{"id":"https://openalex.org/W7165173367","doi":"https://doi.org/10.48550/arxiv.2606.18673","title":"Understanding and Mitigating Prompt Leaking Attacks in Real-World LLM-Based Applications","display_name":"Understanding and Mitigating Prompt Leaking Attacks in Real-World LLM-Based Applications","publication_year":2026,"publication_date":"2026-06-17","ids":{"openalex":"https://openalex.org/W7165173367","doi":"https://doi.org/10.48550/arxiv.2606.18673"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.18673","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18673","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.18673","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138844430","display_name":"Yong Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Yong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138876647","display_name":"Chong Fu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fu, Chong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138871889","display_name":"Tong Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Tong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138956015","display_name":"Rui Zeng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zeng, Rui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138930836","display_name":"Qingming Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Qingming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138848709","display_name":"Tianyu Du","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Du, Tianyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138831240","display_name":"Zonghui Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zonghui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138874196","display_name":"Shouling Ji","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ji, Shouling","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138939068","display_name":"Wenzhi Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Wenzhi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8389999866485596,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8389999866485596,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.08869999647140503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.010999999940395355,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/usability","display_name":"Usability","score":0.5321999788284302},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.522599995136261},{"id":"https://openalex.org/keywords/leakage","display_name":"Leakage (economics)","score":0.5092999935150146},{"id":"https://openalex.org/keywords/troubleshooting","display_name":"Troubleshooting","score":0.3840000033378601},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.36719998717308044},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.3562000095844269}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.679099977016449},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6177999973297119},{"id":"https://openalex.org/C170130773","wikidata":"https://www.wikidata.org/wiki/Q216378","display_name":"Usability","level":2,"score":0.5321999788284302},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.522599995136261},{"id":"https://openalex.org/C2777042071","wikidata":"https://www.wikidata.org/wiki/Q6509304","display_name":"Leakage (economics)","level":2,"score":0.5092999935150146},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4853000044822693},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3952000141143799},{"id":"https://openalex.org/C147494362","wikidata":"https://www.wikidata.org/wiki/Q2078905","display_name":"Troubleshooting","level":2,"score":0.3840000033378601},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.36719998717308044},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.3562000095844269},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.31139999628067017},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.30469998717308044},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.26759999990463257},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2628999948501587},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.25110000371932983}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.18673","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18673","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.18673","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18673","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.5181622505187988,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"model":[2],"(LLM)-based":[3],"applications":[4,67],"rely":[5],"on":[6],"system":[7,23,81],"prompts":[8,18,24,82],"to":[9,27,104,133,194],"encode":[10],"core":[11],"logic":[12],"and":[13,44,73,120,128,159,180],"developer-defined":[14],"constraints,":[15],"making":[16],"these":[17,112,196],"important":[19],"intellectual":[20],"property.":[21],"However,":[22],"are":[25],"vulnerable":[26],"prompt":[28,58],"leaking":[29,59],"attacks.":[30],"Although":[31],"prior":[32],"work":[33],"has":[34],"shown":[35],"such":[36,91],"attacks":[37],"in":[38,46,60],"controlled":[39],"settings,":[40],"their":[41],"prevalence,":[42],"causes,":[43],"defenses":[45,101,172],"real-world":[47,61,160],"deployments":[48,79],"remain":[49],"unclear.":[50],"This":[51],"paper":[52],"presents":[53],"a":[54,145],"systematic":[55],"study":[56],"of":[57,78,170],"LLM-based":[62],"applications.":[63],"We":[64,96],"measure":[65],"1,200":[66],"across":[68],"six":[69],"major":[70],"commercial":[71],"platforms":[72],"find":[74],"that":[75,99,148,164],"over":[76,178],"80%":[77],"leak":[80],"under":[83],"realistic":[84],"adversarial":[85],"queries,":[86],"sometimes":[87],"exposing":[88],"sensitive":[89],"information":[90],"as":[92,198],"third-party":[93],"API":[94],"keys.":[95],"also":[97],"show":[98,163],"existing":[100],"often":[102],"fail":[103],"prevent":[105],"leakage":[106,168],"without":[107],"degrading":[108],"usability.":[109],"To":[110],"explain":[111],"failures,":[113],"we":[114,142],"conduct":[115],"an":[116,154],"attention-level":[117],"mechanistic":[118],"analysis":[119],"identify":[121],"attention":[122,152],"drift,":[123],"where":[124],"query-key":[125],"alignment":[126],"bias":[127],"softmax":[129],"amplification":[130],"cause":[131],"LLMs":[132],"progressively":[134],"ignore":[135],"defensive":[136],"constraints.":[137],"Guided":[138],"by":[139,177,184],"this":[140],"insight,":[141],"propose":[143],"AREA,":[144],"practical":[146],"defense":[147],"re-anchors":[149],"the":[150,167],"model's":[151],"using":[153],"optimizable":[155],"soft":[156],"prompt.":[157],"Experiments":[158],"case":[161],"studies":[162],"AREA":[165],"matches":[166],"resistance":[169],"state-of-the-art":[171],"while":[173],"improving":[174],"average":[175],"usability":[176],"33%":[179],"reducing":[181],"optimization":[182],"overhead":[183],"nearly":[185],"3x.":[186],"Our":[187],"responsible":[188],"disclosure":[189],"led":[190],"two":[191],"affected":[192],"vendors":[193],"classify":[195],"leaks":[197],"medium-severity":[199],"vulnerabilities.":[200]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-19T00:00:00"}