{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,21]],"date-time":"2026-10-21T20:08:51Z","timestamp":1792613331637,"version":"4.5.0"},"reference-count":128,"publisher":"Association for Computing Machinery (ACM)","issue":"6","funder":[{"name":"Fundo para o Desenvolvimento das Ci\u00eancias e da Tecnologia (FDCT), Macau SAR","award":["0080\/2024\/RIA2"],"award-info":[{"award-number":["0080\/2024\/RIA2"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2026,4,30]]},"abstract":"<jats:p>Inspired by the rapid development of Large Language Models (LLMs), LLM agents have evolved to perform complex tasks. LLM agents are now extensively applied across various domains, handling vast amounts of data to interact with humans and execute tasks. The widespread applications of LLM agents demonstrate their significant commercial value; however, they also expose security and privacy vulnerabilities. At the current stage, comprehensive research on the security and privacy of LLM agents is highly needed. This survey aims to provide a comprehensive overview of the newly emerged privacy and security issues faced by LLM agents. We begin by introducing the fundamental knowledge of LLM agents, followed by a categorization and analysis of the threats. We then discuss the impacts of these threats on humans, environment, and other agents. Subsequently, we review existing defensive strategies, and finally explore future trends. Additionally, the survey incorporates diverse case studies to facilitate a more accessible understanding. By highlighting these critical security and privacy issues, the survey seeks to stimulate future research towards enhancing the security and privacy of LLM agents, thereby increasing their reliability and trustworthiness in future applications.<\/jats:p>","DOI":"10.1145\/3773080","type":"journal-article","created":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T10:59:45Z","timestamp":1761562785000},"page":"1-36","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":56,"title":["The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies"],"prefix":"10.1145","volume":"58","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-5853-3594","authenticated-orcid":false,"given":"Feng","family":"He","sequence":"first","affiliation":[{"name":"University of Technology Sydney","place":["Ultimo, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0702-7102","authenticated-orcid":false,"given":"Tianqing","family":"Zhu","sequence":"additional","affiliation":[{"name":"Faculty of Data Science, City University of Macau","place":["Taipa, Macao"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7561-0992","authenticated-orcid":false,"given":"Dayong","family":"Ye","sequence":"additional","affiliation":[{"name":"City University of Macau","place":["Taipa, Macao"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3603-6617","authenticated-orcid":false,"given":"Bo","family":"Liu","sequence":"additional","affiliation":[{"name":"University of Technology Sydney","place":["Ultimo, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1680-2521","authenticated-orcid":false,"given":"Wanlei","family":"Zhou","sequence":"additional","affiliation":[{"name":"City University of Macau","place":["Taipa, Macao"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3491-5968","authenticated-orcid":false,"given":"Philip S.","family":"Yu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Illinois at Chicago","place":["Chicago, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,12,9]]},"reference":[{"key":"e_1_3_1_2_2","volume-title":"ChatGPT","year":"2022","unstructured":"2022. ChatGPT. Retrieved from https:\/\/openai.com\/chatgpt"},{"key":"e_1_3_1_3_2","volume-title":"Gemini - Chat to Supercharge Your Ideas","year":"2023","unstructured":"2023. Gemini - Chat to Supercharge Your Ideas. Retrieved from https:\/\/gemini.google.com"},{"key":"e_1_3_1_4_2","volume-title":"Malicious ChatGPT Agents: How GPTs Can Quietly Grab Your Data (Demo)  \\(\\cdot\\)  Embrace The Red","year":"2023","unstructured":"Embrace The Red 2023. Malicious ChatGPT Agents: How GPTs Can Quietly Grab Your Data (Demo) \\(\\cdot\\) Embrace The Red. Embrace The Red. Retrieved from https:\/\/embracethered.com\/blog\/posts\/2023\/openai-custom-malware-gpt\/"},{"key":"e_1_3_1_5_2","volume-title":"What Are Large Language Model (LLM) Agents and Autonomous Agents","year":"2023","unstructured":"Prompt Engineering 2023. What Are Large Language Model (LLM) Agents and Autonomous Agents. Prompt Engineering. Retrieved from https:\/\/promptengineering.org\/what-are-large-language-model-llm-agents\/"},{"key":"e_1_3_1_6_2","volume-title":"Introducing Meta Llama 3: The Most Capable Openly Available LLM to Date","year":"2024","unstructured":"2024. Introducing Meta Llama 3: The Most Capable Openly Available LLM to Date. Retrieved from https:\/\/ai.meta.com\/blog\/meta-llama-3\/"},{"key":"e_1_3_1_7_2","volume-title":"Introducing the next Generation of Claude","year":"2024","unstructured":"2024. Introducing the next Generation of Claude. Retrieved from https:\/\/www.anthropic.com\/news\/claude-3-family"},{"key":"e_1_3_1_8_2","unstructured":"Renat Aksitov Chung-Ching Chang David Reitter Siamak Shakeri and Yunhsuan Sung. 2023. Characterizing attribution and fluency tradeoffs for retrieval-augmented large language models. arXiv:2302.05578 (2023)."},{"key":"e_1_3_1_9_2","unstructured":"Markus Anderljung Joslyn Barnhart Anton Korinek Jade Leung Cullen O\u2019Keefe Jess Whittlestone Shahar Avin Miles Brundage Justin Bullock Duncan Cass-Beggs Ben Chang Tantum Collins Tim Fist Gillian Hadfield Alan Hayes Lewis Ho Sara Hooker Eric Horvitz Noam Kolt Jonas Schuett Yonadav Shavit Divya Siddarth Robert Trager and Kevin Wolf. 2023. Frontier AI regulation: Managing emerging risks to public safety. arXiv:2307.03718 (2023)."},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690350"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140450"},{"key":"e_1_3_1_12_2","unstructured":"Andres M. Bran Sam Cox Oliver Schilter Carlo Baldassari Andrew D. White and Philippe Schwaller. 2023. ChemCrow: Augmenting large-language models with chemistry tools. arXiv:2304.05376 (2023)."},{"key":"e_1_3_1_13_2","first-page":"2633","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security 21)","author":"Carlini Nicholas","year":"2021","unstructured":"Nicholas Carlini, Florian Tram\u00e8r, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. Extracting training data from large language models. In Proceedings of the 30th USENIX Security Symposium (USENIX Security 21). 2633\u20132650. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/carlini-extracting"},{"key":"e_1_3_1_14_2","unstructured":"P. V. Sai Charan Hrushikesh Chunduri P. Mohan Anand and Sandeep K. Shukla. 2023. From text to MITRE techniques: Exploring the malicious use of large language models for generating cyber attack payloads. arXiv:2305.15336 (2023)."},{"key":"e_1_3_1_15_2","volume-title":"LangChain","author":"Chase Harrison","year":"2022","unstructured":"Harrison Chase. 2022. LangChain. Retrieved from https:\/\/github.com\/langchain-ai\/langchain"},{"key":"e_1_3_1_16_2","unstructured":"Badhan Chandra Das M. Hadi Amini and Yanzhao Wu. 2024. Security and privacy challenges of large language models: A survey. arXiv:2402.00888 (2024)."},{"key":"e_1_3_1_17_2","doi-asserted-by":"crossref","unstructured":"Gelei Deng Yi Liu Yuekang Li Kailong Wang Ying Zhang Zefeng Li Haoyu Wang Tianwei Zhang and Yang Liu. 2023. MasterKey: Automated jailbreak across multiple large language model Chatbots. arXiv:2307.08715 (2023).","DOI":"10.14722\/ndss.2024.24188"},{"key":"e_1_3_1_18_2","doi-asserted-by":"crossref","unstructured":"Ameet Deshpande Vishvak Murahari Tanmay Rajpurohit Ashwin Kalyan and Karthik Narasimhan. 2023. Toxicity in ChatGPT: Analyzing Persona-assigned language models. arXiv:2304.05335 (2023).","DOI":"10.18653\/v1\/2023.findings-emnlp.88"},{"key":"e_1_3_1_19_2","doi-asserted-by":"crossref","unstructured":"Shehzaad Dhuliawala Mojtaba Komeili Jing Xu Roberta Raileanu Xian Li Asli Celikyilmaz and Jason Weston. 2024. Chain-of-verification reduces hallucination in large language models. In Findings of the Association for Computational Linguistics: ACL 2024. 3563\u20133578.","DOI":"10.18653\/v1\/2024.findings-acl.212"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9006283"},{"key":"e_1_3_1_21_2","unstructured":"Zhuoyun Du Chen Qian Wei Liu Zihao Xie Yifei Wang Yufan Dang Weize Chen and Cheng Yang. 2024. Multi-agent software development through cross-team collaboration. arXiv:2406.08979 (2024)."},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.32628\/CSEIT2390533"},{"key":"e_1_3_1_23_2","unstructured":"Richard Fang Rohan Bindu Akul Gupta and Daniel Kang. 2024. LLM agents can autonomously exploit one-day vulnerabilities. arXiv:2404.08144 (2024)."},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.eacl-main.232"},{"key":"e_1_3_1_25_2","unstructured":"Wenjie Fu Huandong Wang Chen Gao Guanghua Liu Yong Li and Tao Jiang. 2023. Practical membership inference attacks against fine-tuned large language models via self-prompt calibration. arXiv:2311.06062 (2023)."},{"key":"e_1_3_1_26_2","unstructured":"Xiaohan Fu Shuheng Li Zihan Wang Yihao Liu Rajesh K. Gupta Taylor Berg-Kirkpatrick and Earlence Fernandes. 2024. Imprompter: Tricking LLM agents into improper tool use. arXiv:2410.14923 (2024)."},{"key":"e_1_3_1_27_2","unstructured":"Jiahui Gao Renjie Pi Tianyang Han Han Wu Lanqing Hong Lingpeng Kong Xin Jiang and Zhenguo Li. 2024. CoCA: Regaining safety-awareness of multimodal large language models with constitutional calibration. arXiv:2409.11365 (2024)."},{"key":"e_1_3_1_28_2","doi-asserted-by":"crossref","unstructured":"Kai Greshake Sahar Abdelnabi Shailesh Mishra Christoph Endres Thorsten Holz and Mario Fritz. 2023. Not what you\u2019ve signed up for: Compromising real-world LLM-Integrated applications with indirect prompt injection. arXiv:2302.12173 (2023).","DOI":"10.1145\/3605764.3623985"},{"key":"e_1_3_1_29_2","unstructured":"Taicheng Guo Xiuying Chen Yaqi Wang Ruidi Chang Shichao Pei Nitesh V. Chawla Olaf Wiest and Xiangliang Zhang. 2024. Large language model based multi-agents: A survey of progress and challenges. arXiv:2402.01680 (2024)."},{"key":"e_1_3_1_30_2","doi-asserted-by":"crossref","unstructured":"Peter Henderson Koustuv Sinha Nicolas Angelard-Gontier Nan Rosemary Ke Genevieve Fried Ryan Lowe and Joelle Pineau. 2017. Ethical challenges in data-driven dialogue systems. arXiv:1711.09050 (2017).","DOI":"10.1145\/3278721.3278777"},{"key":"e_1_3_1_31_2","unstructured":"Keegan Hines Gary Lopez Matthew Hall Federico Zarfati Yonatan Zunger and Emre Kiciman. 2024. Defending against indirect prompt injection attacks with spotlighting. arXiv:2403.14720 (2024)."},{"key":"e_1_3_1_32_2","unstructured":"Sirui Hong Mingchen Zhuge Jonathan Chen Xiawu Zheng Yuheng Cheng Ceyao Zhang Jinlin Wang Zili Wang Steven Ka Shing Yau Zijuan Lin Liyang Zhou Chenyu Ran Lingfeng Xiao Chenglin Wu and J\u00fcrgen Schmidhuber. 2023. MetaGPT: Meta programming for a multi-agent collaborative framework. arXiv:2308.00352 (2023)."},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-1031"},{"key":"e_1_3_1_34_2","unstructured":"Hanxu Hu Pinzhen Chen and Edoardo M. Ponti. 2024. Fine-tuning large language models with sequential instructions. arXiv:2403.07794 (2024)."},{"key":"e_1_3_1_35_2","doi-asserted-by":"crossref","unstructured":"Jianheng Huang Leyang Cui Ante Wang Chengyi Yang Xinting Liao Linfeng Song Junfeng Yao and Jinsong Su. 2024. Mitigating catastrophic forgetting in large language models with self-synthesized rehearsal. arXiv:2403.01244 (2024).","DOI":"10.18653\/v1\/2024.acl-long.77"},{"key":"e_1_3_1_36_2","unstructured":"Jiangyong Huang Silong Yong Xiaojian Ma Xiongkun Linghu Puhao Li Yan Wang Qing Li Song-Chun Zhu Baoxiong Jia and Siyuan Huang. 2024. An embodied generalist agent in 3D world. arXiv:2311.12871 (2024)."},{"key":"e_1_3_1_37_2","unstructured":"Lei Huang Weijiang Yu Weitao Ma Weihong Zhong Zhangyin Feng Haotian Wang Qianglong Chen Weihua Peng Xiaocheng Feng Bing Qin and Ting Liu. 2023. A survey on hallucination in large language models: principles taxonomy challenges and open questions. arXiv:2311.05232 (2023)."},{"key":"e_1_3_1_38_2","unstructured":"Evan Hubinger Carson Denison Jesse Mu Mike Lambert Meg Tong Monte MacDiarmid Tamera Lanham Daniel M. Ziegler Tim Maxwell Newton Cheng et\u00a0al. 2024. Sleeper Agents: training deceptive LLMs that persist through safety training. arXiv:2401.05566 (2024)."},{"key":"e_1_3_1_39_2","doi-asserted-by":"crossref","first-page":"260","DOI":"10.18653\/v1\/2023.trustnlp-1.23","volume-title":"Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing (TrustNLP 2023)","author":"Ishihara Shotaro","year":"2023","unstructured":"Shotaro Ishihara. 2023. Training data extraction from pre-trained language models: A survey. In Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing (TrustNLP 2023) (Toronto, Canada), Anaelia Ovalle, Kai-Wei Chang, Ninareh Mehrabi, Yada Pruksachatkun, Aram Galystan, Jwala Dhamala, Apurv Verma, Trista Cao, Anoop Kumar, and Rahul Gupta (Eds.). Association for Computational Linguistics, 260\u2013275. Retrieved from https:\/\/aclanthology.org\/2023.trustnlp-1.23"},{"key":"e_1_3_1_40_2","doi-asserted-by":"crossref","unstructured":"Bargav Jayaraman Esha Ghosh Melissa Chase Sambuddha Roy Wei Dai and David Evans. 2023. Combing for credentials: Active pattern extraction from smart reply. arXiv:2207.10802 (2023).","DOI":"10.1109\/SP54263.2024.00041"},{"key":"e_1_3_1_41_2","unstructured":"Ziwei Ji Tiezheng Yu Yan Xu Nayeon Lee Etsuko Ishii and Pascale Fung. 2023. Towards mitigating LLM hallucination via self reflection. In Findings of the Association for Computational Linguistics: EMNLP 2023. 1827\u20131843."},{"key":"e_1_3_1_42_2","unstructured":"Tianjie Ju Yiting Wang Xinbei Ma Pengzhou Cheng Haodong Zhao Yulong Wang Lifeng Liu Jian Xie Zhuosheng Zhang and Gongshen Liu. 2024. Flooding spread of manipulated knowledge in LLM-based multi-agent communities. arXiv:2407.07791 (2024)."},{"key":"e_1_3_1_43_2","doi-asserted-by":"crossref","unstructured":"Nikhil Kandpal Krishna Pillutla Alina Oprea Peter Kairouz Christopher A. Choquette-Choo and Zheng Xu. 2024. User inference attacks on large language models. arXiv:2310.09266 (2024).","DOI":"10.18653\/v1\/2024.emnlp-main.1014"},{"key":"e_1_3_1_44_2","unstructured":"Siwon Kim Sangdoo Yun Hwaran Lee Martin Gubri Sungroh Yoon and Seong Joon Oh. 2023. ProPILE: Probing privacy leakage in large language models. arXiv:2307.01881 (2023)."},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.577"},{"key":"e_1_3_1_46_2","unstructured":"Seongyun Lee Sue Hyun Park Yongrae Jo and Minjoon Seo. 2024. Volcano: Mitigating multimodal hallucination through self-feedback guided revision. arXiv:2311.07362 (2024)."},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01316"},{"key":"e_1_3_1_48_2","unstructured":"Haoran Li Dadi Guo Wei Fan Mingshi Xu Jie Huang Fanpu Meng and Yangqiu Song. 2023. Multi-step jailbreaking privacy attacks on ChatGPT. arXiv:2304.05197 (2023)."},{"key":"e_1_3_1_49_2","unstructured":"Jiaju Lin Haoran Zhao Aochi Zhang Yiting Wu Huqiuyue Ping and Qin Chen. 2023. AgentSims: An open-source sandbox for large language model evaluation. arXiv:2308.04026 (2023)."},{"key":"e_1_3_1_50_2","unstructured":"Bingbin Liu Jordan T. Ash Surbhi Goel Akshay Krishnamurthy and Cyril Zhang. 2023. Exposing attention glitches with flip-flop language modeling. arXiv:2306.00946 (2023)."},{"key":"e_1_3_1_51_2","unstructured":"Fuxiao Liu Kevin Lin Linjie Li Jianfeng Wang Yaser Yacoob and Lijuan Wang. 2024. Mitigating hallucination in large multi-modal models via robust instruction tuning. arXiv:2306.14565 (2024)."},{"key":"e_1_3_1_52_2","volume-title":"Proceedings of the 12th International Conference on Learning Representations","author":"Liu Xiaogeng","year":"2024","unstructured":"Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models. In Proceedings of the 12th International Conference on Learning Representations. Retrieved from https:\/\/openreview.net\/forum?id=7Jwpw4qKkb"},{"key":"e_1_3_1_53_2","unstructured":"Xiao Liu Hao Yu Hanchen Zhang Yifan Xu Xuanyu Lei Hanyu Lai Yu Gu Hangliang Ding Kaiwen Men Kejuan Yang Shudan Zhang Xiang Deng Aohan Zeng Zhengxiao Du Chenhui Zhang Sheng Shen Tianjun Zhang Yu Su Huan Sun Minlie Huang Yuxiao Dong and Jie Tang. 2023. AgentBench: Evaluating LLMs as Agents. arXiv:2308.03688 (2023)."},{"key":"e_1_3_1_54_2","unstructured":"Yi Liu Gelei Deng Yuekang Li Kailong Wang Tianwei Zhang Yepang Liu Haoyu Wang Yan Zheng and Yang Liu. 2023. Prompt injection attack against LLM-integrated applications. arXiv:2306.05499 (2023)."},{"key":"e_1_3_1_55_2","unstructured":"Yuliang Liu Biao Yang Qiang Liu Zhang Li Zhiyin Ma Shuo Zhang and Xiang Bai. 2024. TextMonkey: An OCR-free large multimodal model for understanding document. arXiv:2403.04473 (2024)."},{"key":"e_1_3_1_56_2","doi-asserted-by":"crossref","unstructured":"Junyu Luo Cao Xiao and Fenglong Ma. 2024. Zero-resource hallucination prevention for large language models. In Findings of the Association for Computational Linguistics: EMNLP 2024. 3586\u20133602.","DOI":"10.18653\/v1\/2024.findings-emnlp.204"},{"key":"e_1_3_1_57_2","unstructured":"Yun Luo Zhen Yang Fandong Meng Yafu Li Jie Zhou and Yue Zhang. 2023. An empirical study of catastrophic forgetting in large language models during continual fine-tuning. arXiv:2308.08747 (2023)."},{"key":"e_1_3_1_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/3502728"},{"key":"e_1_3_1_59_2","doi-asserted-by":"crossref","unstructured":"Zhao Mandi Shreeya Jain and Shuran Song. 2023. RoCo: Dialectic Multi-Robot Collaboration with Large Language Models. arXiv:2307.04738 (2023).","DOI":"10.1109\/ICRA57147.2024.10610855"},{"key":"e_1_3_1_60_2","doi-asserted-by":"publisher","DOI":"10.3390\/electronics12030706"},{"key":"e_1_3_1_61_2","series-title":"Proceedings of Machine Learning Research","first-page":"353","volume-title":"Proceedings of the 3rd Machine Learning for Health Symposium","volume":"225","author":"Moor Michael","year":"2023","unstructured":"Michael Moor, Qian Huang, Shirley Wu, Michihiro Yasunaga, Yash Dalmia, Jure Leskovec, Cyril Zakka, Eduardo Pontes Reis, and Pranav Rajpurkar. 2023. Med-Flamingo: A Multimodal Medical Few-shot Learner. In Proceedings of the 3rd Machine Learning for Health Symposium(Proceedings of Machine Learning Research, Vol. 225). PMLR, 353\u2013367. Retrieved from https:\/\/proceedings.mlr.press\/v225\/moor23a.html"},{"key":"e_1_3_1_62_2","unstructured":"Yohei Nakajima. 2023. BabyAGI. GitHub repository. https:\/\/github.com\/yoheinakajima\/babyagi"},{"key":"e_1_3_1_63_2","unstructured":"Yuzhou Nie Zhun Wang Ye Yu Xian Wu Xuandong Zhao Wenbo Guo and Dawn Song. 2024. PrivAgent: Agentic-based Red-teaming for LLM Privacy Leakage. arXiv:2412.05734 (2024)."},{"key":"e_1_3_1_64_2","unstructured":"OpenAI Josh Achiam Steven Adler Sandhini Agarwal Lama Ahmad Ilge Akkaya Florencia Leoni Aleman Diogo Almeida Janko Altenschmidt Sam Altman et\u00a0al. 2024. GPT-4 Technical Report. arXiv:2303.08774 (2024)."},{"key":"e_1_3_1_65_2","doi-asserted-by":"crossref","unstructured":"Mustafa Safa Ozdayi Charith Peris Jack FitzGerald Christophe Dupuy Jimit Majmudar Haidar Khan Rahil Parikh and Rahul Gupta. 2023. Controlling the extraction of memorized data from large language models via prompt-tuning. arXiv:2305.11759 (2023).","DOI":"10.18653\/v1\/2023.acl-short.129"},{"key":"e_1_3_1_66_2","unstructured":"Jing-Cheng Pang Heng-Bo Fan Pengyuan Wang Jia-Hao Xiao Nan Tang Si-Hang Yang Chengxing Jia Sheng-Jun Huang and Yang Yu. 2024. Empowering language models with active inquiry for deeper understanding. arXiv:2402.03719 (2024)."},{"key":"e_1_3_1_67_2","doi-asserted-by":"publisher","DOI":"10.1145\/3586183.3606763"},{"key":"e_1_3_1_68_2","first-page":"27585","volume-title":"Proceedings of the 40th International Conference on Machine Learning","author":"Peng Liangzu","year":"2023","unstructured":"Liangzu Peng, Paris Giampouras, and Rene Vidal. 2023. The ideal continual learner: An agent that never forgets. In Proceedings of the 40th International Conference on Machine Learning. PMLR, 27585\u201327610. Retrieved from https:\/\/proceedings.mlr.press\/v202\/peng23a.html"},{"key":"e_1_3_1_69_2","volume-title":"The Bing AI Bot Has Been Secretly Running GPT-4","author":"Peters Jay","year":"2023","unstructured":"Jay Peters. 2023. The Bing AI Bot Has Been Secretly Running GPT-4. The Verge. Retrieved from https:\/\/www.theverge.com\/2023\/3\/14\/23639928\/microsoft-bing-chatbot-ai-gpt-4-llm"},{"key":"e_1_3_1_70_2","unstructured":"Xavier Puig Eric Undersander Andrew Szot Mikael Dallaire Cote Tsung-Yen Yang Ruslan Partsey Ruta Desai Alexander William Clegg Michal Hlavac So Yeon Min et\u00a0al. 2023. Habitat 3.0: A co-Habitat for humans avatars and robots. arXiv:2310.13724 (2023)."},{"key":"e_1_3_1_71_2","unstructured":"Reworkd. 2023. AgentGPT. GitHub repository. https:\/\/github.com\/reworkd\/AgentGPT"},{"key":"e_1_3_1_72_2","unstructured":"Alexander Robey Eric Wong Hamed Hassani and George J. Pappas. 2023. SmoothLLM: Defending large language models against jailbreaking attacks. arXiv:2310.03684 (2023)."},{"key":"e_1_3_1_73_2","unstructured":"Yangjun Ruan Honghua Dong Andrew Wang Silviu Pitis Yongchao Zhou Jimmy Ba Yann Dubois Chris J. Maddison and Tatsunori Hashimoto. 2024. Identifying the risks of LM agents with an LM-emulated sandbox. arXiv:2309.15817 (2024)."},{"key":"e_1_3_1_74_2","unstructured":"Erfan Shayegani Yue Dong and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. arXiv:2307.14539 (2023)."},{"key":"e_1_3_1_75_2","doi-asserted-by":"crossref","unstructured":"V. Shejwalkar and A. Houmansadr. 2021. Membership privacy for machine learning models through knowledge transfer. In Proceedings of the AAAI Conference on Artificial Intelligence 35 11 (2021) 9549-9557.","DOI":"10.1609\/aaai.v35i11.17150"},{"key":"e_1_3_1_76_2","unstructured":"Significant Gravitas. 2023. AutoGPT. GitHub repository. https:\/\/github.com\/Significant-Gravitas\/AutoGPT"},{"key":"e_1_3_1_77_2","unstructured":"Zhiqing Sun Sheng Shen Shengcao Cao Haotian Liu Chunyuan Li Yikang Shen Chuang Gan Liang-Yan Gui Yu-Xiong Wang Yiming Yang Kurt Keutzer and Trevor Darrell. 2023. Aligning large multimodal models with factually augmented RLHF. arXiv:2309.14525 (2023)."},{"key":"e_1_3_1_78_2","unstructured":"Yashar Talebirad and Amirhossein Nadiri. 2023. Multi-agent collaboration: Harnessing the power of intelligent LLM agents. arXiv:2306.03314 (2023)."},{"key":"e_1_3_1_79_2","unstructured":"Meng Tong Kejiang Chen Jie Zhang Yuang Qi Weiming Zhang Nenghai Yu Tianwei Zhang and Zhikun Zhang. 2024. InferDPT: Privacy-preserving inference for black-box large language model. arXiv:2310.12214 (2024)."},{"key":"e_1_3_1_80_2","doi-asserted-by":"crossref","first-page":"4769","DOI":"10.1109\/CVPR46437.2021.00474","volume-title":"Proceedings of the 2021 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Truong Jean-Baptiste","year":"2021","unstructured":"Jean-Baptiste Truong, Pratyush Maini, Robert J. Walls, and Nicolas Papernot. 2021. Data-free model extraction. In Proceedings of the 2021 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 4769\u20134778. Retrieved from https:\/\/ieeexplore.ieee.org\/document\/9577784"},{"key":"e_1_3_1_81_2","first-page":"4245","volume-title":"Proceedings of the 13th Language Resources and Evaluation Conference","author":"Vakili Thomas","year":"2022","unstructured":"Thomas Vakili, Anastasios Lamproudis, Aron Henriksson, and Hercules Dalianis. 2022. Downstream task performance of bert models pre-trained using automatically de-identified clinical data. In Proceedings of the 13th Language Resources and Evaluation Conference (Marseille, France), Nicoletta Calzolari, Fr\u00e9d\u00e9ric B\u00e9chet, Philippe Blache, Khalid Choukri, Christopher Cieri, Thierry Declerck, Sara Goggi, Hitoshi Isahara, Bente Maegaard, Joseph Mariani, H\u00e9l\u00e8ne Mazo, Jan Odijk, and Stelios Piperidis (Eds.). European Language Resources Association, 4245\u20134252. Retrieved from https:\/\/aclanthology.org\/2022.lrec-1.451"},{"key":"e_1_3_1_82_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10095147"},{"key":"e_1_3_1_83_2","unstructured":"Alexander Wan Eric Wallace Sheng Shen and Dan Klein. 2023. Poisoning language models during instruction tuning. arXiv:2305.00944 (2023)."},{"key":"e_1_3_1_84_2","doi-asserted-by":"publisher","DOI":"10.1109\/SRSE59585.2023.10336112"},{"key":"e_1_3_1_85_2","unstructured":"Junyang Wang Haiyang Xu Jiabo Ye Ming Yan Weizhou Shen Ji Zhang Fei Huang and Jitao Sang. 2024. Mobile-Agent: Autonomous multi-modal mobile device agent with visual perception. arXiv:2401.16158 (2024)."},{"key":"e_1_3_1_86_2","unstructured":"Kuan Wang Yadong Lu Michael Santacroce Yeyun Gong Chao Zhang and Yelong Shen. 2023. Adapting LLM agents through communication. arXiv:2310.01444 (2023)."},{"key":"e_1_3_1_87_2","doi-asserted-by":"crossref","unstructured":"Lei Wang Chen Ma Xueyang Feng Zeyu Zhang Hao Yang Jingsen Zhang Zhiyuan Chen Jiakai Tang Xu Chen Yankai Lin Wayne Xin Zhao Zhewei Wei and Ji-Rong Wen. 2023. A survey on large language model based autonomous agents. arXiv:2308.11432 (2023).","DOI":"10.1007\/s11704-024-40231-1"},{"key":"e_1_3_1_88_2","unstructured":"Shenzhi Wang Chang Liu Zilong Zheng Siyuan Qi Shuo Chen Qisen Yang Andrew Zhao Chaofei Wang Shiji Song and Gao Huang. 2023. Avalon\u2019s game of thoughts: battle against deception through recursive contemplation. arXiv:2310.01320 (2023)."},{"key":"e_1_3_1_89_2","unstructured":"Shen Wang Tianlong Xu Hang Li Chaoli Zhang Joleen Liang Jiliang Tang Philip S. Yu and Qingsong Wen. 2024. Large language models for education: A survey and outlook. arXiv:2403.18105 (2024)."},{"key":"e_1_3_1_90_2","doi-asserted-by":"crossref","unstructured":"Shang Wang Tianqing Zhu Bo Liu Ming Ding Dayong Ye Wanlei Zhou and Philip S. Yu. 2025. Unique security and privacy threats of large language models: A comprehensive survey. ACM Computing Surveys 58 4 (2025) 1\u201336.","DOI":"10.1145\/3764113"},{"key":"e_1_3_1_91_2","unstructured":"Tianyu Wang Yifan Li Haitao Lin Xiangyang Xue and Yanwei Fu. 2023. WALL-E: Embodied robotic waiter load lifting with large language model. arXiv:2308.15962 (2023)."},{"key":"e_1_3_1_92_2","doi-asserted-by":"crossref","unstructured":"Yuntao Wang Yanghe Pan Miao Yan Zhou Su and Tom H. Luan. 2023. A survey on ChatGPT: AI-generated contents challenges and solutions. IEEE Open Journal of the Computer Society 4 1 (2023) 280\u2013302.","DOI":"10.1109\/OJCS.2023.3300321"},{"key":"e_1_3_1_93_2","unstructured":"Yufei Wang Wanjun Zhong Liangyou Li Fei Mi Xingshan Zeng Wenyong Huang Lifeng Shang Xin Jiang and Qun Liu. 2023. Aligning large language models with human: A survey. arXiv:2307.12966 (2023)."},{"key":"e_1_3_1_94_2","unstructured":"Zhenhua Wang Wei Xie Kai Chen Baosheng Wang Zhiwen Gui and Enze Wang. 2023. Self-Deception: Reverse penetrating the semantic firewall of large language models. arXiv:2308.11521 (2023)."},{"key":"e_1_3_1_95_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.48"},{"key":"e_1_3_1_96_2","unstructured":"Chenfei Wu Shengming Yin Weizhen Qi Xiaodong Wang Zecheng Tang and Nan Duan. 2023. Visual ChatGPT: Talking drawing and editing with visual foundation models. arXiv:2303.04671 (2023)."},{"key":"e_1_3_1_97_2","unstructured":"Zhiheng Xi Wenxiang Chen Xin Guo Wei He Yiwen Ding Boyang Hong Ming Zhang Junzhe Wang Senjie Jin Enyu Zhou et\u00a0al. 2023. The rise and potential of large language model based agents: A survey. arXiv:2309.07864 (2023)."},{"key":"e_1_3_1_98_2","doi-asserted-by":"crossref","unstructured":"Junlin Xie Zhihong Chen Ruifei Zhang Xiang Wan and Guanbin Li. 2024. Large multimodal agents: A survey. arXiv:2402.15116 (2024).","DOI":"10.1007\/s44267-025-00093-y"},{"key":"e_1_3_1_99_2","doi-asserted-by":"crossref","unstructured":"Lin Xu Zhiyuan Hu Daquan Zhou Hongyu Ren Zhen Dong Kurt Keutzer See Kiong Ng and Jiashi Feng. 2023. MAgIC: Investigation of large language model powered multi-agent in cognition adaptability rationality and collaboration. arXiv:2311.08562 (2023).","DOI":"10.18653\/v1\/2024.emnlp-main.416"},{"key":"e_1_3_1_100_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.258"},{"key":"e_1_3_1_101_2","doi-asserted-by":"crossref","unstructured":"Mingfu Xue Chengxiang Yuan Heyi Wu Yushu Zhang and Weiqiang Liu. 2020. Machine learning security: threats countermeasures and evaluations. IEEE Access 8 (2020) 74720\u201374742.","DOI":"10.1109\/ACCESS.2020.2987435"},{"key":"e_1_3_1_102_2","unstructured":"Lu Yan Zhuo Zhang Guanhong Tao Kaiyuan Zhang Xuan Chen Guangyu Shen and Xiangyu Zhang. 2023. ParaFuzz: An interpretability driven technique for detecting poisoned samples in NLP. arXiv:2308.02122 (2023)."},{"key":"e_1_3_1_103_2","unstructured":"Haomiao Yang Kunlan Xiang Mengyu Ge Hongwei Li Rongxing Lu and Shui Yu. 2023. A comprehensive overview of backdoor attacks in large language models within communication networks. arXiv:2308.14367 (2023)."},{"key":"e_1_3_1_104_2","doi-asserted-by":"crossref","unstructured":"Jihan Yang Runyu Ding Ellis Brown Xiaojuan Qi and Saining Xie. 2024. V-IRL: Grounding virtual intelligence in real life. arXiv:2402.03310 (2024).","DOI":"10.1007\/978-3-031-72995-9_3"},{"key":"e_1_3_1_105_2","unstructured":"Wenkai Yang Xiaohan Bi Yankai Lin Sishuo Chen Jie Zhou and Xu Sun. 2024. Watch out for your agents! Investigating backdoor threats to LLM-based agents. arXiv:2402.11208 (2024)."},{"key":"e_1_3_1_106_2","unstructured":"Zhengyuan Yang Linjie Li Jianfeng Wang Kevin Lin Ehsan Azarnasab Faisal Ahmed Zicheng Liu Ce Liu Michael Zeng and Lijuan Wang. 2023. MM-REACT: Prompting ChatGPT for multimodal reasoning and action. arXiv:2303.11381 (2023)."},{"key":"e_1_3_1_107_2","series-title":"NIPS \u201923","first-page":"11809","volume-title":"Proceedings of the 37th International Conference on Neural Information Processing Systems","author":"Yao Shunyu","year":"2023","unstructured":"Shunyu Yao, Dian Yu, Jeffrey Zhao, Izhak Shafran, Thomas L. Griffiths, Yuan Cao, and Karthik Narasimhan. 2023. Tree of thoughts: Deliberate problem solving with large language models. In Proceedings of the 37th International Conference on Neural Information Processing Systems (Red Hook, NY, USA) (NIPS \u201923). Curran Associates Inc., 11809\u201311822."},{"key":"e_1_3_1_108_2","unstructured":"Shunyu Yao Jeffrey Zhao Dian Yu Nan Du Izhak Shafran Karthik Narasimhan and Yuan Cao. 2023. ReAct: Synergizing reasoning and acting in language models. arXiv:2210.03629 (2023)."},{"key":"e_1_3_1_109_2","doi-asserted-by":"crossref","unstructured":"Yifan Yao Jinhao Duan Kaidi Xu Yuanfang Cai Eric Sun and Yue Zhang. 2023. A survey on large language model (LLM) security and privacy: The good the bad and the ugly. arXiv:2312.02003 (2023).","DOI":"10.1016\/j.hcc.2024.100211"},{"key":"e_1_3_1_110_2","unstructured":"Jingwei Yi Yueqi Xie Bin Zhu Keegan Hines Emre Kiciman Guangzhong Sun Xing Xie and Fangzhao Wu. 2023. Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv:2312.14197 (2023)."},{"key":"e_1_3_1_111_2","unstructured":"Shukang Yin Chaoyou Fu Sirui Zhao Tong Xu Hao Wang Dianbo Sui Yunhang Shen Ke Li Xing Sun and Enhong Chen. 2023. Woodpecker: Hallucination correction for multimodal large language models. arXiv:2310.16045 (2023)."},{"key":"e_1_3_1_112_2","unstructured":"Sheng Yin Xianghe Pang Yuanzhuo Ding Menglan Chen Yutong Bi Yichen Xiong Wenhao Huang Zhen Xiang Jing Shao and Siheng Chen. 2024. SafeAgentBench: A benchmark for safe task planning of embodied LLM agents. arXiv:2412.13178 (2024)."},{"key":"e_1_3_1_113_2","unstructured":"Ziyi Yin Muchao Ye Tianrong Zhang Tianyu Du Jinguo Zhu Han Liu Jinghui Chen Ting Wang and Fenglong Ma. 2024. VLATTACK: Multimodal adversarial attacks on vision-language tasks via Pre-trained models. arXiv:2310.04655 (2024)."},{"key":"e_1_3_1_114_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Yu Da","year":"2021","unstructured":"Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et\u00a0al. 2021. Differentially private fine-tuning of language models. In Proceedings of the International Conference on Learning Representations. Retrieved from https:\/\/openreview.net\/forum?id=Q42f0dfjECO"},{"key":"e_1_3_1_115_2","unstructured":"Jiahao Yu Xingwei Lin Zheng Yu and Xinyu Xing. 2023. GPTFUZZER: Red teaming large language models with auto-generated jailbreak prompts. arXiv:2309.10253 (2023)."},{"key":"e_1_3_1_116_2","doi-asserted-by":"crossref","unstructured":"Ziqi Yuan Yihe Liu Hua Xu and Kai Gao. 2024. Noise imitation based adversarial training for robust multimodal sentiment analysis. IEEE Transactions on Multimedia 26 (2024) 529\u2013539.","DOI":"10.1109\/TMM.2023.3267882"},{"key":"e_1_3_1_117_2","unstructured":"Bohan Zhai Shijia Yang Chenfeng Xu Sheng Shen Kurt Keutzer Chunyuan Li and Manling Li. 2024. HallE-Control: Controlling object hallucination in large multimodal models. arXiv:2310.01779 (2024)."},{"key":"e_1_3_1_118_2","unstructured":"Yuexiang Zhai Shengbang Tong Xiao Li Mu Cai Qing Qu Yong Jae Lee and Yi Ma. 2023. Investigating the catastrophic forgetting in multimodal large language models. arXiv:2309.10313 (2023)."},{"key":"e_1_3_1_119_2","doi-asserted-by":"crossref","unstructured":"Qiusi Zhan Zhixiang Liang Zifan Ying and Daniel Kang. 2024. InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents. arXiv:2403.02691 (2024).","DOI":"10.18653\/v1\/2024.findings-acl.624"},{"key":"e_1_3_1_120_2","doi-asserted-by":"crossref","unstructured":"Shuo Zhang Liangming Pan Junzhou Zhao and William Yang Wang. 2024. The knowledge alignment problem: Bridging human and external knowledge for large language Models. arXiv:2305.13669 (2024).","DOI":"10.18653\/v1\/2024.findings-acl.121"},{"key":"e_1_3_1_121_2","unstructured":"Yuyang Zhang Kangjie Chen Xudong Jiang Yuxiang Sun Run Wang and Lina Wang. 2024. Towards action hijacking of large language model-based agent. arXiv:2412.10807 (2024)."},{"key":"e_1_3_1_122_2","unstructured":"Zhexin Zhang Shiyao Cui Yida Lu Jingzhuo Zhou Junxiao Yang Hongning Wang and Minlie Huang. 2024. Agent-safety bench: Evaluating the safety of LLM agents. arXiv:2412.14470 (2024)."},{"key":"e_1_3_1_123_2","doi-asserted-by":"publisher","DOI":"10.1145\/3613904.3642385"},{"key":"e_1_3_1_124_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.481"},{"key":"e_1_3_1_125_2","unstructured":"Qiwei Zhao Xujiang Zhao Yanchi Liu Wei Cheng Yiyou Sun Mika Oishi Takao Osaki Katsushi Matsuda Huaxiu Yao and Haifeng Chen. 2024. SAUP: Situation awareness uncertainty propagation on LLM agent. arXiv:2412.01033 (2024)."},{"key":"e_1_3_1_126_2","unstructured":"Qingxiao Zheng Zhongwei Xu Abhinav Choudhary Yuting Chen Yongming Li and Yun Huang. 2023. Synergizing human-AI agency: A guide of 23 heuristics for service co-creation with LLM-based agents. arXiv:2310.15065 (2023)."},{"key":"e_1_3_1_127_2","doi-asserted-by":"crossref","unstructured":"Wanjun Zhong Ruixiang Cui Yiduo Guo Yaobo Liang Shuai Lu Yanlin Wang Amin Saied Weizhu Chen and Nan Duan. 2023. AGIEval: A human-centric benchmark for evaluating foundation models. arXiv:2304.06364 (2023).","DOI":"10.18653\/v1\/2024.findings-naacl.149"},{"key":"e_1_3_1_128_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i17.29946"},{"key":"e_1_3_1_129_2","first-page":"3827","volume-title":"Proceedings of the 34th USENIX Security Symposium (USENIX Security 25)","author":"Zou Wei","year":"2025","unstructured":"Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. PoisonedRAG: Knowledge poisoning attacks to retrieval-augmented generation of large language models. In Proceedings of the 34th USENIX Security Symposium (USENIX Security 25). 3827\u20133844."}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3773080","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,9]],"date-time":"2025-12-09T15:20:04Z","timestamp":1765293604000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3773080"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,9]]},"references-count":128,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2026,4,30]]}},"alternative-id":["10.1145\/3773080"],"URL":"https:\/\/doi.org\/10.1145\/3773080","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,12,9]]},"assertion":[{"value":"2024-07-29","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-17","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}