The integration of external tools and untrusted data has transformed large language models (LLMs) into autonomous agents, but also exposes them to indirect prompt injection (IPI) attacks, where adversarial instructions in external content can manipulate tool use and compromise system behavior. Existing defenses use input filtering, reasoning correction, or execution control, but often trade attack suppression against task utility or runtime cost. We propose DISARM , a training-free defense that mediates action commitment at the tool boundary between agent-internal planning and external tool execution. DISARM keeps ordinary steps on a lightweight fast path and invokes one additional planner run only for selected checkpoints after removing any detected suspicious spans. It compares the proposed and replayed actions by tool path and critical arguments, allowing consistent actions, using the replayed action when only critical arguments differ within an unchanged tool path, and blocking tool-path deviations. This selective single-replay policy jointly targets security, utility, and low latency. On AgentDojo with GPT-4o, DISARM reduces the four-attack average attack success rate (ASR) from 23.01% to 0.37% while increasing utility under attack (UA) from 63.69% to 73.63%. On benign tasks, its 4.29s latency is 9.44% above No Defense but 56.22% and 66.80% below MELON-Aug and IPIGUARD, respectively. Across five LLM backends, the largest observed suite-level average ASR is 1.56%. Complementary WASP and all-suite fixed-configuration adaptive evaluations further examine transfer and gate coverage: no successful attacker objective is observed in the evaluated Base64 and fragmentation cases, whereas semantic parameter pollution retains 1.11% ASR. These results support DISARM as a lightweight tool-boundary defense while exposing the boundary of cue-based gating.
Fault-recovery mechanisms such as retry, fallback, replication, and re-execution are normally analysed as dependability mechanisms, yet their externally visible behaviour can reveal hidden execution paths. We study recovery-induced leakage: confidentiality loss caused by observing recovery behaviour beyond final outputs. Public observations combine a final output with an analyst-specified abstraction of an internal recovery trace, and leakage is quantified with vulnerability-based min-entropy. We formulate exact finite policy–interface selection over analyst-supplied recovery policies and diagnostic projections. The framework evaluates min-entropy leakage, availability, integrity risk, cost, and policy-dependent action diagnosability; it does not derive abstractions automatically. Diagnosability is conditioned on fault-present executions, reports support size, and normalises balanced Bayes accuracy above chance. We prove a recovery-action lower bound and add a hard case in which the action carries positive min-entropy leakage beyond the final output. A reproducible Envoy HTTP ext_authz fail-open study supplies an independently developed recovery mechanism, while the threat model distinguishes fault conditioning and repeated observations. Controlled models and executable studies show why output-only analysis can miss recovery channels and how auditable, action-level interfaces expose less than path-dependent traces without assuming that zero leakage is always attainable.
Dependency Confusion Attacks (DCA), which exploit resolver-level source bypass in multi-repository environments, have emerged as a critical threat to software supply chain security. Existing dependency confusion detection tools are limited by incomplete dependency extraction, insufficient transitive dependency analysis, and a lack of cross-repository version-precedence evaluation. We propose DCFinder, an automated dependency confusion detection method based on multi-dimensional dependency analysis. DCFinder first extracts dependencies from heterogeneous configuration sources by combining format-specific parsing for static configuration files with AST-based static analysis for executable build scripts. It then reconstructs multi-layer dependency trees through a source-aware dependency expansion strategy implemented with BFS traversal, where dependency expansion obtains metadata from configured private indexes when available and from PyPI otherwise, and continues recursively through the discovered sub-dependencies. Finally, it performs cross-repository version analysis to determine whether resolver behavior may allow a public package to override an intended private source. We evaluate DCFinder on 28 real-world Python projects with observable multi-index configurations. The results show that DCFinder achieves 88.7% precision and 83.3% recall for resolver-level dependency-confusion condition detection, whereas the evaluated baseline tools report no positive cases under the same setting due to their more limited modeling of cross-index resolution behavior. These results demonstrate that combining heterogeneous dependency extraction, source-aware dependency expansion, and cross-repository version analysis enables more comprehensive auditing of dependency-confusion risks.
Backdoor attacks inject hidden behaviors into deep neural networks, causing them to behave normally on benign inputs but produce attacker-specified results under trigger conditions, which poses significant threats to model integrity. However, transfer learning, as a prevalent paradigm for training neural networks, often compromises backdoors during the fine-tuning process. To address this issue, we propose Robust Backdoor Attacks against Fine-tuning-based Transfer Learning via Self-Attention Distillation (RBA-SAD), a robust backdoor attack scheme that manipulates model’s ability to recognize the trigger via layer-wise and top-down self-attention distillation, effectively withstanding the impact of fine-tuning. Additionally, imperceptible noise is employed as a trigger to evade defenses based on input purification. To enhance the effectiveness of self-attention distillation, we optimize trigger generation to achieve multi-layer feature collisions, ensuring that the representations of poisoned samples at each corresponding layer are similar to those of clean samples. Extensive experiments on three benchmark transfer-learning tasks show that RBA-SAD achieves over 97% attack success rate while remaining stealthy against seven state-of-the-art backdoor defenses. Moreover, it generalizes well to additional settings, including Vision Transformers, ImageNet-scale transfers, and parameter-efficient fine-tuning with Low-Rank Adaptation.
Behavioral profiling is widely used to characterize patterns in user activity, typically through clustering techniques that group similar behaviors. However, existing research often overlooks the role of feature engineering and assumes the availability of extensive historical data, assumptions that rarely hold in real-world settings. This study presents a case study on behavioral profiling using Microsoft Entra ID sign-in logs from a real-world cloud environment, and provides a systematic analysis of key design choices in profiling. In particular, we investigate how domain knowledge in feature engineering and the choice of data scope affect the quality and interpretability of behavioral profiles. Profiles are evaluated using both quantitative metrics and expert validation. Our results demonstrate that domain-informed features improve clustering quality and profiling accuracy. Moreover, profiles constructed from all available data remain distinctive across user groups, even under limited data availability, highlighting the robustness of the approach in realistic scenarios. Expert evaluation further shows that interpretability depends on the consistency and abstraction level of features. Moreover, the resulting profiles expose behavioral patterns that extend beyond experts’ typical user-centered analyses, providing a more comprehensive view of authentication behavior. Overall, our findings demonstrate that data-driven profiling, supported by expert validation, enables the construction of interpretable behavioral representations in cloud authentication environments.
