{"id":"https://openalex.org/W7134849468","doi":"https://doi.org/10.1109/tdsc.2026.3671410","title":"AGFPS: An Automated Gradient-Free Framework for Prompt Stealing","display_name":"AGFPS: An Automated Gradient-Free Framework for Prompt Stealing","publication_year":2026,"publication_date":"2026-03-09","ids":{"openalex":"https://openalex.org/W7134849468","doi":"https://doi.org/10.1109/tdsc.2026.3671410"},"language":null,"primary_location":{"id":"doi:10.1109/tdsc.2026.3671410","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2026.3671410","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5128634649","display_name":"Huali Ren","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Huali Ren","raw_affiliation_strings":["School of Artificial Intelligence, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0000-5823-8343","affiliations":[{"raw_affiliation_string":"School of Artificial Intelligence, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067313044","display_name":"Anli Yan","orcid":"https://orcid.org/0000-0002-2854-2931"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Anli Yan","raw_affiliation_strings":["School of Artificial Intelligence, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-2854-2931","affiliations":[{"raw_affiliation_string":"School of Artificial Intelligence, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128674359","display_name":"Hongyang Yan","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongyang Yan","raw_affiliation_strings":["School of Artificial Intelligence, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-1493-9671","affiliations":[{"raw_affiliation_string":"School of Artificial Intelligence, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101814661","display_name":"Chong-zhi Gao","orcid":"https://orcid.org/0000-0001-7778-6775"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chong-zhi Gao","raw_affiliation_strings":["School of Computer Science, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0001-7778-6775","affiliations":[{"raw_affiliation_string":"School of Computer Science, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5128686287","display_name":"Jin Li","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jin Li","raw_affiliation_strings":["School of Artificial Intelligence, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-0385-8793","affiliations":[{"raw_affiliation_string":"School of Artificial Intelligence, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I37987034"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.29024735,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":"3","first_page":"7088","last_page":"7099"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8783000111579895,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8783000111579895,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.024900000542402267,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.016300000250339508,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.8144999742507935},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.725600004196167},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6187999844551086},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5515000224113464},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.35600000619888306},{"id":"https://openalex.org/keywords/snapshot","display_name":"Snapshot (computer storage)","score":0.32109999656677246}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8267999887466431},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8144999742507935},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.725600004196167},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6187999844551086},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5515000224113464},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46939998865127563},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.35600000619888306},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33000001311302185},{"id":"https://openalex.org/C55282118","wikidata":"https://www.wikidata.org/wiki/Q252683","display_name":"Snapshot (computer storage)","level":2,"score":0.32109999656677246},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3118000030517578},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.2989000082015991},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.29580000042915344},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2955000102519989},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2883000075817108},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.274399995803833},{"id":"https://openalex.org/C137836250","wikidata":"https://www.wikidata.org/wiki/Q984063","display_name":"Optimization problem","level":2,"score":0.2718000113964081},{"id":"https://openalex.org/C191015642","wikidata":"https://www.wikidata.org/wiki/Q1132459","display_name":"Fragmentation (computing)","level":2,"score":0.2581000030040741},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.25200000405311584}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2026.3671410","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2026.3671410","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1770965889","display_name":null,"funder_award_id":"62272118","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2159116245","display_name":null,"funder_award_id":"62402131","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2215088380","display_name":null,"funder_award_id":"U23A20307","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5894582779","display_name":null,"funder_award_id":"62132018","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7561889554","display_name":null,"funder_award_id":"U1936116","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8887200350","display_name":null,"funder_award_id":"12126609","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0,193],"widespread":[1],"deployment":[2,221],"of":[3,191],"large":[4],"language":[5],"models":[6,202],"(LLMs)":[7],"in":[8,25,121,189,218,232],"downstream":[9],"applications":[10,51],"has":[11],"increased":[12],"the":[13,26,225],"demand":[14],"for":[15,228],"high-quality":[16],"system":[17,35,47,176],"prompts,":[18],"which":[19],"have":[20,32],"become":[21],"valuable":[22],"intellectual":[23,59],"assets":[24],"commercial":[27],"prompt":[28,40,107,177],"marketplace.":[29],"Recent":[30],"studies":[31],"demonstrated":[33],"that":[34,96,155,170],"prompts":[36,48],"are":[37,117,127],"vulnerable":[38],"to":[39,100],"stealing":[41,108,178],"attacks,":[42],"where":[43,114],"adversaries":[44],"can":[45],"extract":[46],"from":[49,71],"LLM":[50,220,233],"by":[52],"crafting":[53],"adversarial":[54,115,195],"queries,":[55],"thereby":[56],"compromising":[57],"developers'":[58],"property":[60],"and":[61,77,135,166,185,203,223],"undermining":[62],"existing":[63],"business":[64],"models.":[65],"However,":[66],"prior":[67],"attack":[68],"methods":[69,188],"suffer":[70],"critical":[72,216],"limitations":[73],"including":[74],"gradient":[75],"dependency":[76],"poor":[78],"scalability,":[79],"severely":[80],"restricting":[81],"their":[82],"practical":[83],"applicability.":[84],"To":[85,138],"address":[86],"these":[87],"limitations,":[88],"we":[89,143],"present":[90],"AGFPS,":[91],"an":[92,122],"automated":[93],"gradient-free":[94],"framework":[95],"leverages":[97],"evolutionary":[98],"optimization":[99,112],"systematically":[101],"steal":[102],"prompts.":[103],"Our":[104,213],"approach":[105],"formulates":[106],"as":[109,119],"a":[110,145,173],"discrete":[111],"problem,":[113],"queries":[116,196],"modeled":[118],"individuals":[120,126],"evolving":[123],"population.":[124],"These":[125],"optimized":[128],"through":[129],"elite":[130],"retention,":[131],"selection,":[132],"adaptive":[133,152],"crossover,":[134],"mutation":[136],"operations.":[137],"mitigate":[139],"local":[140],"optima":[141],"convergence,":[142],"introduce":[144],"progressive":[146],"fitness":[147],"evaluation":[148],"strategy":[149],"based":[150],"on":[151],"sequence":[153],"fragmentation":[154],"exploits":[156],"LLMs'":[157],"autoregressive":[158],"properties.":[159],"Comprehensive":[160],"evaluations":[161],"across":[162,200],"multiple":[163],"benchmark":[164],"datasets":[165],"mainstream":[167],"LLMs":[168],"demonstrates":[169],"AGFPS":[171],"achieves":[172],"95.2%":[174],"exact":[175],"success":[179],"rate,":[180],"significantly":[181],"outperforming":[182],"manual":[183],"baselines":[184],"surpassing":[186],"gradient-based":[187],"80.6%":[190],"scenarios.":[192],"generated":[194],"exhibit":[197],"remarkable":[198],"transferability":[199],"heterogeneous":[201],"diverse":[204],"datasets,":[205],"while":[206],"maintaining":[207],"robustness":[208],"against":[209],"various":[210],"defense":[211],"mechanisms.":[212],"work":[214],"exposes":[215],"vulnerabilities":[217],"current":[219],"practices":[222],"underscores":[224],"urgent":[226],"need":[227],"enhanced":[229],"security":[230],"measures":[231],"applications.":[234]},"counts_by_year":[],"updated_date":"2026-07-16T13:24:37.021932","created_date":"2026-03-11T00:00:00"}