Search papers, labs, and topics across Lattice.
This paper investigates the vulnerability of Large Language Models (LLMs) used in Security Operations Centers, revealing that adversaries can exploit passive prompt injection by embedding malicious payloads in log entries, which are then executed when the LLM processes these logs. Using the LogInject framework, the authors benchmarked 12,847 log entries, finding an alarming average attack success rate of 83.4% across three production LLMs, with a peak of 88.2%. To address these threats, they introduce Context Stitching to fragment payloads and propose layered defense strategies that reduce attack success by 90.4%, though a residual vulnerability of 8.4% remains.
Adversaries can achieve up to 88.2% success in exploiting LLMs for log analysis through passive prompt injection, highlighting a critical security vulnerability.
Large Language Models are increasingly deployed in Security Operations Centers for log analysis tasks including summarization, alert triage, and threat investigation. These systems ingest logs from external-facing services and process network logs as natural language contexts to generate security insights. We demonstrate that this architectural pattern introduces a critical vulnerability: adversaries can embed prompt injection payloads in log-generating fields that persist in storage and are executed when analysts query the LLM, achieving what we term passive prompt injection. We present LogInject, a systematic framework for evaluating these threats. Using LogInject-1.0, a benchmark of 12,847 log entries including 2,569 adversarial samples, we evaluate three production LLMs across four attack objectives: activity concealment, false positive generation, information exfiltration, and output hijacking. Our findings reveal an up to 88.2% attack success rate (83.4% average across models) under the baseline conditions. We introduce Context Stitching, a novel technique that fragments payloads across multiple log entries to evade stateless filters while exploiting LLM long-context reasoning, achieving a 76.4% success rate. As mitigation, we evaluate layered defenses by combining input filtering, prompt hardening, and output validation, demonstrating a 90.4% attack reduction, although 8.4% residual vulnerability persists. Our results establish that LLM-based log analysis creates an inherent confused deputy vulnerability where untrusted data and trusted instructions compete indistinguishably for model attention, requiring defense in-depth architectures and continued human oversight for security-critical decisions.
