LAAF: Logic-layer Automated Attack Framework A Systematic Red-Teaming Methodology for LPCI Vulnerabilities in Agentic Large Language Model Systems

• URL: http://arxiv.org/abs/2603.17239v1
• Date: Wed, 18 Mar 2026 00:51:36 GMT
• Title: LAAF: Logic-layer Automated Attack Framework A Systematic Red-Teaming Methodology for LPCI Vulnerabilities in Agentic Large Language Model Systems
• Abstract summary: LAAF is the first automated red-teaming framework to combine an LPCI-specific technique taxonomy with stage-sequential seed escalation.<n>We show that LAAF achieves higher stage-breakthrough efficiency than single-technique random testing.
• Score: 0.39875976220956705
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Agentic LLM systems equipped with persistent memory, RAG pipelines, and external tool connectors face a class of attacks - Logic-layer Prompt Control Injection (LPCI) - for which no automated red-teaming instrument existed. We present LAAF (Logic-layer Automated Attack Framework), the first automated red-teaming framework to combine an LPCI-specific technique taxonomy with stage-sequential seed escalation - two capabilities absent from existing tools: Garak lacks memory-persistence and cross-session triggering; PyRIT supports multi-turn testing but treats turns independently, without seeding each stage from the prior breakthrough. LAAF provides: (i) a 49-technique taxonomy spanning six attack categories (Encoding~11, Structural~8, Semantic~8, Layered~5, Trigger~12, Exfiltration~5; see Table 1), combinable across 5 variants per technique and 6 lifecycle stages, yielding a theoretical maximum of 2,822,400 unique payloads ($49 \times 5 \times 1{,}920 \times 6$; SHA-256 deduplicated at generation time); and (ii) a Persistent Stage Breaker (PSB) that drives payload mutation stage-by-stage: on each breakthrough, the PSB seeds the next stage with a mutated form of the winning payload, mirroring real adversarial escalation. Evaluation on five production LLM platforms across three independent runs demonstrates that LAAF achieves higher stage-breakthrough efficiency than single-technique random testing, with a mean aggregate breakthrough rate of 84\% (range 83--86\%) and platform-level rates stable within 17 percentage points across runs. Layered combinations and semantic reframing are the highest-effectiveness technique categories, with layered payloads outperforming encoding on well-defended platforms.

Related papers

• On the Design of Qwen3.8-Next Architecture: Evaluation, Efficiency, and Training Stability [57.03393882933515]
  We describe the architecture and ablations of Qwen3.8-Flash-Next, a sparse mixture-of-experts model with 125B parameters, 6B activated per token, and 51B parameters of n-gram embedding tables held off the accelerator.<n>On fourteen pre-training benchmarks the model leads the 397B-A17B predecessor on eight and trails it on the rest by at most 2.6 points, at 1/3 the activated parameters, 1/3 the training tokens, and roughly 1/9 the training FLOPs.
  arXiv  Detail & Related papers  (2026-08-31T06:35:07Z)
• Differentiable Logic Gate Networks for Low-Latency EEG Classification on Edge Devices [0.0]
  Real-time EEG classification on edge devices is bottlenecked by the floating-point arithmetic of conventional neural networks.<n>We investigated Differentiable Logic Gate Networks (Diff-Logic) as a hardware-native alternative.<n>Our results establish logic-based neural architectures as a practical paradigm for resource-constrained brain-computer interfaces.
  arXiv  Detail & Related papers  (2026-07-20T16:49:30Z)
• Constrained Decoding for Diffusion Language Models via Efficient Inference over Finite Automata [57.27430779838529]
  We present an exact and tractable algorithm for sampling from the constrained mean-field posterior under any constraint expressible as a finite automaton.<n>The approach guarantees constraint satisfaction by construction, supports both greedy and sampling-based decoding, and is compatible with parallel and block-wise decoding.<n> Empirical evaluations on Dream-7B and LLaDA-8 show substantial accuracy gains across various tasks.
  arXiv  Detail & Related papers  (2026-07-08T05:48:57Z)
• CompactionRL: Reinforcement Learning with Context Compaction for Long-Horizon Agents [46.180980184707416]
  We propose CompactionRL, a reinforcement learning strategy to train long-horizon agentic LLMs with context compaction.<n>We train CompactionRL on top of open models and observe consistent performance gains on agentic coding tasks.<n>Built upon GLM-4.7-Flash (30B-A3B), CompactionRL improves Pass@1 by 5.5 and 6.8 points, reaching 56.4% on SWE-bench Verified and 20.2% on Terminal-Bench 2.0.
  arXiv  Detail & Related papers  (2026-07-06T17:55:12Z)
• SymbolicLight V1: Spike-Gated Dual-Path Language Modeling with High Activation Sparsity and Sub-Billion-Scale Pre-Training Evidence [8.419155861590548]
  SymbolicLight V1 is a spike-gated dual-path language model.<n>It combines binary Leaky Integrate-and-Fire spike dynamics with a continuous residual stream.<n>It reaches held-out validation PPL 8.88-8.93 across four independent runs at >89% per-element activation sparsity.
  arXiv  Detail & Related papers  (2026-05-20T16:00:20Z)
• PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection [19.162716475205308]
  Multi-agent LLM systems increasingly rely on a Planner to decompose goals into sub-task sequences.<n>A single injection into the Planner's context achieves cascade amplification, corrupting all downstream sub-tasks simultaneously.<n>We introduce PlanFlip, a framework comprising four planning-phase prompt injection attacks.
  arXiv  Detail & Related papers  (2026-04-30T07:22:06Z)
• Phase-Scheduled Multi-Agent Systems for Token-Efficient Coordination [0.0]
  Phase-Scheduled Multi-Agent Systems (PSMAS) is a framework that reconceptualizes agent activation as continuous control over a shared attention space modeled on a circular manifold.<n>PSMAS achieves a mean token reduction of 27.3 percent (range 21.4-34.8 percent) while maintaining task performance within 2.1 percentage points of a fully activated baseline.
  arXiv  Detail & Related papers  (2026-04-19T12:03:54Z)
• CLASP: Defending Hybrid Large Language Models Against Hidden State Poisoning Attacks [48.54598003197356]
  State space models (SSMs) like Mamba have gained significant traction as efficient alternatives to Transformers.<n>HiSPAs, a recently discovered vulnerability that corrupts SSM memory through adversarial strings, pose a critical threat to these architectures.<n>We introduce the CLASP model to defend against this threat.
  arXiv  Detail & Related papers  (2026-03-12T17:29:55Z)
• Resource-Efficient Iterative LLM-Based NAS with Feedback Memory [49.44875022114861]
  Neural Architecture Search (NAS) automates network design, but conventional methods demand substantial computational resources.<n>We propose a closed-loop pipeline leveraging large language models (LLMs) to iteratively generate, evaluate, and refine convolutional neural network architectures.
  arXiv  Detail & Related papers  (2026-03-12T16:00:22Z)
• AWE: Adaptive Agents for Dynamic Web Penetration Testing [0.0]
  AWE is a memory-augmented multi-agent framework for autonomous web penetration testing.<n>It embeds structured, vulnerability-specific analysis pipelines within a lightweight LLM orchestration layer.<n>AWE achieves substantial gains on injection-class vulnerabilities.
  arXiv  Detail & Related papers  (2026-03-01T07:32:42Z)
• Towards a Science of Scaling Agent Systems [79.64446272302287]
  We formalize a definition for agent evaluation and characterize scaling laws as the interplay between agent quantity, coordination structure, modelic, and task properties.<n>We derive a predictive model using coordination metrics, that cross-validated R2=0, enabling prediction on unseen task domains.<n>We identify three effects: (1) a tool-coordination trade-off: under fixed computational budgets, tool-heavy tasks suffer disproportionately from multi-agent overhead, and (2) a capability saturation: coordination yields diminishing or negative returns once single-agent baselines exceed 45%.
  arXiv  Detail & Related papers  (2025-12-09T06:52:21Z)
• Dyadic-Chaotic Lifting S-Boxes for Enhanced Physical-Layer Security within 6G Networks [1.5469452301122173]
  Sixth-Generation (6G) wireless networks will interconnect billions of resource-constrained devices and time-critical services.<n>Physical-Layer Security (PLS) is pivotal to deliver lightweight, information-theoretic protection.<n>We introduce the first-ever chaos-lifted substitution box (S-box) for PLS.
  arXiv  Detail & Related papers  (2025-11-15T19:00:29Z)
• A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks [1.1435139523855764]
  This paper presents a novel multi-agent defense framework to detect and neutralize prompt injection attacks in real-time.<n>We evaluate our approach using two distinct architectures: a sequential chain-of-agents pipeline and a hierarchical coordinator-based system.
  arXiv  Detail & Related papers  (2025-09-16T19:11:28Z)
• DeltaLLM: A Training-Free Framework Exploiting Temporal Sparsity for Efficient Edge LLM Inference [19.987309147268586]
  We present DeltaLLM, a training-free framework that exploits temporal sparsity in attention patterns to enable efficient LLM inference on resource-constrained edge devices.<n>We evaluate our framework on the edge-device-friendly BitNet-b1.58-2B-4T model and Llama3.2-1B-Instruct model across diverse language tasks.
  arXiv  Detail & Related papers  (2025-07-25T18:23:18Z)
• AegisLLM: Scaling Agentic Systems for Self-Reflective Defense in LLM Security [74.22452069013289]
  AegisLLM is a cooperative multi-agent defense against adversarial attacks and information leakage.<n>We show that scaling agentic reasoning system at test-time substantially enhances robustness without compromising model utility.<n> Comprehensive evaluations across key threat scenarios, including unlearning and jailbreaking, demonstrate the effectiveness of AegisLLM.
  arXiv  Detail & Related papers  (2025-04-29T17:36:05Z)
• Learning Adaptive Parallel Reasoning with Language Models [70.1745752819628]
  We propose Adaptive Parallel Reasoning (APR), a novel reasoning framework that enables language models to orchestrate both serialized and parallel computations end-to-end.<n> APR generalizes existing reasoning methods by enabling adaptive multi-threaded inference using spawn() and join() operations.<n>A key innovation is our end-to-end reinforcement learning strategy, optimizing both parent and child inference threads to enhance task success rate without requiring predefined reasoning structures.
  arXiv  Detail & Related papers  (2025-04-21T22:29:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.