Cascade: Composing Software-Hardware Attack Gadgets for Adversarial Threat Amplification in Compound AI Systems

Complex AI systems have overlooked security gaps: Compound AI systems—pipelines combining multiple LLMs, software tools, and databases—remain vulnerable to traditional software and hardware attacks documented in the CVE database, despite significant research focus on LLM-specific risks like model extraction and training data leakage.

Old vulnerabilities enable new AI harms: The paper demonstrates that conventional system flaws can be weaponized to compromise AI safety. One attack combined a software code injection vulnerability with a Rowhammer hardware attack to bypass AI guardrails and inject jailbreak prompts directly into an LLM, resulting in safety violations.

Multi-layer attacks threaten data confidentiality: Researchers showed how manipulating a knowledge database could redirect an LLM agent to transmit sensitive user data to malicious applications, demonstrating that attacks don't need to target the AI model itself to compromise user privacy.

Current AI security research has blind spots: The paper highlights that the AI safety community has primarily focused on algorithmic risks while neglecting the traditional infrastructure vulnerabilities that underpin these systems—a gap that attackers can exploit through coordinated "cascade" attacks.

Responsible AI deployment requires holistic security: Securing compound AI systems demands addressing not just novel AI-specific threats, but also maintaining rigorous security practices across the entire software and hardware stack that supports these systems.