The DOI matches its Crossref record; 50 of the 50 references it cites were found in a registry or an index.
Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks
Open accessAbstract
Recent advances in instruction-following large language models (LLMs) have led to dramatic improvements in a range of NLP tasks. Unfortunately, we find that the same improved capabilities amplify the dual-use risks for malicious purposes of these models. Dual-use is difficult to prevent as instruction-following capabilities now enable standard attacks from computer security. The capabilities of these instruction-following LLMs provide strong economic incentives for dual-use by malicious actors. In particular, we show that instruction-following LLMs can produce targeted malicious content, including hate speech and scams, bypassing in-the-wild defenses implemented by LLM API vendors. Our analysis shows that this content can be generated economically and at cost of $125-500 \times$ cheaper than human effort alone. Together, our findings suggest that LLMs will increasingly attract more sophisticated adversaries and attacks, and addressing these attacks may require new approaches to mitigations.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Potential consequences include exfiltrating user data, executing arbitrary code, and more [18, 23, 33, 42].”
From AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (2024) · cites this paper as [23]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Even without actively specifying any social engineering techniques, the model's output could mirror some standard scam persuasion techniques [20].”
From Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023) · cites this paper as [20]
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“However, LLMs also excel at phishing attacks 29 .”
From Human innovation and the creative agency of the world in the age of generative AI (2024) · cites this paper as [29]
The cited source says what the claim attributes to it.
In the citing paper
“When prompted, the model may produce convincing personalized scams given appropriate knowledge about the target [21,43] (that was either given in the prompt or, importantly, the model acquired during the chat session).”
From Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023) · cites this paper as [21]
The cited source says what the claim attributes to it.
In the citing paper
“Previous work has shown that LLMs can produce convincing scams such as phishing emails [21].”
From Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023) · cites this paper as [21]
The cited source says what the claim attributes to it.
In the citing paper
“Different social engineering and persuasion tricks can be automated with LLMs [20] (e.g., claiming authority as an official service, claiming repercussions for not complying such as a loss of the service, distracting the user by implying the requested action is urgent, offering a limited-time kind gesture, etc.).”
From Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023) · cites this paper as [20]
The cited source says what the claim attributes to it.
In the citing paper
“Even if applied, it remains unclear whether filtering can be evaded by stronger forms of obfuscation or encoding [21], which future models might further enable.”
From Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023) · cites this paper as [21]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“A successful attack can allow an external attacker to take actions (and call tools) on behalf of the user.”
From AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (2024) · cites this paper as [23]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372
On the Dangers of Stochastic Parrots: Can Language Models Be Too Big? 🦜
Bender, E. M., Gebru, T., McMillan-Major, A., & Shmitchell, S. (2021) · Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency · doi:10.1145/3442188.3445922 · Cited by 6,988 · cited 1×
“Our work furthers the study of harms and risks of LLMs (Bender et al., 2021; Bommasani et al., 2021; Liang et al., 2022; Abid et al., 2021; Gehman et al., 2020; Ganguli et al., 2022; Weidinger et al., 2021; 2022), focusing on demonstrating their potential of being actively misused.”
BackgroundTraining language models to follow instructions with human feedback
Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C. L., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al. (2022) · arXiv · doi:10.48550/arxiv.2203.02155 · Cited by 4,208
Training Language Models to Follow Instructions with Human Feedback
Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al. (2022) · Advances in Neural Information Processing Systems 35 · doi:10.52202/068431-2011 · Cited by 3,117
On the Opportunities and Risks of Foundation Models
Bommasani, R., Hudson, D. A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M. S., Bohg, J., Bosselut, A., Brunskill, E., et al. (2021) · arXiv · doi:10.48550/arxiv.2108.07258 · Cited by 2,676
Self-citationFinetuned Language Models Are Zero-Shot Learners
Wei, J., Bosma, M., Zhao, V. Y., Guu, K., Yu, A. W., Lester, B., Du, N., Dai, A. M., & Le, Q. V. (2021) · arXiv · doi:10.48550/arxiv.2109.01652 · Cited by 1,101
Taxonomy of Risks posed by Language Models
Weidinger, L., Uesato, J., Rauh, M., Griffin, C., Huang, P.-S., Mellor, J., Glaese, A., Cheng, M., Balle, B., Kasirzadeh, A., et al. (2022) · 2022 ACM Conference on Fairness Accountability and Transparency · doi:10.1145/3531146.3533088 · Cited by 764
RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models
Gehman, S., Gururangan, S., Sap, M., Choi, Y., & Smith, N. A. (2020) · Findings of the Association for Computational Linguistics: EMNLP 2020 · doi:10.18653/v1/2020.findings-emnlp.301 · Cited by 693
Multitask Prompted Training Enables Zero-Shot Task Generalization
Sanh, V., Webson, A., Raffel, C., Bach, S. H., Sutawika, L., Alyafeai, Z., Chaffin, A., Stiegler, A., Scao, T. L., Raja, A., et al. (2021) · arXiv · doi:10.48550/arxiv.2110.08207 · Cited by 612
Malware Obfuscation Techniques: A Brief Survey
You, I., & Yim, K. (2010) · 2010 International Conference on Broadband, Wireless Computing, Communication and Applications · doi:10.1109/bwcca.2010.85 · Cited by 607
Research works printed but not linked: 2
- 10.2139/ssrn.2937641 · DOI
- Mandt, 2016, Demystifying the secure enclave processor, Black Hat Las Vegas
Cited by
Sorted by citations
Items 101–123 of 123
AdaptiveGuard: Towards Adaptive Runtime Safety for LLM-Powered Software
Yang, R., Fu, M. C., Tantithamthavorn, C. K., Arora, C., Gulmammadova, G., & Chua, J. (2025) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase63991.2025.00279 · Cited by 4
HAMSA: Hijacking Aligned Compact Models via Stealthy Automation
Krylov, A. S., Vagizov, I. I., Korzh, D., Douiba, M., Guezzaz, A., Kokh, V. N., Erokhin, S. D., Тутубалина, Е. В., & Rogov, O. Y. (2025) · Doklady Mathematics · doi:10.1134/s1064562425700425 · Cited by 3
S-Eval: Towards Automated Safety Evaluation with Enhancement for Large Language Models
Yuan, X., Li, J., Wang, D., Chen, Y., Mao, X., Huang, L., Chen, J., Xue, H., Liu, X., Wang, W., et al. (2026) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3805706
Li, Y., Wang, G., & Wang, H. (2026) · Scientific Reports · doi:10.1038/s41598-026-47434-5
Mitigating Security Risks in Large Language Models: A Full Lifecycle Perspective
Wang, Y. K., Bai, Z., Huo, J., Wang, B., Liu, J., Cao, H., Meng, F., Yang, X., & Gao, Y. (2026) · Machine Learning · doi:10.1007/s10994-025-06930-x
Kang, N., & Im, J. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.6837687
Real-Time Unified Spam Detection System for Email and SMS
Singh, B., Mishra, R., Nagina, K., Ali, S. R., Tiwari, R., & Khan, N. R. (2026) · International Conference Big Data and Machine Learning · doi:10.1109/icbdml68582.2026.11544748
Liu, S., Chen, J. C., & Yin, Z. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-9694-2_8
Berini, A. D. E., Jamil, N., Lakas, A., Doshmangir, L., Ferrag, M. A., & Lam, K. (2026) · ACM International Workshop on Security and Privacy Analytics (IWSPA) · doi:10.1145/3806007.3810962
LLMThief: Evaluating Configuration Leaking Risks in Commercial LLM App Stores
Chen, P., Jiang, J., Chen, J., Qin, F., Zhang, M., Zhang, J., Duan, H., Shen, K., & Jiang, H. (2026) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp63933.2026.00195
AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption
Wang, Y., Geng, R., Chen, Y., & Jia, J. (2026) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp63933.2026.00198 · Cited by 13
Adaptive reinforcement learning based projected gradient descent attack
Zhu, Z. D. J. D., Zhang, Y., Ye, A., Wang, X. Y., Wang, C., & Zhu, T. (2026) · The Journal of Supercomputing · doi:10.1007/s11227-026-08687-z · Cited by 1
Akyol, H. M. (2026) · AI and Ethics · doi:10.1007/s43681-026-01231-y
Enhancing the TARA Framework for Physical AI Security: Application to ADS
Woo, J., Park, K., & Lee, J. (2026) · Transactions of Korean Society of Automotive Engineers · doi:10.7467/ksae.2026.34.7.785
Li, Y., Hu, J., Sang, W., Ma, L., Nie, D., Zhang, W., Yu, A., Su, Y., Huang, Q., & Zhou, Q. (2026) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn69566.2026.00054
Wang, Z., Wang, H., Luo, N., Zhang, L., Liu, P., Cao, Y., & Sun, X. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-32767-3_13 · Cited by 1
JAIL: Adaptive multi-turn jailbreak attacks reveal limitations of LLM safety alignment
Feng, Y., Lao, M., Wang, J., Li, Y., Li, X., Xie, Y., & Guo, Y. (2026) · Expert Systems with Applications · doi:10.1016/j.eswa.2026.133684
Self-citationAttacks via AI Agents: How Autonomous Systems Are Becoming the New Weapon of Cybercriminals
Segizbayev, D., Bakhtiyar, K., Sultan, O., & Abzal, S. (2026) · International Conference on Cybersecurity, Digital Forensics, and AI Applications (ICCSDFAI) · doi:10.1109/iccsdfai70505.2026.11647861
Rezaei, H., Rabhi, F., Beheshti, A., & Behnia, A. (2026) · IEEE International Conference on Digital Health (ICDH) · doi:10.1109/icdh72779.2026.00045
Evolving Jailbreak Templates via LLaDA-Based Mutation
Liang, J., & Wang, H. (2026) · International Conference on Data-driven Optimization of Complex Systems (DOCS) · doi:10.1109/docs70981.2026.11698563
VRSA: Jailbreaking Multimodal Large Language Models Through Visual Reasoning Sequential Attack
Zhao, S., Xiong, S., Huang, Y., Yan, J., Wu, Z., Guan, J., Duan, R., Tao, J., Xue, H., & Wei, X. (2026) · doi:10.1109/cvprf71909.2026.00902
A Prompt Injection Detection Model Addressing Over-Defense
Sable, V. S., Chorbev, I., & Dağ, H. (2026) · International Conference on Informatics and Information Technologies (CIIT) · doi:10.1109/ciit68512.2026.11731549
In ChatGPT We Trust? Measuring and Characterizing the Reliability of ChatGPT
Shen, X., Chen, Z., Backes, M., & Zhang, Y. (2023) · arXiv · doi:10.48550/arxiv.2304.08979 · Cited by 76
“Benefiting from ChatGPT’s instruction-following nature [40], we observe ChatGPT’s response in most cases follow the guide we defined in the prompt, facilitating automatic answer extraction for different QA tasks.”
Metadata
- Authors
- Kang, D., Li, X., Stoica, I., Guestrin, C., Zaharia, M., & Hashimoto, T.
- Affiliations
- University of Illinois Urbana-Champaign (US)
- Stanford University (US)
- Berkeley
- Venue
- 2024 IEEE Security and Privacy Workshops (SPW)
- Publisher
- IEEE
- Published
- 2024-05-23
- Pages
- 132-143
- OpenAlex
- W4400315206
- Cited by
- 114
- References
- 45
- Citations by year
- 2026: 29 · 2025: 41 · 2024: 30
- FWCI
- 29.51
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Security and Privacy Workshops (SPW) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Funders
- Open Philanthropy Project
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
- Physical Sciences › Computer Science › Artificial Intelligence › Hate Speech and Cyberbullying Detection
- Keywords
- large language models, dual-use risks, hate speech, scams, instruction following, security attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
