Sooel Son

Recent advances in large language models (LLMs) have enabled autonomous web agents to perform complex user tasks by leveraging their adaptive decision-making capabilities. Despite their growing use in crawling the Web, their security implications under indirect prompt injection (IPI) attacks remain largely understudied. Prior studies have compiled static benchmarks or proposed dynamic frameworks that generate adversarial phrases aimed at deceiving a single LLM within a target agent. However, by ignoring the agent’s operating context, these approaches yield suboptimal IPI attacks against modern web agents leveraging multiple, specialized LLMs. In this paper, we study the vulnerability in web agents to malicious phrases embedded as HTML elements. To assess the security risks posed by this vulnerability, we present AgentBreaker, an IPI attack framework that autonomously composes adversarial phrases tailored to page-specific context. When processed by web agents, these DOM-embedded phrases induce adversarial behaviors, such as clicking attacker-designated HTML elements, posting attacker-provided text, and disclosing internal agent secrets. In our evaluation against five state-of-the-art web agents, AgentBreaker achieves an attack success rate of 71.7%–100% across 60 webpages sampled from Online-Mind2Web. We then propose practical defenses that not only mitigate observed threats but also address potential adaptive attacks. Our defenses reduce the attack success rate down to 1.7%. By conducting context-aware injection, AgentBreaker outperforms existing IPI frameworks, thereby accurately evaluating web agents’ susceptibility to IPI and providing stepping stones for countering this emerging threat.

Graph-based retrieval-augmented generation (Graph RAG) is increasingly deployed to support LLM applications by augmenting user queries with structured knowledge retrieved from a knowledge graph. While Graph RAG improves relational reasoning, it introduces a largely understudied threat: adversaries can reconstruct subgraphs from a target RAG system's knowledge graph, enabling privacy inference and replication of curated knowledge assets. We show that existing attacks are largely ineffective against Graph RAG even with simple prompt-based safeguards, because these attacks expose explicit exfiltration intent and are therefore easily suppressed by lightweight safe prompts. We identify three technical challenges for practical Graph RAG extraction under realistic safeguards and introduce GRASP, a closed-box, multi-turn subgraph reconstruction attack. GRASP (i) reframes extraction as a context-processing task, (ii) enforces format-compliant, instance-grounded outputs via per-record identifiers to reduce hallucinations and preserve relational details, and (iii) diversifies goal-driven attack queries using a momentum-aware scheduler to operate within strict query budgets. Across two real-world knowledge graphs, four safety-aligned LLMs, and multiple Graph RAG frameworks, GRASP attains the strongest type-faithful reconstruction where prior methods fail, reaching up to 82.9 F1. We further evaluate defenses and propose two lightweight mitigations that substantially reduce reconstruction fidelity without utility loss.

As Neural Radiance Fields (NeRFs) have emerged as a powerful tool for 3D scene representation and novel view synthesis, protecting their intellectual property (IP) from unauthorized use is becoming increasingly crucial. In this work, we aim to protect the IP of NeRFs by injecting adversarial perturbations that disrupt their unauthorized applications. However, perturbing the 3D geometry of NeRFs can easily deform the underlying scene structure and thus substantially degrade the rendering quality, which has led existing attempts to avoid geometric perturbations or restrict them to explicit spaces like meshes. To overcome this limitation, we introduce a learnable sensitivity to quantify the spatially varying impact of geometric perturbations on rendering quality. Building upon this, we propose AegisRF, a novel framework that consists of a Perturbation Field, which injects adversarial perturbations into the pre-rendering outputs (color and volume density) of NeRF models to fool an unauthorized downstream target model, and a Sensitivity Field, which learns the sensitivity to adaptively constrain geometric perturbations, preserving rendering quality while disrupting unauthorized use. Our experimental evaluations demonstrate the generalized applicability of AegisRF across diverse downstream tasks and modalities, including multi-view image classification and voxel-based 3D localization, while maintaining high visual fidelity. Codes are available at https://github.com/wkim97/AegisRF.