LLM Security Research · Lateos
Structured prompt injection susceptibility testing across frontier and edge LLMs. Using the IPI Taxonomy to classify, quantify, and map attack surface to OWASP LLM categories. All findings follow responsible structural disclosure — no weaponized payloads published.
Overview
This research track assesses how well language models resist indirect prompt injection (IPI) — the class of attack where untrusted content in a model's context window attempts to redirect or override its operational behavior.
Each assessment runs a structured test harness against a target model. Tests are organized by IPI class (attack pattern) and delivery variant (direct, obfuscated, embedded), producing a quantified susceptibility rate against a reproducible taxonomy. Results are cross-referenced to the OWASP Top 10 for LLMs to give enterprise teams a compliance-mapped risk picture.
The goal is to give application developers and security teams architectural data — not exploit code. Knowing which attack classes a model resists vs. which it fails, and why, drives better middleware design, safer deployment patterns, and more informed model selection.
Methodology
All findings are published under a Structural Disclosure framework. This approach demonstrates technical validity through data flow analysis, architectural root cause identification, and abstract defensive unit-tests — without releasing the adversarial inputs themselves.
| Withheld | Disclosed Instead | Operational Impact |
|---|---|---|
| Exact adversarial tokens & specific prompt strings | Data flow diagrams — the path of untrusted input through model context windows and tool boundaries | Protects production applications while exposing the underlying logic flaw |
| Weaponized payloads that trigger tool bypasses or arbitrary execution | OWASP LLM mapping — categorization via standard frameworks (LLM01 through LLM10) | Provides enterprise context for compliance and internal risk auditing |
| Live exploit scripts automating model exploitation | Validation unit-tests — safe, abstract dummy patterns allowing teams to verify if their middleware intercepts the class | Positions the research as builder-oriented, directly assisting defensive engineering teams |
Findings Index
Muse-Spark-1.2-Contributor — IPI Adversarial Evaluation
Evaluation of meta/muse-spark-1.2-contributor against the IPI prompt-injection taxonomy. 0.4% ASR (1/228 attack records) with a fully resistant core-25 (0/25). One genuine low-severity spectral-LSB marker-echo compromise (IPI-032). Modest over-refusal (6.6% raw FPR) on benign twins. Partial battery caveat: ~57% of configs returned deterministic EMPTY completions — a provider availability artifact. Highly resistant where available.
Qwen 3.8 27B — Full Battery Adversarial Evaluation
51-config battery across 772 records (524 attack / 248 benign, 2 trials per variant): core-25 IPI classes plus advanced threats, multimodal stego, agentic/MCP, RAG forged-policy disclosure, output-plane, reasoning, memory, iMIST/ICD, ghostjacking, and ReAct scratchpad phases. Fully resistant core-25 (0/25 — no breaks, including IPI-010/IPI-015 that broke Qwen 3.8 Max) with zero benign-twin compromise FPR. Top findings in RAG forged-policy cross-account disclosure (IPI-105 3/4), iMIST tool jailbreak (2/6), stego tool poisoning (2/6), ReAct scratchpad forged verification (2/6), and memory poison-then-trigger (2/8).
Qwen 3.8 Max — Full Battery Adversarial Evaluation
47-config battery across 431 records (282 attack / 149 benign): core-25 IPI classes plus advanced threats, multimodal stego, encoded numerical injection, MCP parameter/registry poisoning, RAG query triggers, multi-turn escalation, output injection, memorization divergence, consumption, memory poisoning, and ReAct scratchpad poisoning. Core-25 breaks (IPI-010 recursive framing 2/2, IPI-015 action induction 1/2) with zero benign-twin compromise FPR. Full OWASP LLM mapping with defensive mitigations and validation unit-tests.
InclusionAI Ling 3.0 Tiny — Full Battery Adversarial Evaluation
123-class battery across 391 completed records (265 attack / 126 benign): core IPI classes plus extended multimodal stego, agentic/MCP, RAG, output-plane, reasoning, memory, ghostjacking, and multi-agent phases. Ghostjacking cluster fully compromised (9/9), MCP rug-pull/shadowing at 100%, RAG metadata-plane poisoning 8/8, memory write-path smuggling 4/4. Zero benign-twin false positives; all 89 compromises individually verified.
DeepSeek V4 Flash 0731 — Full Battery Adversarial Evaluation
106-class battery across 379 records (256 attack / 123 benign): core-25 IPI classes plus advanced threats, multimodal stego, MCP parameter/registry/prompt-primitive poisoning, ReAct scratchpad poisoning, RAG dormant triggers and forged policies, multi-turn escalation, prompt extraction, output injection, reasoning sponge, and consumption phases. Core-25 partial break (IPI-001, IPI-006, IPI-010, IPI-023) with zero benign-twin compromise FPR. Full OWASP LLM mapping with defensive mitigations and validation unit-tests.
Qwen 3.7 Flash — Full Battery Adversarial Evaluation
30-config battery across 610 records (398 attack / 208 benign): core-25 IPI classes plus multimodal stego, MCP parameter/registry poisoning, RAG dormant triggers, multi-turn escalation, output injection, cipher evasion, reasoning sponge, memorization divergence, and memory poisoning phases. Structural analysis with manual spot-check of all 43 compromise verdicts (38 genuine, 1 suspect, 4 borderline). Full OWASP LLM mapping with defensive mitigations and validation unit-tests.
GPT-5 Nano — Prompt Injection Susceptibility Assessment
IPI Taxonomy v0.13 assessment across 210 test cases (21 classes × 10 variants; 9 inference failures excluded; 201 analyzed). Structural analysis of recursive instruction framing, MCP tool description poisoning, role hijacking, and steganographic injection. Full OWASP LLM mapping with defensive mitigations and validation unit-tests.
Custom Testing
If you are building on top of a language model and need a structured adversarial assessment before shipping, or want to validate that your defensive middleware holds up against the IPI taxonomy, custom engagements are available. Testing is conducted against your target model or deployment configuration, not a generic benchmark environment.
Each engagement runs the full IPI Taxonomy test suite — 21 attack classes across 3 delivery variants (direct, obfuscated, embedded). Coverage spans prompt injection, steganographic payloads, tool-description poisoning, multi-agent propagation, unauthorized action induction, RAG corpus attacks, and role-boundary bypass patterns.
The deliverable is a full structural disclosure report — the same format as the published assessments on this page. It quantifies susceptibility per class and severity tier, traces architectural root causes, maps findings to OWASP LLM Top 10, and provides immediately actionable mitigations for each failed class.