Attacking LLMs and AI Agents: Advertisement Embedding Attacks Against Large Language Models

Supply chain vulnerabilities pose underestimated risks: The paper identifies two practical attack vectors—compromising third-party service platforms and distributing backdoored open-source models—that require minimal resources yet can inject malicious content into AI systems at scale, highlighting that LLM security threats extend beyond the model itself to entire deployment ecosystems.

Attacks can evade traditional safety measures: Unlike conventional adversarial attacks that degrade model performance and are therefore detectable, Advertisement Embedding Attacks maintain normal model functionality while covertly injecting ads, propaganda, or hate speech, meaning current accuracy-based safety evaluations may fail to catch these threats.

Multiple stakeholder groups face distinct risks: The paper identifies five victim groups affected by these attacks, suggesting that the harms are distributed across different users and organizations—from end-users receiving manipulated outputs to organizations whose reputations could be damaged by compromised AI agents.

Current defenses are incomplete: While the authors propose a prompt-based self-inspection defense that works without retraining models, they characterize this as only an "initial" mitigation, indicating that comprehensive solutions remain underdeveloped and require coordinated effort from the AI safety community.

Urgent policy and auditing gaps exist: The paper calls for "coordinated detection, auditing, and policy responses," suggesting that current governance frameworks and industry practices are not adequately equipped to address this emerging class of LLM security threats.