Prompt injection research has mostly targeted text channels, but multimodal agents now process audio — and audio-capable models must transcribe before they can filter. Injecting malicious instructions into the acoustic signal, below the threshold of human perception, bypasses safety filters entirely: by the time the model has a text representation to filter, the injected instruction is already in the reasoning context.
Figure 1: Attack pipeline — the malicious payload is embedded in the acoustic waveform as a psychoacoustically imperceptible perturbation. The perception (ASR) layer transcribes it to text before any safety filter runs, placing the injected instruction directly in the agent's reasoning context.
The attack embeds adversarial instruction strings as psychoacoustically imperceptible perturbations in the audio waveform, running concurrently with (not replacing) the legitimate audio content — making the channel stealthy to both human review and acoustic anomaly detection. The "concurrent" structure exploits a fundamental ordering constraint in multimodal agents: the ASR perception layer must transcribe to text before the LLM's safety alignment can act. Evaluated against production-scale multimodal agents (Hangzhou Dianzi University, Ant Group, Zhejiang University, Tsinghua University), the attack achieves high success rates while remaining below human perceptibility thresholds, with code publicly released.
Figure 1: FEGA maps SAE features along concept (activation clarity) and effect (logit shift) axes — revealing systematic misalignment: interpretable features often have weak causal effects, and causally dominant features are often poorly described.
Feature-Effect Geometry Analysis (FEGA) decomposes SAE feature behavior into a concept axis (activation descriptions) and an effect axis (downstream logit shifts when the feature fires), finding these are systematically misaligned: features with clear interpretable descriptions may have weak or inconsistent causal effects on outputs, while causally dominant features can be poorly described. Across multiple models and SAE families, effect geometry predicts steering reliability better than activation descriptions alone — directly challenging interpretability evaluations that rely solely on activation analysis.
Figure 1: Steering success across source position types — execution-boundary positions (where the model is about to produce the target behavior) consistently outperform all alternatives across three models and four task families.
Holding the downstream intervention constant and varying only where in the context the steering vector is extracted, the paper finds execution-boundary states — positions just before the model produces the target behavior — yield substantially stronger steering signals than random positions, last tokens, or post-action states, across three instruction-tuned models and four behavioral task families. This turns source selection from a poorly understood hyperparameter into a principled design choice with meaningful impact on steering reliability.
Figure 1: ToxScreen benchmark taxonomy — ~800 backdoored models spanning five axes; defenders have white-box weight access but no training data, no trusted reference model, and no trigger knowledge.
ToxScreen frames trigger recovery in a realistic threat model: white-box weight access but no training data, no known-clean reference model, and no prior on trigger type or attack objective. The benchmark spans ~800 backdoored models across attack objectives, trigger mechanisms (word/phrase/style), poisoning rates 0.1%–5%, model scales 125M–7B, and training mechanisms including full fine-tuning, LoRA, and RLHF-based backdoor insertion — the first systematic evaluation substrate for comparing trigger-recovery defenses under these constraints.
Figure 1: ALIBI attack loop — a coding agent iteratively inserts and refines adversarial source-code comments to manipulate LLM vulnerability detectors' chain-of-thought reasoning, causing them to miss real CVEs.
ALIBI constructs a black-box adaptive attack in which an agent inserts adversarial natural-language comments into real-world vulnerable code (drawn from vulnerability-fixing commits) and iteratively refines them based on detector feedback — exploiting that comments are processed as natural language by detector chain-of-thought but carry no security semantics in the code itself, making them simultaneously trusted and attacker-controlled. Evaluated against four LLM-based detectors from specialized reasoning models to frontier multi-agent systems, ALIBI exposes source-code comments as a previously understudied attack surface.
08
dLLMpreprint
4 entries removed on 2026-09-10 as repeats of earlier reports: 2606.04027 (first covered 2026-07-02), 2607.27386 (first covered 2026-07-31), 2607.20596 (first covered 2026-07-26), 2607.19317 (first covered 2026-07-20).
Figure 1: CVC mechanism — tokens that pass local confidence thresholds commit early (green), while the global stopping criterion independently decides when the full sequence is done (blue), reducing total denoising steps without retraining.
Confidence-Verified Commit (CVC) separates two decisions that standard dLLM decoding conflates: when individual tokens are confident enough to commit, and when the global sequence can stop. This training-free decoding framework reduces the number of denoising steps per generation without quality degradation, directly addressing dLLMs' inference-cost disadvantage relative to autoregressive models. Submitted July 30, 2026 by a team spanning NYCU, Albany SUNY, and NCKU.