{"id":"https://openalex.org/W4415054281","doi":"https://doi.org/10.48550/arxiv.2509.05831","title":"Decoding Latent Attack Surfaces in LLMs: Prompt Injection via HTML in Web Summarization","display_name":"Decoding Latent Attack Surfaces in LLMs: Prompt Injection via HTML in Web Summarization","publication_year":2025,"publication_date":"2025-09-06","ids":{"openalex":"https://openalex.org/W4415054281","doi":"https://doi.org/10.48550/arxiv.2509.05831"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2509.05831","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2509.05831","pdf_url":"https://arxiv.org/pdf/2509.05831","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2509.05831","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Verma, Ishaan","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Verma, Ishaan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":null,"display_name":"Yadav, Arsheya","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yadav, Arsheya","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9915000200271606,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9915000200271606,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10181","display_name":"Natural Language Processing Techniques","score":0.9786999821662903,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12016","display_name":"Web Data Mining and Analysis","score":0.9294999837875366,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/automatic-summarization","display_name":"Automatic summarization","score":0.503600001335144},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.46860000491142273},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.45809999108314514},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.4291999936103821},{"id":"https://openalex.org/keywords/decoding-methods","display_name":"Decoding methods","score":0.414900004863739},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.4146000146865845},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.4002000093460083},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.35510000586509705},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.3488999903202057}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7799999713897705},{"id":"https://openalex.org/C170858558","wikidata":"https://www.wikidata.org/wiki/Q1394144","display_name":"Automatic summarization","level":2,"score":0.503600001335144},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.46860000491142273},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.461899995803833},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.45809999108314514},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.4291999936103821},{"id":"https://openalex.org/C57273362","wikidata":"https://www.wikidata.org/wiki/Q576722","display_name":"Decoding methods","level":2,"score":0.414900004863739},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.4146000146865845},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.4041000008583069},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.4002000093460083},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.39079999923706055},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.35510000586509705},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.3488999903202057},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.34529998898506165},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.34310001134872437},{"id":"https://openalex.org/C2778689934","wikidata":"https://www.wikidata.org/wiki/Q1313396","display_name":"Headline","level":2,"score":0.3328999876976013},{"id":"https://openalex.org/C21959979","wikidata":"https://www.wikidata.org/wiki/Q36774","display_name":"Web page","level":2,"score":0.3215000033378601},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3138999938964844},{"id":"https://openalex.org/C137922610","wikidata":"https://www.wikidata.org/wiki/Q2093","display_name":"Document Object Model","level":3,"score":0.3107999861240387},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3068000078201294},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.3025999963283539},{"id":"https://openalex.org/C2781018962","wikidata":"https://www.wikidata.org/wiki/Q5164884","display_name":"Container (type theory)","level":2,"score":0.29840001463890076},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.29600000381469727},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2865999937057495},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.2786000072956085},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.27079999446868896},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26269999146461487},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.2614000141620636},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.25949999690055847},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.25769999623298645}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2509.05831","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2509.05831","pdf_url":"https://arxiv.org/pdf/2509.05831","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2509.05831","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2509.05831","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2509.05831","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2509.05831","pdf_url":"https://arxiv.org/pdf/2509.05831","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"are":[4,80],"increasingly":[5],"integrated":[6],"into":[7],"web-based":[8],"systems":[9],"for":[10,208,218],"content":[11,51,194],"summarization,":[12],"yet":[13,171],"their":[14,117],"susceptibility":[15],"to":[16,43,87,119,155],"prompt":[17,211],"injection":[18,212],"attacks":[19],"remains":[20],"a":[21,53,57,83,169,180,203],"pressing":[22],"concern.":[23],"In":[24],"this":[25,121],"study,":[26],"we":[27,137],"explore":[28],"how":[29],"non-visible":[30],"HTML":[31,91],"elements":[32],"such":[33],"as":[34],",":[35],"aria-label,":[36],"and":[37,69,92,111,127,182,206,213],"alt":[38],"attributes":[39],"can":[40,195],"be":[41],"exploited":[42],"embed":[44],"adversarial":[45,70,193],"instructions":[46],"without":[47],"altering":[48],"the":[49,139,159,215],"visible":[50],"of":[52,141,151,175],"webpage.":[54],"We":[55,101],"introduce":[56],"novel":[58],"dataset":[59],"comprising":[60],"280":[61],"static":[62],"web":[63,189,226],"pages,":[64],"evenly":[65],"divided":[66],"between":[67],"clean":[68],"injected":[71,152],"versions,":[72],"crafted":[73],"using":[74],"diverse":[75],"HTML-based":[76,210],"strategies.":[77],"These":[78,177],"pages":[79],"processed":[81],"through":[82],"browser":[84],"automation":[85],"pipeline":[86],"extract":[88],"both":[89,124],"raw":[90],"rendered":[93],"text,":[94],"closely":[95],"mimicking":[96],"real-world":[97],"LLM":[98,187,223],"deployment":[99],"scenarios.":[100],"evaluate":[102],"two":[103],"state-of-the-art":[104],"open-source":[105],"models,":[106],"Llama":[107,160],"4":[108,161],"Scout":[109,162],"(Meta)":[110],"Gemma":[112,165],"9B":[113,166],"IT":[114,167],"(Google),":[115],"on":[116],"ability":[118],"summarize":[120],"content.":[122,227],"Using":[123],"lexical":[125],"(ROUGE-L)":[126],"semantic":[128],"(SBERT":[129],"cosine":[130],"similarity)":[131],"metrics,":[132],"along":[133],"with":[134],"manual":[135],"annotations,":[136],"assess":[138],"impact":[140],"these":[142],"covert":[143],"injections.":[144],"Our":[145,200],"findings":[146],"reveal":[147],"that":[148],"over":[149],"29%":[150],"samples":[153],"led":[154],"noticeable":[156],"changes":[157],"in":[158,186,222],"summaries,":[163],"while":[164],"showed":[168],"lower,":[170],"non-trivial,":[172],"success":[173],"rate":[174],"15%.":[176],"results":[178],"highlight":[179],"critical":[181],"largely":[183],"overlooked":[184],"vulnerability":[185],"driven":[188],"pipelines,":[190],"where":[191],"hidden":[192],"subtly":[196],"manipulate":[197],"model":[198],"outputs.":[199],"work":[201],"offers":[202],"reproducible":[204],"framework":[205],"benchmark":[207],"evaluating":[209],"underscores":[214],"urgent":[216],"need":[217],"robust":[219],"mitigation":[220],"strategies":[221],"applications":[224],"involving":[225]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-11T00:00:00"}