With the proliferation of LLM-driven multi-agent systems (MAS), the security of Web links has become a critical concern. Once MAS is induced to trust a malicious link, attackers can use it as a springboard to expand the attack surface. In this paper, we propose Web Fraud Attacks, a novel type of attack manipulating unique structures of web links to deceive MAS. We design 12 representative attack variants that encompass various methods, such as homoglyph deception, sub-directory nesting, and parameter obfuscation. Through extensive experiments on these attack vectors, we demonstrate that Web fraud attacks not only exhibit significant destructive potential across different MAS architectures but also possess a distinct advantage in evasion: they circumvent the need for complex input design, lowering the threshold for attacks significantly. These results underscore the importance of addressing Web fraud attacks, providing new insights into MAS safety.

While Large Language Models (LLMs) have achieved remarkable performance, they remain vulnerable to jailbreak. The integration of Large Language Models (LLMs) with external tools via protocols such as the Model Context Protocol (MCP) introduces critical security vulnerabilities, including prompt injection, data exfiltration, and other threats. To counter these challenges, we propose MCP-Guard, a robust, layered defense architecture designed for LLM–tool interactions. MCP-Guard employs a three-stage detection pipeline that balances efficiency with accuracy: it progresses from lightweight static scanning for overt threats and a deep neural detector for semantic attacks, to our fine-tuned E5-based model achieves 96.01% accuracy in identifying adversarial prompts. Finally, an LLM arbitrator synthesizes these signals to deliver the final decision. To enable rigorous training and evaluation, we introduce MCP-AttackBench, a comprehensive benchmark comprising 70,448 samples augmented by GPT-4. This benchmark simulates diverse real-world attack vectors that circumvent conventional defenses in the MCP paradigm, thereby laying a solid foundation for future research on securing LLM-tool ecosystems.

While Large Language Models (LLMs) have achieved remarkable performance, they remain vulnerable to jailbreak attacks that circumvent safety constraints. Existing strategies, ranging from heuristic prompt engineering to computationally intensive optimization, often face significant trade-offs between effectiveness and efficiency. In this work, we propose Contextual Representation Ablation (CRA), a novel inference-time intervention framework designed to dynamically silence model guardrails. Predicated on the geometric insight that refusal behaviors are mediated by specific low-rank subspaces within the model’s hidden states, CRA identifies and suppresses these refusal-inducing activation patterns during decoding without requiring expensive parameter updates or training. Empirical evaluation across multiple safety-aligned open-source LLMs demonstrates that CRA significantly outperforms baselines. By revealing that safety constraints can be surgically ablated from internal representations, our findings expose the intrinsic fragility of current alignment mechanisms and underscore the urgent need for more robust latent-space defenses.

When retrieved evidence contradicts parametric memory, language models frequently ignore the context and revert to memorized priors—a failure that undermines the purpose of retrieval augmentation. Contrastive decoding amplifies context-conditioned output to suppress parametric bias, but fixed coefficients cannot track changing disagreement, while output-only adaptive coefficients observe only the final prediction distributions. We propose FIDES (Faithful Inference via Deep Evidence Signals), a training-free decoder that combines signals from output distributions, hidden representations, and prediction trajectories to recompute contrastive intervention strength at every step. A matched, formula-verified audit on 128 NQ-Swap pairs shows that conflict raises Opposition by 0.0969 and the resulting coefficient α by 0.0727 at the same answer-prediction position (both p < 10⁻⁴). The audit also finds only a small Shift effect and saturated clipped Noise, clarifying the limits of the mechanism interpretation. Across three benchmarks and six backbones—four primary 7B/8B models and two scaling backbones up to 70B—FIDES achieves the best context fidelity in all 18 settings, outperforming the strongest training-free baseline by +3 to +13 points. At 70B, fidelity reaches 92–94% while F1 reaches 62–63%, showing that multi-depth stepwise contrast can preserve generation utility while improving evidence following.

This paper studies the problem of misclassification detection for vision-language models (VLMs), which aims to identify samples wrongly assigned by the pre-trained VLM. Previous works usually focus on exploring the latent space and measuring pairwise similarity scores for confidence estimation. However, these similarity scores can be biased for boundary points with different fine-grained features. To address this issue, this paper proposes an approach named Distribution-aware Prototypical Calibration with Fine-grained Voting (DECENT). The core idea of DECENT is to utilize probabilistic distributions to characterize both the semantics of the test image and its corresponding class prototype. Specifically, we first conduct clustering within each class in the latent space to construct a distribution of fine grained prototypes. More importantly, multiple augmented views of the test image are considered as samples from its underlying semantic distribution. Then, we measure the distribution distance between the image’s underlying semantic distribution and its neighboring fine grained prototype distributions, which is aggregated via fine-grained voting into a distributional score. This score can be fused with the VLM’s semantic alignment score to significantly enhance misclassification detection sensitivity, or to improve overall classification robustness. Extensive experiments on benchmark datasets validate the dual effectiveness of the proposed DECENT.

Lightweight Large Language Models (LwLLMs) are reduced-parameter, optimized models designed to run efficiently on consumer-grade hardware, offering significant advantages in resource efficiency, cost-effectiveness, and data privacy. However, these models often struggle with limited inference and reasoning capabilities, which restrict their performance on complex tasks and limit their practical applicability. Moreover, existing prompt optimization methods typically rely on extensive manual effort or the meta-cognitive abilities of state-of-the-art LLMs, making them less effective for LwLLMs.To address these challenges, we introduce DeBoP, a new Direct Behavior Optimization Paradigm, original from the Chain-of-Thought (CoT) prompting technique. Unlike CoT Prompting, DeBoP is an automatic optimization method, which focuses on the optimization directly on the behavior of LwLLMs. In particular, DeBoP transforms the optimization of complex prompts into the optimization of discrete, quantifiable execution sequences using a gradient-free Monte Carlo Tree Search. We evaluate DeBoP on seven challenging tasks where state-of-the-art LLMs excel but LwLLMs generally underperform. Experimental results demonstrate that DeBoP significantly outperforms recent prompt optimization methods on most tasks. In particular, DeBoP-optimized LwLLMs surpass GPT-3.5 on most tasks while reducing computational time by approximately 60% compared to other automatic prompt optimization methods.

The widespread deployment of large language models (LLMs) has intensified concerns around intellectual property (IP) protection, as model theft and unauthorized redistribution become increasingly feasible. To address this, model fingerprinting aims to embed verifiable ownership traces into LLMs. However, existing methods face inherent trade-offs between stealthness, robustness, and generalizability—being either detectable via distributional shifts, vulnerable to adversarial modifications, or easily invalidated once the fingerprint is revealed. In this work, we introduce CTCC, a novel rule-driven fingerprinting framework that encodes contextual correlations across multiple dialogue turns—such as counterfactual—rather than relying on token-level or single-turn triggers. CTCC enables fingerprint verification under black-box access while mitigating false positives and fingerprint leakage, supporting continuous construction under a shared semantic rule even if partial triggers are exposed. Extensive experiments across multiple LLM architectures demonstrate that CTCC consistently achieves stronger stealth and robustness than prior work. Our findings position CTCC as a reliable and practical solution for ownership verification in real-world LLM deployment scenarios.