs for IoT devices, discovering complex vulnerabilities.

50. DeGPT: Optimizing Decompiler Output with LLM

Conference: NDSS 2024
Summary: Employs LLMs to optimize and improve decompiler output quality, enhancing binary analysis and reverse engineering capabilities.

51. Large Language Model guided Protocol Fuzzing

Conference: NDSS 2024
Summary: Uses LLM guidance to drive protocol fuzzing, enabling more intelligent and effective discovery of protocol vulnerabilities.

52. Large Language Models for Code Analysis: Do LLMs Really Do Their Job?

Conference: USENIX Security 2024
Summary: Critically evaluates LLM capabilities for code analysis tasks, measuring accuracy and identifying systematic failure modes.

53. From Large to Mammoth: A Comparative Evaluation of Large Language Models in Vulnerability Detection

Conference: NDSS 2025
Summary: Provides comparative analysis of different LLM sizes and architectures for vulnerability detection, measuring performance trade-offs.

54. Generating API Parameter Security Rules with LLM for API Misuse Detection

Conference: NDSS 2025
Summary: Uses LLMs to automatically generate security rules for API parameter validation and misuse detection.

55. SV-TrustEval-C: Evaluating Structure and Semantic Reasoning in Large Language Models for Source Code Vulnerability Analysis

Conference: IEEE S&P 2025
Summary: Proposes evaluation framework assessing LLM structure and semantic reasoning capabilities in vulnerability analysis tasks.

56. Poster: An Exploration of Large Language Models in Malicious Code Detection

Conference: ACM CCS 2024
Summary: Explores how LLMs can be used for malicious source-code detection and compares their interpretability against traditional detection approaches.

57. RACONTEUR: A Knowledgeable, Insightful, and Portable LLM-Powered Shell Command Explainer

Conference: NDSS 2025
Summary: Develops an LLM-powered system to explain shell commands, improving security awareness and preventing accidental command injection.

58. JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation

Conference: ACM CCS 2025
Summary: Creates benchmarks and evaluates LLMs for JavaScript deobfuscation, enabling better analysis of obfuscated client-side code.

---

IX. Agent Security & Agentic AI Systems

59. On the (In)Security of LLM App Stores

Conference: IEEE S&P 2025
Summary: Analyzes security of LLM app stores and plugin marketplaces, identifying vetting gaps and risks from malicious or vulnerable apps.

60. Make Agent Defeat Agent: Automatic Detection of Taint-Style Vulnerabilities in LLM-based Agents

Conference: USENIX Security 2025
Summary: Proposes agent-based methods to automatically detect taint-style vulnerabilities in LLM agents, modeling security analysis as multi-agent competition.

61. Cloak, Honey, Trap: Proactive Defenses Against LLM Agents

Conference: USENIX Security 2025
Summary: Uses deception, honeytokens, traps, and counterattacks to exploit LLM weaknesses and disrupt or neutralize malicious agents, often without relying on prompt injection.

62. When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs

Conference: USENIX Security 2025
Summary: Studies security implications of LLMs with web access capabilities, demonstrating novel attack vectors and information leakage risks.

63. Demystifying RCE Vulnerabilities in LLM-Integrated Apps

Conference: ACM CCS 2024
Summary: Analyzes remote code execution vulnerabilities in applications integrating LLMs, identifying patterns and attack chains leading to RCE.

64. Malla: Demystifying Real-World Large Language Model Integrated Malicious Services

Conference: USENIX Security 2024
Summary: Studies real-world malicious LLM-integrated services, characterizing attack patterns and identifying ecosystem security risks.

65. IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems

Conference: NDSS 2025
Summary: Proposes execution isolation architecture to sandbox LLM agents, preventing unauthorized access to system resources and sensitive data.

66. AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents

Conference: ACM CCS 2025
Summary: Intercepts sensitive operations in computer-use agents, checks them against security policy, and blocks execution until the action is deemed safe.

67. SecAlign: Defending Against Prompt Injection with Preference Optimization

Conference: ACM CCS 2025
Summary: Builds a preference dataset of prompt-injected inputs paired with secure and insecure outputs, then uses preference optimization to teach the model to prefer the secure response.

---

X. Chatbot & Team Communication Security

68. Why So Toxic?: Measuring and Triggering Toxic Behavior in Open-Domain Chatbots

Conference: ACM CCS 2022
Summary: Measures and characterizes toxic behavior in open-domain chatbots, identifying triggers that elicit harmful outputs.

69. Exploring the Security and Privacy Risks of Chatbots in Messaging Platforms

Conference: ACM CCS 2022
Summary: Analyzes security and privacy risks of chatbots deployed in messaging platforms, including data leakage and social engineering vectors.

70. Hazard Integrated: Understanding Security Risks in App Extensions to Team Chat Systems

Conference: NDSS 2022
Summary: Examines security risks in app extensions and bots for team collaboration platforms, identifying privilege escalation and information leakage risks.

71. On Large Language Models' Resilience to Coercive Interrogation

Conference: IEEE S&P 2024
Summary: Shows that an attacker with access to top-k token predictions can coerce an LLM into disclosing harmful text by forcing low-ranked tokens during autoregressive generation, without crafting a jailbreak prompt.

---

XI. Misuse & Societal Harms

72. From Chatbots to Phishbots?: Phishing Scam Generation in Commercial Large Language Models

Conference: IEEE S&P 2024
Summary: Demonstrates that LLMs can be easily misused to generate convincing phishing scams, highlighting misuse risks in commercial systems.

73. Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns

Conference: ACM CCS 2024
Summary: Qualitative study investigating how developers perceive and manage security risks when using AI assistants in software development.

---

XII. Fine-Tuning Interface Attacks

74. Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-Based Prompt Injection Attacks via the Fine-Tuning Interface

Conference: IEEE S&P 2025
Summary: Shows that loss-like signals exposed by the remote fine-tuning interface can be used to guide optimization-based prompt injection against closed-weight LLMs.

---

---

Comprehensive Problem-Solution Matrix

Each subtable below uses one specific problem per row and one specific paper per column. Paper columns are shortened for readability; the exhaustive catalog above contains the full titles and venue/year references.

Prompt Injection & Instruction Hijacking

Problem	DataSentinel (S&P 2025)	Formalizing & Benchmarking (USENIX 2024)	Prompt Inversion (S&P 2025)	JudgeDeceiver (CCS 2024)	Fun-tuning (S&P 2025)	SecAlign (CCS 2025)	IsolateGPT (NDSS 2025)	LLM App Stores (S&P 2025)	AI Worm (CCS 2025)	ImportSnare (CCS 2025)
Detect prompt injection in LLM-integrated apps	game-theoretic detector	formal attack/defense benchmark	—	—	loss-guided injection search	preference-optimized defense	execution isolation	app-store risk framework	prompt propagation containment	RAG manual hijack
Attack distributed inference or judge pipelines	—	benchmark and attack taxonomy	prompt recovery across split inference	optimization-based judge attack	—	—	—	—	—	—
Defend agent execution against injected instructions	—	defense evaluation framework	—	—	—	secure-response preference optimization	sandboxed execution and least privilege	—	—	—
Assess ecosystem exposure to malicious prompts	—	—	—	—	—	—	—	three-layer app-store concern framework	ecosystem worm analysis	poisoned dependency chain

Prompt Leakage & Privacy Extraction

Problem	PLeak (CCS 2024)	Prompt Stealing (S&P 2025)	KV-Cache Sharing (NDSS 2025)	Remote Keylogging (USENIX 2024)	Prompt Inference (CCS 2025)	SysVec (CCS 2025)	Training Data Extraction (USENIX 2021)	PII Leakage (S&P 2023)	AirGapAgent (CCS 2024)	Janus (CCS 2024)
Steal hidden system prompts from LLM apps	closed-box query optimization	in-the-wild prompt stealing evaluation	—	—	—	system-vector defense	—	—	task-limited context isolation	—
Recover prompts from distributed or shared inference	—	—	prompt leakage via shared KV cache	—	prompt reconstruction from intermediate outputs	—	—	—	—	—
Extract assistant output or prompt content via side channels	—	—	—	token-length side channel	—	—	—	—	—	—
Extract training examples or PII from language models	—	—	—	—	—	—	verbatim training-data extraction	quantifies PII memorization leakage	—	fine-tuning amplifies privacy leakage
Protect privacy-conscious conversational agents	—	—	—	—	—	encodes system prompts as internal vectors	—	—	contextual integrity and access restriction	—

Backdoors, Trojans & Model Hijacking

Problem	BAIT (S&P 2025)	Instruction Backdoor (USENIX 2024)	LMSanitator (NDSS 2024)	Philosopher’s Stone (NDSS 2025)	Safety Misalignment (NDSS 2025)	Two-in-One (USENIX 2023)	Spinning Language Models (S&P 2022)	Nightshade (S&P 2024)
Detect or scan for LLM backdoors	inverts attack targets to expose triggers	—	—	—	unified misalignment measurement	—	—	—
Inject instruction backdoors into customized LLMs	—	word/syntax/semantic trigger design	—	—	—	—	—	—
Defend prompt-tuned models against backdoors	—	—	sanitizes task-agnostic backdoors	—	—	—	—	—
Trojan plugins or adapters that control tool use	—	—	—	infected low-rank adapters and tool misuse	—	—	—	—
Hijack text generation or propagate adversarial behavior	—	—	—	—	safety alignment gap exploitation	model hijacking attack	propaganda-as-a-service backdoor	prompt-specific poisoning

Code Generation & Developer Workflow Security

Problem	Poisoned ChatGPT (S&P 2024)	You Autocomplete Me (USENIX 2021)	Lost at C (USENIX 2023)	AI Assistants Study (CCS 2024)	Code Hardening (CCS 2023)	PromSec (CCS 2024)	Security Course (CCS 2025)	Codebreaker (S&P 2025)
Poison insecure code suggestions into developer workflows	insecure suggestion poisoning	poisoning neural code completion	user study of code-assistant impact	qualitative security-practice study	—	—	—	—
Measure whether assistants change secure coding behavior	—	—	workplace code-assistant user study	developer security concerns study	—	—	—	—
Harden code generation against insecure output	—	—	—	—	security hardening and adversarial testing	secure prompt optimization	security knowledge injection for RACG	—
Extract sensitive code or implementation details	—	—	—	—	—	—	—	dynamic extraction attacks on code models

Security Analysis, Fuzzing & Reverse Engineering

Problem	Vuln Repair (S&P 2023)	LLMIF (S&P 2024)	PentestGPT (USENIX 2024)	Matter Fuzzing (USENIX 2024)	DeGPT (NDSS 2024)	Protocol Fuzzing (NDSS 2024)
Repair vulnerabilities with zero-shot LLMs	zero-shot vulnerability repair	—	—	—	—	—
Fuzz IoT devices with LLM augmentation	—	domain-augmented IoT fuzzing	—	specification-driven Matter fuzzing	—	—
Automate penetration testing	—	—	LLM-guided pentesting	—	—	—
Fuzz protocol implementations without machine-readable specs	—	—	—	—	—	LLM-guided protocol fuzzing
Improve decompiler output for reverse engineering	—	—	—	—	decompiler-output optimization	—

Security Analysis, Detection & Explanation

Problem	Large to Mammoth (NDSS 2025)	API Rules (NDSS 2025)	SV-TrustEval-C (S&P 2025)	RACONTEUR (NDSS 2025)	JsDeObsBench (CCS 2025)	Malicious Code Detection (CCS 2024)	Code Analysis (USENIX 2024)	Poster: Malicious Code Detection
Detect source-code vulnerabilities with LLMs	comparative vulnerability-detection evaluation	—	structural/semantic reasoning evaluation	—	—	—	code-analysis evaluation	—
Generate security rules for API misuse detection	—	APSR generation for API misuse	—	—	—	—	—	—
Explain shell commands for security analysts	—	—	—	knowledgeable shell-command explanation	—	—	—	—
Deobfuscate JavaScript or analyze malicious code	—	—	—	—	JS deobfuscation benchmark	malicious source-code detection	—	interpretability-focused malware detection

Voice Assistant Security

Problem	Light Commands (USENIX 2020)	SkillExplorer (USENIX 2020)	Void (USENIX 2020)	Hey Alexa (NDSS 2021)	EarArray (NDSS 2021)	GhostTalk (NDSS 2022)	FakeWake (CCS 2021)	CapSpeaker (CCS 2021)	Learning Normality (USENIX 2023)	Dangerous Skills (CCS 2020)
Inject unauthorized audio commands	laser-based audio injection	—	—	—	—	power-line interactive voice attack	—	capacitor-based voice injection	—	—
Analyze or audit skill ecosystems	—	large-scale skill behavior analysis	—	Alexa skill ecosystem audit	—	—	—	—	—	skill certification trustworthiness
Detect or mitigate voice spoofing	—	—	fast voice-liveness detection	—	acoustic attenuation defense	—	fake wake-word mitigation	—	software mitigation for inaudible voice attacks	—

Agent, App, Plugin & RAG Security

Problem	LLM App Stores (S&P 2025)	RCE Vulnerabilities (CCS 2024)	Malla (USENIX 2024)	When LLMs Go Online (USENIX 2025)	IsolateGPT (NDSS 2025)	AgentSentinel (CCS 2025)	Cloak/Honey/Trap (USENIX 2025)	AirGapAgent (CCS 2024)	SecAlign (CCS 2025)	AI Worm (CCS 2025)	ImportSnare (CCS 2025)	Security Course (CCS 2025)
Assess platform risks in LLM apps, stores, and plugins	app-store security analysis	—	malicious-service ecosystem study	web-enabled LLM threat study	—	—	—	—	—	—	—	—
Prevent unsafe agent execution or sensitive-data leakage	—	LLM-integrated app RCE analysis	—	—	execution isolation	real-time computer-use defense	deception, traps, and counterattacks	privacy-conscious conversational isolation	preference-optimized prompt-injection defense	—	—	secure retrieval-augmented code generation
Stop adversarial prompt propagation or RAG poisoning	—	—	—	—	—	—	—	—	—	self-replicating prompt containment	RAG code-manual hijacking	—

Chatbots, Messaging & Coercive Interaction

Problem	Why So Toxic? (CCS 2022)	Messaging Chatbots (CCS 2022)	Hazard Integrated (NDSS 2022)	Coercive Interrogation (S&P 2024)	Phishbots (S&P 2024)
Trigger toxic or harmful chatbot behavior	toxic behavior measurement and triggers	—	—	—	—
Expose security/privacy risks in messaging bots and team chat apps	—	chatbot security and privacy risk analysis	team-chat extension risk analysis	—	—
Coerce models or misuse chatbots for harmful content	—	—	—	low-ranked token forcing without jailbreak prompts	phishing scam generation in commercial LLMs

Misuse, Harmful Generation & Alignment

Problem	Spinning Language Models (S&P 2022)	Nightshade (S&P 2024)	Safety Misalignment (NDSS 2025)	SurrogatePrompt (CCS 2024)	Fuzz-Testing Meets LLM-Based Agents (S&P 2025)
Generate propaganda or biased outputs with training-time attacks	meta-backdoor propaganda model	—	—	—	—
Poison text-to-image models or bypass T2I safety filters	—	prompt-specific poisoning	—	safety-filter bypass by substitution	automated T2I jailbreaking
Measure and reduce alignment failures	—	—	unified safety-misalignment framework	—	—

Fine-Tuning Interface Attacks

Problem	Fun-tuning (S&P 2025)	Janus (CCS 2024)
Use fine-tuning interfaces to search for prompt injections	loss-like signals guide optimization-based prompt injection	—
Expose how fine-tuning amplifies privacy leakage	—	fine-tuning recovers forgotten PII from pre-training data