{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T22:42:44Z","timestamp":1784241764556,"version":"3.55.0"},"reference-count":74,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"nominal grant received at the ELLIS Unit Alicante Foundation from the Regional Government of Valencia in Spain"},{"DOI":"10.13039\/100002418","name":"Intel Corporation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100002418","id-type":"DOI","asserted-by":"publisher"}]},{"name":"European Union\u2019s Horizon 2020 Research and Innovation Programme","award":["951847"],"award-info":[{"award-number":["951847"]}]},{"name":"European Union\u2019s Horizon Europe Research and Innovation Programme","award":["101070254 CORESENSE"],"award-info":[{"award-number":["101070254 CORESENSE"]}]},{"name":"European Union through the project ROBOPROX","award":["CZ.02.01.01\/00\/22_008\/0004590"],"award-info":[{"award-number":["CZ.02.01.01\/00\/22_008\/0004590"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2024]]},"DOI":"10.1109\/access.2024.3450388","type":"journal-article","created":{"date-parts":[[2024,8,26]],"date-time":"2024-08-26T17:33:40Z","timestamp":1724693620000},"page":"126176-126187","source":"Crossref","is-referenced-by-count":38,"title":["A Security Risk Taxonomy for Prompt-Based Interaction With Large Language Models"],"prefix":"10.1109","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7588-7668","authenticated-orcid":false,"given":"Erik","family":"Derner","sequence":"first","affiliation":[{"name":"ELLIS Alicante, Alicante, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kristina","family":"Batisti\u010d","sequence":"additional","affiliation":[{"name":"Independent Researcher, Ljubljana, Slovenia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6743-3607","authenticated-orcid":false,"given":"Jan","family":"Zah\u00e1lka","sequence":"additional","affiliation":[{"name":"Czech Institute of Informatics, Robotics, and Cybernetics, Czech Technical University in Prague, Prague, Czech Republic"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9578-8598","authenticated-orcid":false,"given":"Robert","family":"Babu\u0161ka","sequence":"additional","affiliation":[{"name":"Czech Institute of Informatics, Robotics, and Cybernetics, Czech Technical University in Prague, Prague, Czech Republic"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref2","volume-title":"Introducing ChatGPT","year":"2022"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3442188.3445924"},{"key":"ref4","first-page":"6565","article-title":"Towards understanding and mitigating social biases in language models","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","volume":"139","author":"Liang"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3461702.3462530"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3531146.3533088"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1108\/LHTN-01-2023-0009"},{"issue":"7","key":"ref8","first-page":"12","article-title":"Our excessively simplistic information security model and how to fix it","volume":"8","author":"Parker","year":"2010","journal-title":"ISSA J."},{"key":"ref9","article-title":"Understanding the capabilities, limitations, and societal impact of large language models","author":"Tamkin","year":"2021","journal-title":"arXiv:2102.02503"},{"key":"ref10","article-title":"On the opportunities and risks of foundation models","author":"Bommasani","year":"2021","journal-title":"arXiv:2108.07258"},{"key":"ref11","article-title":"Towards safer generative language models: A survey on safety risks, evaluations, and improvements","author":"Deng","year":"2023","journal-title":"arXiv:2302.09270"},{"key":"ref12","volume-title":"Lessons Learned on Language Model Safety and Misuse","author":"Brundage","year":"2023"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3531146.3534627"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3442188.3445907"},{"key":"ref15","first-page":"2611","article-title":"Bias out-of-the-box: An empirical analysis of intersectional occupational biases in popular generative language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Kirk"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.190"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.229"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3531146.3533203"},{"key":"ref19","article-title":"Mitigating harm in language models with conditional-likelihood filtration","author":"Ngo","year":"2021","journal-title":"arXiv:2108.07790"},{"key":"ref20","article-title":"Assessing language model deployment with risk cards","author":"Derczynski","year":"2023","journal-title":"arXiv:2303.18190"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3593013.3594067"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1038\/d41586-023-00288-7"},{"key":"ref23","article-title":"Red teaming ChatGPT via jailbreaking: Bias, robustness, reliability and toxicity","author":"Yue Zhuo","year":"2023","journal-title":"arXiv:2301.12867"},{"issue":"1","key":"ref24","first-page":"342","article-title":"ChatGPT: Bullshit spewer or the end of traditional assessments in higher education?","volume":"6","author":"Rudolph","year":"2023","journal-title":"J. Appl. Learn. Teach."},{"key":"ref25","volume-title":"OWASP Top 10 for LLM","year":"2023"},{"key":"ref26","article-title":"LLM platform security: Applying a systematic evaluation framework to OpenAI\u2019s ChatGPT plugins","author":"Iqbal","year":"2023","journal-title":"arXiv:2309.10254"},{"key":"ref27","article-title":"Tricking LLMs into disobedience: Formalizing, analyzing, and detecting jailbreaks","author":"Rao","year":"2023","journal-title":"arXiv:2305.14965"},{"key":"ref28","article-title":"Safety assessment of Chinese large language models","author":"Sun","year":"2023","journal-title":"arXiv:2304.10436"},{"key":"ref29","article-title":"A survey of safety and trustworthiness of large language models through the lens of verification and validation","author":"Huang","year":"2023","journal-title":"arXiv:2305.11391"},{"key":"ref30","volume-title":"Adversarial AI in the Cyber Domain","author":"Brink","year":"2023"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00299"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3523273"},{"key":"ref33","first-page":"13647","article-title":"MoPe: Model perturbation based privacy attacks on language models","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Li"},{"key":"ref34","first-page":"8332","article-title":"Quantifying privacy risks of masked language models using membership inference attacks","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Mireshghallah"},{"key":"ref35","first-page":"2633","article-title":"Extracting training data from large language models","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Carlini"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3531146.3534642"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00095"},{"key":"ref38","article-title":"Quantifying association capabilities of large language models and its implications on privacy leakage","author":"Shao","year":"2023","journal-title":"arXiv:2305.12707"},{"key":"ref39","first-page":"12671","article-title":"MeaeQ: Mount model extraction attacks with efficient queries","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Dai"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3461702.3462578"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.225"},{"key":"ref42","article-title":"Evaluating large language models trained on code","author":"Chen","year":"2021","journal-title":"arXiv:2107.03374"},{"key":"ref43","article-title":"CodeLMSec benchmark: Systematically evaluating and finding security vulnerabilities in black-box code language models","author":"Hajipour","year":"2023","journal-title":"arXiv:2302.04012"},{"key":"ref44","first-page":"2205","article-title":"Lost at C: A user study on the security implications of large language model code assistants","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Sandoval"},{"key":"ref45","article-title":"Targeted phishing campaigns using large scale language models","author":"Karanjai","year":"2022","journal-title":"arXiv:2301.00665"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i10.21302"},{"key":"ref47","article-title":"LLMs killed the script kiddie: How agents supported by large language models change the landscape of network threat testing","author":"Moskal","year":"2023","journal-title":"arXiv:2310.06936"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW.2018.00028"},{"key":"ref49","article-title":"A proposal for a European cybersecurity taxonomy","author":"Nai-Fovino","year":"2019"},{"key":"ref50","article-title":"AVOIDIT: A cyber attack taxonomy","author":"Simmons","year":"2009"},{"key":"ref51","article-title":"Common attack pattern enumeration and classification (CAPEC) schema description","author":"Barnum","year":"2008"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3367792"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3300381"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.4425678"},{"key":"ref55","volume-title":"Security Implications of ChatGPT","author":"Seifried","year":"2023"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN52387.2021.9534192"},{"key":"ref57","article-title":"From text to MITRE techniques: Exploring the malicious use of large language models for generating cyber attack payloads","author":"Charan","year":"2023","journal-title":"arXiv:2305.15336"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/spw63631.2024.00018"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.272"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i17.29949"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i17.29950"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i4.20303"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"ref64","first-page":"4945","article-title":"Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Schulhoff"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.4018\/IJSPPC.320225"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.4018\/IJSPPC.325475"},{"key":"ref67","article-title":"BadGPT: Exploring security vulnerabilities of ChatGPT via backdoor attacks to InstructGPT","author":"Shi","year":"2023","journal-title":"arXiv:2304.12298"},{"key":"ref68","first-page":"1885","article-title":"Understanding black-box predictions via influence functions","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Koh"},{"key":"ref69","first-page":"1","article-title":"Learning to confuse: Generating training time adversarial data with auto-encoder","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Feng"},{"key":"ref70","first-page":"30339","article-title":"Adversarial examples make strong poisons","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Fowl"},{"key":"ref71","first-page":"1","article-title":"Unlearnable examples: Making personal data unexploitable","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Huang"},{"key":"ref72","article-title":"Trainwreck: A damaging adversarial attack on image classifiers","author":"Zah\u00e1lka","year":"2023","journal-title":"arXiv:2311.14772"},{"key":"ref73","first-page":"80","article-title":"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains","volume-title":"Leading Issues in Information Warfare and Security Research","volume":"1","author":"Hutchins","year":"2011"},{"key":"ref74","article-title":"Beyond the safeguards: Exploring the security risks of ChatGPT","author":"Derner","year":"2023","journal-title":"arXiv:2305.08005"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10380310\/10648691.pdf?arnumber=10648691","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,18]],"date-time":"2024-09-18T18:00:47Z","timestamp":1726682447000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10648691\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":74,"URL":"https:\/\/doi.org\/10.1109\/access.2024.3450388","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]}}}