Cross-LLM Attacks COASP Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is investigating a potential cross-LLM attack where an attacker embeds malicious content in a document that is summarized by LLM A, and the summary is then used as input to LLM B. The team has access to logs of all inputs and outputs. They notice that LLM B's output is anomalous only when the summary contains a specific phrase. What is the BEST way to confirm the attack?

   • ACheck if the specific phrase is also present in the original document.
   • BReplay the exact same summary into LLM B in a controlled environment and observe if the anomalous behavior repeats.
   • CCheck if LLM A has been compromised by a direct prompt injection attack.
   • DReview LLM B's training data for any malicious examples.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security analyst is investigating an incident where a prompt injection payload spread from a public LLM to an internal LLM. The public LLM's output was automatically fed into the internal LLM's API. The analyst notices that the internal LLM's behavior changed only when the public LLM's output contained a specific phrase. Which detection method would have been most effective at identifying this cross-LLM attack?

   • AMonitor the internal LLM's input for the specific phrase and alert when it appears.
   • BMonitor the flow of outputs from the public LLM to the internal LLM and flag any output that contains instruction-like patterns.
   • CMonitor the network traffic between the two LLMs for unusual packet sizes.
   • DMonitor the internal LLM's output for unexpected data exfiltration patterns.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a common vector that enables cross-LLM attack propagation?

   • AShared prompts used across multiple LLM systems.
   • BThe brand name of the LLM provider.
   • CThe physical location of the LLM servers.
   • DThe color scheme of the LLM's user interface.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company operates a document summarization LLM and a question-answering LLM. The summarization LLM's output is fed directly into the question-answering LLM to answer user queries. Security wants to prevent any malicious content in the summaries from affecting the question-answering LLM. Which mitigation is MOST effective?

   • AUse a different LLM provider for the question-answering LLM to ensure architectural diversity.
   • BRetrain the question-answering LLM with examples of malicious summaries to make it resistant.
   • CApply output filtering on the summarization LLM to remove any instruction-like text before it is passed to the question-answering LLM.
   • DIncrease the temperature setting of the question-answering LLM to reduce its susceptibility to injected instructions.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is model-to-model data poisoning?

   • AA process where one model's output is used to improve another model's performance legitimately.
   • BA process where poisoned outputs from one model contaminate the training data or fine-tuning of another model.
   • CA process where a model's outputs are deleted to prevent data leakage.
   • DA process where a model is trained on data from multiple sources to increase its accuracy.
   Reveal Solution Discussion Select an answer first