{"id":"https://openalex.org/W7117581357","doi":"https://doi.org/10.1145/3733799.3762963","title":"Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignment","display_name":"Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignment","publication_year":2025,"publication_date":"2025-10-13","ids":{"openalex":"https://openalex.org/W7117581357","doi":"https://doi.org/10.1145/3733799.3762963"},"language":"en","primary_location":{"id":"doi:10.1145/3733799.3762963","doi":"https://doi.org/10.1145/3733799.3762963","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762963","pdf_url":null,"source":{"id":"https://openalex.org/S7407088135","display_name":"ACM Workshop on Artificial Intelligence and Security (AISec)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3733799.3762963","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5121528906","display_name":"Zedian Shao","orcid":"https://orcid.org/0009-0000-6022-8654","observed_orcids":["https://orcid.org/0009-0000-6022-8654"]},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zedian Shao","raw_affiliation_strings":["Georgia Institute of Technology, Atlanta, USA"],"raw_orcid":"https://orcid.org/0009-0000-6022-8654","affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, Atlanta, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081986971","display_name":"Hongbin Liu","orcid":"https://orcid.org/0000-0003-1869-0428","observed_orcids":["https://orcid.org/0000-0003-1869-0428"]},"institutions":[{"id":"https://openalex.org/I170897317","display_name":"Duke University","ror":"https://ror.org/00py81415","country_code":"US","type":"education","lineage":["https://openalex.org/I170897317"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hongbin Liu","raw_affiliation_strings":["Duke University, Durham, USA"],"raw_orcid":"https://orcid.org/0000-0003-1869-0428","affiliations":[{"raw_affiliation_string":"Duke University, Durham, USA","institution_ids":["https://openalex.org/I170897317"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101498428","display_name":"Jaden Mu","orcid":"https://orcid.org/0009-0009-3509-4944","observed_orcids":["https://orcid.org/0009-0009-3509-4944"]},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jaden Mu","raw_affiliation_strings":["Carnegie Mellon University, Pittsburgh, USA"],"raw_orcid":"https://orcid.org/0009-0009-3509-4944","affiliations":[{"raw_affiliation_string":"Carnegie Mellon University, Pittsburgh, USA","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5009102659","display_name":"Neil Zhenqiang Gong","orcid":"https://orcid.org/0000-0002-9900-9309","observed_orcids":["https://orcid.org/0000-0002-9900-9309"]},"institutions":[{"id":"https://openalex.org/I170897317","display_name":"Duke University","ror":"https://ror.org/00py81415","country_code":"US","type":"education","lineage":["https://openalex.org/I170897317"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Neil Gong","raw_affiliation_strings":["Duke University, Durham, USA"],"raw_orcid":"https://orcid.org/0000-0002-9900-9309","affiliations":[{"raw_affiliation_string":"Duke University, Durham, USA","institution_ids":["https://openalex.org/I170897317"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":8.8792,"has_fulltext":true,"cited_by_count":25,"citation_normalized_percentile":{"value":0.98247739,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"13","last_page":"27"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.9819999933242798},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9020000100135803},{"id":"https://openalex.org/keywords/adversarial-alignment","display_name":"adversarial alignment","score":0.414000004529953},{"id":"https://openalex.org/keywords/llm-security","display_name":"LLM security","score":0.7160000205039978}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6847000122070312},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6377999782562256},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.6140000224113464},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5845999717712402},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5346999764442444},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4894999861717224},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.428600013256073},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.39169999957084656},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.321399986743927},{"id":"https://openalex.org/C3017944768","wikidata":"https://www.wikidata.org/wiki/Q1450463","display_name":"Poison control","level":2,"score":0.3107999861240387},{"id":"https://openalex.org/C545542383","wikidata":"https://www.wikidata.org/wiki/Q2751242","display_name":"Medical emergency","level":1,"score":0.26820001006126404},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2538999915122986},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.25290000438690186}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3733799.3762963","doi":"https://doi.org/10.1145/3733799.3762963","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762963","pdf_url":null,"source":{"id":"https://openalex.org/S7407088135","display_name":"ACM Workshop on Artificial Intelligence and Security (AISec)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2410.14827","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2410.14827","pdf_url":"https://arxiv.org/pdf/2410.14827","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2410.14827","doi":"https://doi.org/10.48550/arxiv.2410.14827","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2410.14827","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.1145/3733799.3762963","doi":"https://doi.org/10.1145/3733799.3762963","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733799.3762963","pdf_url":null,"source":{"id":"https://openalex.org/S7407088135","display_name":"ACM Workshop on Artificial Intelligence and Security (AISec)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G4503720401","display_name":"CAREER: Graph-Based Security Analytics: New Algorithms, Robustness under Adversarial Settings, and Robustness Enhancements","funder_award_id":"1937787","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G652313190","display_name":"Collaborative Research: SaTC: CORE: Small: Securing Recommender Systems against Data Poisoning Attacks","funder_award_id":"2125977","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6561886486","display_name":"Collaborative Research: SaTC: EDU: A Lab-based Curriculum for Watermarking AI-Generated Content: Theory, Algorithms, and Robustness Testing","funder_award_id":"2414406","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G777550411","display_name":"Collaborative Research: SaTC: CORE: Medium: Towards Secure Federated Learning","funder_award_id":"2131859","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8377316191","display_name":"AI Institute for Edge Computing Leveraging Next Generation Networks (Athena)","funder_award_id":"2112562","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8991437584","display_name":"Collaborative Research: SaTC: CORE: Medium: Securing LLMs against Prompt Injection Attacks","funder_award_id":"2450935","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7117581357.pdf","grobid_xml":"https://content.openalex.org/works/W7117581357.grobid-xml"},"referenced_works_count":16,"referenced_works":["https://openalex.org/W2036166268","https://openalex.org/W2251930319","https://openalex.org/W2251939518","https://openalex.org/W2589277916","https://openalex.org/W2595653137","https://openalex.org/W4385374425","https://openalex.org/W4392678053","https://openalex.org/W4401042743","https://openalex.org/W4401042878","https://openalex.org/W4402671843","https://openalex.org/W4404612289","https://openalex.org/W4405183113","https://openalex.org/W4411337880","https://openalex.org/W4416037087","https://openalex.org/W7161032443","https://openalex.org/W7165736730"],"related_works":["https://openalex.org/W7147211113","https://openalex.org/W7127370637","https://openalex.org/W4416549384","https://openalex.org/W7202037975","https://openalex.org/W4416840250","https://openalex.org/W7129268324","https://openalex.org/W4415314618","https://openalex.org/W4415011827","https://openalex.org/W7151294679","https://openalex.org/W7163321635"],"abstract_inverted_index":{"Prompt":[0],"injection":[1,93,148],"attack,":[2],"where":[3],"an":[4,16,27,109],"attacker":[5],"injects":[6],"a":[7,31,51,76,99,126,143],"prompt":[8,24,92,147],"into":[9],"the":[10,22,47,82,88,130,135,156,167,181],"original":[11],"one,":[12],"aiming":[13],"to":[14,25,86,107,142,170],"make":[15],"Large":[17],"Language":[18],"Model":[19],"(LLM)":[20],"follow":[21],"injected":[23],"perform":[26],"attacker-chosen":[28],"task,":[29],"represent":[30],"critical":[32],"security":[33],"threat.":[34],"Existing":[35],"attacks":[36,59],"primarily":[37],"focus":[38],"on":[39,159],"crafting":[40],"these":[41,58],"injections":[42],"at":[43,184],"inference":[44],"time,":[45],"treating":[46],"LLM":[48],"itself":[49],"as":[50],"static":[52],"target.":[53],"Our":[54,113],"experiments":[55,114],"show":[56,122],"that":[57,101,123],"achieve":[60],"some":[61],"success,":[62],"but":[63],"there":[64],"is":[65,133,153,183],"still":[66],"significant":[67],"room":[68],"for":[69,179],"improvement.":[70],"In":[71],"this":[72,151],"work,":[73],"we":[74,96],"introduces":[75],"more":[77,140],"foundational":[78],"attack":[79,182],"vector:":[80],"poisoning":[81],"LLM\u2019s":[83,110,157],"alignment":[84,105,111,120,131],"process":[85],"amplify":[87],"success":[89],"of":[90,129,146],"future":[91],"attacks.":[94,149],"Specifically,":[95],"propose":[97],"PoisonedAlign,":[98],"method":[100],"strategically":[102],"creates":[103],"poisoned":[104],"samples":[106],"poison":[108],"dataset.":[112],"across":[115],"five":[116],"LLMs":[117],"and":[118],"two":[119],"datasets":[121],"when":[124],"even":[125],"small":[127],"fraction":[128],"data":[132],"poisoned,":[134],"resulting":[136],"model":[137],"becomes":[138],"substantially":[139],"vulnerable":[141],"wide":[144],"range":[145],"Crucially,":[150],"vulnerability":[152],"instilled":[154],"while":[155],"performance":[158,175],"standard":[160],"capability":[161],"benchmarks":[162],"remains":[163],"largely":[164],"unchanged,":[165],"making":[166],"manipulation":[168],"difficult":[169],"detect":[171],"through":[172],"automated,":[173],"general-purpose":[174],"evaluations.":[176],"The":[177],"code":[178],"implementing":[180],"https://github.com/Sadcardation/PoisonedAlign.":[185]},"counts_by_year":[{"year":2026,"cited_by_count":14},{"year":2025,"cited_by_count":11}],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2025-12-30T00:00:00"}