@inproceedings{Pasquini2025LLMmap, author = {Dario Pasquini and Evgenios M. Kornaropoulos and Giuseppe Ateniese}, title = {LLMmap: Fingerprinting for Large Language Models}, booktitle = {34th {USENIX} Security Symposium, {USENIX} Security 2025, Seattle, WA, USA, August 13-15, 2025}, pages = {299--318}, publisher = {{USENIX} Association}, year = {2025}, url = {https://www.usenix.org/conference/usenixsecurity25/presentation/pasquini}, timestamp = {Fri, 31 Oct 2025 16:17:35 +0100}, } @inproceedings{gubri2024trap, author = {Martin Gubri and Dennis Ulmer and Hwaran Lee and Sangdoo Yun and Seong Joon Oh}, title = {{TRAP:} Targeted Random Adversarial Prompt Honeypot for Black-Box Identification}, booktitle = {Findings of the Association for Computational Linguistics, {ACL} 2024, Bangkok, Thailand and virtual meeting, August 11-16, 2024}, series = {Findings of {ACL}}, pages = {11496--11517}, publisher = {Association for Computational Linguistics}, year = {2024}, url = {https://doi.org/10.18653/v1/2024.findings-acl.683}, doi = {10.18653/V1/2024.FINDINGS-ACL.683}, timestamp = {Tue, 27 Jan 2026 20:26:47 +0100}, } @misc{dao2022flashattention, title = {FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awareness}, author = {Tri Dao and Daniel Y. Fu and Stefano Ermon and Atri Rudra and Christopher R\'e}, howpublished = {arXiv 2205.14135}, year = 2022 } @misc{dao2023flashattention2, title = {FlashAttention-2: Faster Attention with Better Parallelism and Work Partitioning}, author = {Tri Dao}, howpublished = {arXiv 2307.08691}, year = 2023 } @article{golden2024flashattentionstable, author = {Alicia Golden and Samuel Hsia and Fei Sun and Bilge Acun and Basil Hosmer and Yejin Lee and Zachary DeVito and Jeff Johnson and Gu{-}Yeon Wei and David Brooks and Carole{-}Jean Wu}, title = {Is Flash Attention Stable?}, journal = {CoRR}, volume = {abs/2405.02803}, year = {2024}, url = {https://doi.org/10.48550/arXiv.2405.02803}, eprinttype = {arXiv}, eprint = {2405.02803}, timestamp = {Wed, 11 Mar 2026 15:53:29 +0100}, biburl = {https://dblp.org/rec/journals/corr/abs-2405-02803.bib}, bibsource = {dblp computer science bibliography, https://dblp.org} } @inproceedings{moller2025adversarial, author = {Jonas M{\"{o}}ller and Lukas Pirch and Felix Weissberg and Sebastian Baunsgaard and Thorsten Eisenhofer and Konrad Rieck}, title = {Adversarial Inputs for Linear Algebra Backends}, booktitle = {Forty-second International Conference on Machine Learning, {ICML} 2025, Vancouver, BC, Canada, July 13-19, 2025}, series = {Proceedings of Machine Learning Research}, publisher = {{PMLR} / OpenReview.net}, year = {2025}, url = {https://proceedings.mlr.press/v267/moller25a.html}, timestamp = {Wed, 04 Feb 2026 17:22:46 +0100}, biburl = {https://dblp.org/rec/conf/icml/MollerPWBER25.bib}, bibsource = {dblp computer science bibliography, https://dblp.org} } @misc{ring2025triton, title = {The Anatomy of a Triton Attention Kernel}, author = {Burkhard Ringlein and Jan van Lunteren and Radu Stoica and Thomas Parnell}, year = 2025, howpublished = {arXiv 2511.11581}, } @inproceedings{schlogl2024causes, author = {Alexander Schl{\"{o}}gl and Nora Hofer and Rainer B{\"{o}}hme}, title = {Causes and Effects of Unanticipated Numerical Deviations in Neural Network Inference Frameworks}, booktitle = {Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023}, year = {2023}, url = {http://papers.nips.cc/paper\_files/paper/2023/hash/af076c3bdbf935b81d808e37c5ede463-Abstract-Conference.html}, timestamp = {Fri, 01 Mar 2024 16:26:20 +0100}, } @misc{shah2024flashattention3, title = {FlashAttention-3: Fast and Accurate Attention with Asynchrony and Low-precision}, author = {Jay Shah and Ganesh Bikshandi and Ying Zhang and Vijay Thakkar and Pradeep Ramani and Tri Dao}, howpublished = {arXiv 2407.08608}, year = 2024 } @inproceedings{yuan2025understanding, title = {Understanding and Mitigating Numerical Sources of Nondeterminism in LLM Inference}, author = {Jiayi Yuan and Hao Li and Xinheng Ding and Wenya Xie and Yu-Jhe Li and Wentian Zhao and Kun Wan and Jing Shi and Xia Hu and Zirui Liu}, booktitle = {Annual Conference on Neural Information Processing Systems}, year = 2025, } @inproceedings{zhang2024hardware, title={Hardware and Software Platform Inference}, author={Cheng Zhang and Hanna Foerster and Robert D. Mullins and Yiren Zhao and Ilia Shumailov}, booktitle={Forty-second International Conference on Machine Learning}, year={2025}, url={https://openreview.net/forum?id=kdmjVF1iDO} } @inproceedings{ gloaguen2026llm, title={{LLM} Fingerprinting via Semantically Conditioned Watermarks}, author={Thibaud Gloaguen and Robin Staab and Nikola Jovanovi{\'c} and Martin Vechev}, booktitle={The Fourteenth International Conference on Learning Representations}, year={2026}, url={https://openreview.net/forum?id=t38nZqqi3Z} } @inproceedings{ chauvin2026log, title={Log Probability Tracking of {LLM} {API}s}, author={Timothee Chauvin and Erwan Le Merrer and Francois Taiani and Gilles Tredan}, booktitle={The Fourteenth International Conference on Learning Representations}, year={2026}, url={https://openreview.net/forum?id=hFxivbAgVP} } @inproceedings{hui2024pleak, author = {Hui, Bo and Yuan, Haolin and Gong, Neil and Burlina, Philippe and Cao, Yinzhi}, title = {PLeak: Prompt Leaking Attacks against Large Language Model Applications}, year = {2024}, isbn = {9798400706363}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, url = {https://doi.org/10.1145/3658644.3670370}, booktitle = {Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security}, pages = {3600–3614}, numpages = {15}, keywords = {large language model (llm) applications, prompt leaking attack}, location = {Salt Lake City, UT, USA}, series = {CCS '24} } @inproceedings{yang2025prsa, author = {Yong Yang and Changjiang Li and Qingming Li and Oubo Ma and Haoyu Wang and Zonghui Wang and Yandong Gao and Wenzhi Chen and Shouling Ji}, title = {{PRSA:} Prompt Stealing Attacks against Real-World Prompt Services}, booktitle = {34th {USENIX} Security Symposium, {USENIX} Security 2025, Seattle, WA, USA, August 13-15, 2025}, pages = {2283--2302}, publisher = {{USENIX} Association}, year = {2025}, url = {https://www.usenix.org/conference/usenixsecurity25/presentation/yang-yong}, timestamp = {Wed, 05 Nov 2025 20:38:44 +0100}, biburl = {https://dblp.org/rec/conf/uss/YangLLMWWGCJ25.bib}, bibsource = {dblp computer science bibliography, https://dblp.org} } @inproceedings{vaswani2017attention, author = {Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and Jones, Llion and Gomez, Aidan N. and Kaiser, \L{}ukasz and Polosukhin, Illia}, title = {Attention is all you need}, year = {2017}, isbn = {9781510860964}, publisher = {Curran Associates Inc.}, address = {Red Hook, NY, USA}, booktitle = {Proceedings of the 31st International Conference on Neural Information Processing Systems}, pages = {6000–6010}, numpages = {11}, location = {Long Beach, California, USA}, series = {NIPS'17} } @inproceedings{kwon2023efficientmemorymanagementlarge_vllm, author = {Kwon, Woosuk and Li, Zhuohan and Zhuang, Siyuan and Sheng, Ying and Zheng, Lianmin and Yu, Cody Hao and Gonzalez, Joseph and Zhang, Hao and Stoica, Ion}, title = {Efficient Memory Management for Large Language Model Serving with PagedAttention}, year = {2023}, isbn = {9798400702297}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, url = {https://doi.org/10.1145/3600006.3613165}, doi = {10.1145/3600006.3613165}, booktitle = {Proceedings of the 29th Symposium on Operating Systems Principles}, pages = {611–626}, numpages = {16}, location = {Koblenz, Germany}, series = {SOSP '23} } @inproceedings{zheng2024sglangefficientexecutionstructured, author = {Zheng, Lianmin and Yin, Liangsheng and Xie, Zhiqiang and Sun, Chuyue and Huang, Jeff and Yu, Cody Hao and Cao, Shiyi and Kozyrakis, Christos and Stoica, Ion and Gonzalez, Joseph E. and Barrett, Clark and Sheng, Ying}, title = {SGLang: efficient execution of structured language model programs}, year = {2024}, isbn = {9798331314385}, publisher = {Curran Associates Inc.}, address = {Red Hook, NY, USA}, booktitle = {Proceedings of the 38th International Conference on Neural Information Processing Systems}, articleno = {2000}, numpages = {27}, location = {Vancouver, BC, Canada}, series = {NIPS '24} } @misc{tensorrtllm2023, author = {{NVIDIA}}, title = {{TensorRT-LLM}: A {TensorRT} Toolbox for Optimized Large Language Model Inference}, year = {2023}, howpublished = {\url{https://github.com/NVIDIA/TensorRT-LLM}}, note = {Accessed: April 2026} } @misc{lmdeploy2023, author = {{OpenMMLab}}, title = {{LMDeploy}: A Toolkit for Compressing, Deploying, and Serving {LLM}}, year = {2023}, howpublished = {\url{https://github.com/InternLM/lmdeploy}}, note = {Accessed: April 2026} } @inproceedings{carlini2024stealing, author = {Nicholas Carlini and Daniel Paleka and Krishnamurthy Dj Dvijotham and Thomas Steinke and Jonathan Hayase and A. Feder Cooper and Katherine Lee and Matthew Jagielski and Milad Nasr and Arthur Conmy and Eric Wallace and David Rolnick and Florian Tram{\`{e}}r}, title = {Stealing part of a production language model}, booktitle = {Forty-first International Conference on Machine Learning, {ICML} 2024, Vienna, Austria, July 21-27, 2024}, series = {Proceedings of Machine Learning Research}, pages = {5680--5705}, publisher = {{PMLR} / OpenReview.net}, year = {2024}, url = {https://proceedings.mlr.press/v235/carlini24a.html}, timestamp = {Mon, 09 Feb 2026 17:23:53 +0100}, } @inproceedings{luo2025shadowcache, title={Shadow in the cache: Unveiling and mitigating privacy risks of kv-cache in llm inference}, author={Luo, Zhifan and Shao, Shuo and Zhang, Su and Zhou, Lijing and Hu, Yuke and Zhao, Chenxu and Liu, Zhihao and Qin, Zhan}, year={2026}, organization={NDSS} } @inproceedings{wu2025promptleakage, title={I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving.}, author={Wu, Guanlong and Zhang, Zheng and Zhang, Yao and Wang, Weili and Niu, Jianyu and Wu, Ye and Zhang, Yinqian}, booktitle={NDSS}, year={2025} } @inproceedings{clark2019boolq, title = {BoolQ: Exploring the Surprising Difficulty of Natural Yes/No Questions}, author={Clark, Christopher and Lee, Kenton and Chang, Ming-Wei and Kwiatkowski, Tom and Collins, Michael and Toutanova, Kristina}, booktitle = {NAACL}, year = {2019} } @misc{cve_2026_22778, author = {MITRE}, title = {{CVE-2026-22778}: Remote Code Execution in {vLLM} Multimodal Video Processing}, howpublished = {\url{https://nvd.nist.gov/vuln/detail/CVE-2026-22778}}, year = {2026}, note = {CVSS 9.8 (Critical)} } @misc{cve_2026_27893, author = {MITRE}, title = {{CVE-2026-27893}: Remote Code Execution in {vLLM} via {\texttt{trust\_remote\_code}} Bypass}, howpublished = {\url{https://nvd.nist.gov/vuln/detail/CVE-2026-27893}}, year = {2026}, note = {CVSS 8.8 (High)} } @misc{cve_2026_5760, author = {MITRE}, title = {{CVE-2026-5760}: Remote Code Execution in {SGLang} via Server-Side Template Injection in {GGUF} Chat Templates}, howpublished = {\url{https://nvd.nist.gov/vuln/detail/CVE-2026-5760}}, year = {2026}, note = {CVSS 9.8 (Critical)} } @inproceedings{wu2026promptpeek, author = {Guanlong Wu and Zheng Zhang and Yao Zhang and Weili Wang and Jianyu Niu and Ye Wu and Yinqian Zhang}, title = {I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant {LLM} Serving}, booktitle = {32nd Annual Network and Distributed System Security Symposium, {NDSS} 2025, San Diego, California, USA, February 24-28, 2025}, publisher = {The Internet Society}, year = {2025}, timestamp = {Mon, 07 Apr 2025 08:23:04 +0200}, } @inproceedings{wu2026cache, author = {XiangFan Wu and Lingyun Ying and Guoqiang Chen and Yacong Gu and Haipeng Qu}, title = {Cache Me, Catch You: Cache Related Security Threats in {LLM} Serving Frameworks}, booktitle = {33rd Annual Network and Distributed System Security Symposium, {NDSS} 2026, San Diego, California, USA, February 23-27, 2026}, publisher = {The Internet Society}, year = {2026}, timestamp = {Tue, 05 May 2026 16:25:44 +0200}, } @inproceedings{wu2026cachepoisoning, author = {Wu, Guanlong and Wang, Taojie and Zhang, Yao and Zhang, Zheng and Niu, Jianyu and Wu, Ye and Zhang, Yinqian}, title = {{When Cache Poisoning Meets LLM Systems: Semantic Cache Poisoning and Its Countermeasures}}, booktitle = {Proc. of the Network and Distributed System Security Symposium (NDSS)}, year = {2026} } @misc{prompts_chat_2022, author = {Fatih Ka{\c{c}}maz and contributors}, title = {prompts.chat: A Curated Collection of ChatGPT Prompts}, year = {2022}, howpublished = {\url{https://huggingface.co/datasets/fka/prompts.chat}}, note = {Accessed: May 2026. License: CC0 1.0 Universal} } @inproceedings{renze-2024-effect, title = "The Effect of Sampling Temperature on Problem Solving in Large Language Models", author = "Renze, Matthew", booktitle = "Findings of the Association for Computational Linguistics: EMNLP 2024", month = nov, year = "2024", address = "Miami, Florida, USA", publisher = "Association for Computational Linguistics", url = "https://aclanthology.org/2024.findings-emnlp.432/", doi = "10.18653/v1/2024.findings-emnlp.432", pages = "7346--7356" } @inproceedings{douceur2002sybil, author = {Douceur, John R.}, title = {The {Sybil} Attack}, booktitle = {Peer-to-Peer Systems}, volume = {2429}, pages = {251--260}, year = {2002}, }