{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,29]],"date-time":"2026-08-29T11:17:44Z","timestamp":1788002264639,"version":"build-2784847793"},"reference-count":113,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/access.2026.3656849","type":"journal-article","created":{"date-parts":[[2026,1,21]],"date-time":"2026-01-21T21:11:10Z","timestamp":1769029870000},"page":"12875-12899","source":"Crossref","is-referenced-by-count":10,"title":["A Systematic Review of Prompt Injection Attacks on Large Language Models: Trends, Taxonomy, Evaluation, Defenses, and Opportunities"],"prefix":"10.1109","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-8100-5347","authenticated-orcid":false,"given":"Jaqueline","family":"Damacena Duarte","sequence":"first","affiliation":[{"name":"Department of Electrical Engineering, University of Brasília, Brasília, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-8770-7610","authenticated-orcid":false,"given":"Guilherme D.","family":"C\u00e2ndido","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, University of Brasília, Brasília, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-4499-3984","authenticated-orcid":false,"given":"Jos\u00e9 Ricardo A.","family":"De Britto Filho","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, University of Brasília, Brasília, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4853-8788","authenticated-orcid":false,"given":"Jo\u00e3o","family":"Souza Neto","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, University of Brasília, Brasília, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-4998-0031","authenticated-orcid":false,"given":"Elena J.","family":"Da Costa","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, University of Brasília, Brasília, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8616-4924","authenticated-orcid":false,"given":"Jo\u00e3o Paulo Javidi","family":"Da Costa","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, University of Brasília, Brasília, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2075-6601","authenticated-orcid":false,"given":"Laerte","family":"Peotta De Melo","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, University of Brasília, Brasília, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1080\/0952813x.2021.1964003"},{"key":"ref2","volume-title":"The Illusion of Thinking","author":"Khashabi","year":"2024"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.patter.2025.101260"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW63382.2024.00295"},{"issue":"7","key":"ref5","doi-asserted-by":"crossref","first-page":"549","DOI":"10.3390\/info16070549","article-title":"Large language models in medical chatbots: Opportunities, challenges, and the need to address AI risks","volume":"16","author":"Chow","year":"2025","journal-title":"Information"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.3389\/frai.2023.1166014"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623985"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.6028\/nist.ai.600-1"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.6028\/nist.ai.600-1"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3300381"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ichms59971.2024.10555871"},{"key":"ref12","volume-title":"Regulation (EU) 2024\/1689 of the European Parliament and of the Council of 13, June 2024 Laying down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Regulations (EC), no. 300\/2008, (EU), no. 167\/2013, (EU), no. 168\/2013 and Directives 2014\/90\/EU, (EU) 2016\/797, (EU) 2017\/745, (EU) 2017\/746, (EU) 2018\/744, (EU) 2019\/1020 and (EU) 2020\/1055, and Decision (EU) 2020\/2228","year":"2024"},{"key":"ref13","first-page":"5998","article-title":"Attention is all you need","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"30","author":"Vaswani"},{"key":"ref14","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018","journal-title":"arXiv:1810.04805"},{"issue":"8","key":"ref15","first-page":"1","article-title":"Improving language understanding by generative pre-training","volume":"1","author":"Radford","year":"2018","journal-title":"OpenAI Blog"},{"key":"ref16","first-page":"1877","article-title":"Language models are few-shot learners","volume-title":"Proc. 34th Int. Conf. Neural Inf. Process. Syst.","volume":"33","author":"Brown"},{"issue":"120","key":"ref17","first-page":"1","article-title":"Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity","volume":"23","author":"Fedus","year":"2021","journal-title":"J. Mach. Learn. Res."},{"key":"ref18","first-page":"27730","article-title":"Training language models to follow instructions with human feedback","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ouyang"},{"key":"ref19","first-page":"1","article-title":"Chain-of-thought prompting elicits reasoning in large language models","volume-title":"Proc. 36th Int. Conf. Neural Inf. Process. Syst.","author":"Lee"},{"key":"ref20","article-title":"LLaMA: Open and efficient foundation language models","author":"Touvron","year":"2023","journal-title":"arXiv:2302.13971"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1159\/000546726"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1007\/s10639-025-13550-4"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2024.3497725"},{"key":"ref24","article-title":"A systematic survey of prompt engineering in large language models: Techniques and applications","author":"Sahoo","year":"2024","journal-title":"arXiv:2402.07927"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3689932.3694764"},{"key":"ref26","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.iotcps.2025.01.001","article-title":"Generative AI in cybersecurity: A comprehensive review of LLM applications and vulnerabilities","volume":"5","author":"Ferrag","year":"2025","journal-title":"Internet Things Cyber-Physical Syst."},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1117\/12.3055959"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.20532\/cit.2024.1005778"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2025.3592935"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/IRASET64571.2025.11008146"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.6028\/nist.ai.100-2e2023"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CSDE59766.2023.10487667"},{"key":"ref33","first-page":"4945","article-title":"Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Schulhoff"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670388"},{"key":"ref35","first-page":"9","article-title":"Scaling behavior of machine translation with large language models under prompt injection attacks","volume-title":"Proc. 1st, Ed., Workshop Scaling Behav. Large Lang. Models (SCALE-LLM)","author":"Sun"},{"key":"ref36","volume-title":"ATLAS: Adversarial Threat Landscape for Artificial-intelligence Systems","year":"2025"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3630106.3658913"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3689217.3690621"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3663530.3665021"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02304"},{"key":"ref41","first-page":"14322","article-title":"How Johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs","volume-title":"Proc. 62nd Annu. Meeting Assoc. Comput. Linguistics","author":"Zeng"},{"key":"ref42","first-page":"380","article-title":"A test suite of prompt injection attacks for LLM-based machine translation","volume-title":"Proc. 9th Conf. Mach. Transl.","author":"Miceli Barone"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN55064.2022.9892715"},{"key":"ref44","first-page":"14708","article-title":"Preemptive answer \u2018attacks\u2019 on chain-of-thought reasoning","volume-title":"Proc. Findings Assoc. Comput. Linguistics (ACL)","author":"Xu"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3650212.3680300"},{"key":"ref46","first-page":"6065","article-title":"Backdooring instruction-tuned large language models with virtual prompt injection","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics, Human Lang. Technol.","author":"Yan"},{"key":"ref47","first-page":"2136","article-title":"A wolf in sheep\u2019s clothing: Generalized nested jailbreak prompts can fool large language models easily","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics: Human Lang. Technol.","author":"Ding"},{"key":"ref48","first-page":"7957","article-title":"Automatic prompt optimization with \u2018gradient descent\u2019 and beam search","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Pryzant"},{"key":"ref49","first-page":"2862","article-title":"Gradient-based language model red teaming","volume-title":"Proc. 18th Conf. Eur. Chapter Assoc. Comput. Linguistics","author":"Wichers"},{"key":"ref50","first-page":"6473","article-title":"LinkPrompt: Natural and universal adversarial attacks on prompt-based language models","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics, Human Lang. Technol.","author":"Xu"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17120-8_53"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SPW63631.2024.00017"},{"key":"ref53","first-page":"2153","article-title":"Universal adversarial triggers for attacking and analyzing NLP","volume-title":"Proc. 9th Int. Joint Conf. Natural Lang. Process. Conf. Empirical Methods Natural Lang. Process. (EMNLP-IJCNLP)","author":"Wallace"},{"key":"ref54","article-title":"Scalable extraction of training data from (production) language models","author":"Nasr","year":"2023","journal-title":"arXiv:2311.17035"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.500"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.400"},{"key":"ref57","article-title":"Stress test evaluation for natural language inference","author":"Naik","year":"2018","journal-title":"arXiv:1806.00692"},{"key":"ref58","first-page":"10471","article-title":"InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents","volume-title":"Proc. Findings Assoc. Comput. Linguistics (ACL)","author":"Zhan"},{"key":"ref59","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","author":"Radford"},{"key":"ref60","first-page":"1","article-title":"BadChain: Backdoor chain-of-thought prompting for large language models","volume-title":"Proc. NeurIPS Workshop Backdoors Deep Learning: Good","author":"Xiang"},{"key":"ref61","first-page":"1","article-title":"Identifying the risks of LM agents with an LM-emulated sandbox","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Ruan"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1016\/j.otsr.2023.103694"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1103"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6311"},{"key":"ref65","first-page":"1927","article-title":"MART: Improving LLM safety with multi-round automatic red-teaming","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics: Human Lang. Technol.","volume":"1","author":"Ge"},{"key":"ref66","first-page":"703","article-title":"FLIRT: FeedBack loop in-context red teaming","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Mehrabi"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1162"},{"key":"ref68","article-title":"TruthfulQA: Measuring how models mimic human falsehoods","author":"Lin","year":"2021","journal-title":"arXiv:2109.07958"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3531146.3533192"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/W18-5446"},{"key":"ref71","first-page":"4675","article-title":"ETHOS: An online hate speech detection dataset","volume-title":"Proc. 12th Lang. Resour. Eval. Conf. (LREC)","author":"Mollas"},{"key":"ref72","volume-title":"Nudenet: Neural Network for Nude Detection","year":"2023"},{"key":"ref73","first-page":"3309","article-title":"ToxiGen: A large-scale machine-generated dataset for adversarial and implicit hate speech detection","volume-title":"Proc. 60th Annu. Meeting Assoc. Comput. Linguistics","author":"Hartvigsen"},{"key":"ref74","first-page":"649","article-title":"Character-level convolutional networks for text classification","volume-title":"Proc. 29th Int. Conf. Neural Inf. Process. Syst.","volume":"1","author":"Zhang"},{"key":"ref75","first-page":"142","article-title":"Learning word vectors for sentiment analysis","volume-title":"Proc. 49th Annu. Meeting Assoc. Comput. Linguistics: Human Lang. Technol. (ACL-HLT)","author":"Maas"},{"key":"ref76","first-page":"9","article-title":"Automatically constructing a corpus of sentential paraphrases","volume-title":"Proc. 3rd Int. Workshop Paraphrasing (IWP)","author":"Dolan"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N18-1101"},{"key":"ref78","first-page":"1","article-title":"Measuring massive multitask language understanding","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Hendrycks"},{"key":"ref79","first-page":"4149","article-title":"CommonsenseQA: A question answering challenge targeting commonsense knowledge","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics, Human Lang. Technol.","author":"Talmor"},{"key":"ref80","doi-asserted-by":"crossref","first-page":"346","DOI":"10.1162\/tacl_a_00370","article-title":"Did aristotle use a laptop? A question answering benchmark with implicit reasoning strategies","volume":"9","author":"Geva","year":"2021","journal-title":"Trans. Assoc. Comput. Linguistics"},{"key":"ref81","first-page":"784","article-title":"Know what you don\u2019t know: Unanswerable questions for SQuAD","volume-title":"Proc. 56th Annu. Meeting Assoc. Comput. Linguistics","author":"Rajpurkar"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1259"},{"key":"ref83","first-page":"2868","article-title":"MultiUN: A multilingual corpus from united nation documents","volume-title":"Proc. 7th Int. Conf. Lang. Resour. Eval. (LREC)","author":"Eisele"},{"key":"ref84","first-page":"2","article-title":"Overview of the IWSLT 2017 evaluation campaign","volume-title":"Proc. 14th Int. Conf. Spoken Lang. Transl.","author":"Cettolo"},{"key":"ref85","article-title":"Analysing mathematical reasoning abilities of neural models","author":"Saxton","year":"2019","journal-title":"arXiv:1904.01557"},{"key":"ref86","first-page":"2357","article-title":"MathQA: Towards interpretable math word problem solving with operation-based formalisms","volume-title":"Proc. Conf. North American Chapter Assoc. Comput. Linguistics: Human Lang. Technol.","author":"Amini"},{"key":"ref87","article-title":"Training verifiers to solve math word problems","author":"Cobbe","year":"2021","journal-title":"arXiv:2110.14168"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1145\/3137597.3137600"},{"key":"ref89","first-page":"3214","article-title":"TruthfulQA: Measuring how models mimic human falsehoods","volume-title":"Proc. 60th Annu. Meeting Assoc. Comput. Linguistics","author":"Lin"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.48550\/arxiv.1705.00648"},{"key":"ref91","first-page":"32","article-title":"Arsarcasm: A new dataset for sarcasm detection in Arabic tweets","volume-title":"Proc. 4th Workshop Open-Source Arabic Corpora Process. Tools","author":"Farha"},{"key":"ref92","volume-title":"AG\u2019s News Topic Classification Dataset","author":"Gulli","year":"2005"},{"key":"ref93","first-page":"166","article-title":"Measuring bias in contextualized word representations","volume-title":"Proc. 1st Workshop Gender Bias Natural Lang. Process.","author":"Kurita"},{"key":"ref94","article-title":"CodeSearchNet challenge: Evaluating the state of semantic code search","author":"Husain","year":"2019","journal-title":"arXiv:1909.09436"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.461"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2004.383"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10599-4_29"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ICVGIP.2008.47"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2013.77"},{"key":"ref101","article-title":"Fine-grained visual classification of aircraft","author":"Maji","year":"2013","journal-title":"arXiv:1306.5151"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/JSTARS.2019.2918242"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2010.5539970"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2012.6248092"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1212.0402"},{"key":"ref106","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-009-0275-4"},{"key":"ref108","first-page":"215","article-title":"An analysis of single-layer networks in unsupervised feature learning","volume-title":"Proc. AISTATS","volume":"15","author":"Coates"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/ASRU57964.2023.10389637"},{"key":"ref110","first-page":"1825","article-title":"AoE: Angle-optimized embeddings for semantic textual similarity","volume-title":"Proc. 62nd Annu. Meeting Assoc. Comput. Linguistics","author":"Li"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/TCSET64720.2024.10755823"},{"key":"ref112","first-page":"10542","article-title":"Defending against alignment-breaking attacks via robustly aligned LLM","volume-title":"Proc. 62nd Annu. Meeting Assoc. Comput. Linguistics","author":"Cao"},{"key":"ref113","first-page":"4551","article-title":"Flames: Benchmarking value alignment of LLMs in Chinese","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics: Human Lang. Technol.","author":"Huang"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/11323511\/11359704.pdf?arnumber=11359704","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,9]],"date-time":"2026-02-09T21:07:46Z","timestamp":1770671266000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11359704\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":113,"URL":"https:\/\/doi.org\/10.1109\/access.2026.3656849","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}