Bilkent University
Department of Computer Engineering
SEMINAR
LLM Contexts Have No Walls: From Prompt Injection to Subliminal Leakage
Asst.Prof.Yiğitcan Kaya
Indiana University Bloomington
Abstract: LLM applications place instructions, user inputs, retrieved content, and sensitive data in the same context. Developers rely on role, trust, and task boundaries to control how each input can affect the model’s output. This talk examines what happens when those boundaries fail. First, I present a large-scale study of 17 third-party chatbot plugins deployed across more than 10,000 websites. We find that insecure handling of conversation history and retrieved web content allows attackers to cross role and trust boundaries. These design flaws make direct and indirect prompt injection attacks significantly more effective and undermine safeguards built into modern LLMs. I then present ongoing work on subliminal leakage: how secrets can leave detectable traces in an LLM’s output, even when unrelated to the task. For example, a secret PIN in the model’s context can subtly influence its response to a request to draft an email. Although the PIN never appears in the response, we show that its influence is measurable: a statistical test can distinguish output distributions associated with different secrets. Together, these works expose two forms of unintended information flow in LLM systems. Untrusted data can gain influence over model behavior, while private data can influence outputs that should be independent of it. Addressing these risks requires stronger guarantees for context integrity and noninterference.
Biography: Yigitcan Kaya (https://yigitcankaya.github.io/) is an assistant professor at Indiana University Bloomington. Previously, he was a postdoctoral fellow at UC Santa Barbara, where he worked with Giovanni Vigna and Chris Kruegel. He received his Ph.D. from the University of Maryland, College Park. His research sits at the intersection of trustworthy AI and systems security, with a focus on how AI systems behave in real-world, security-critical settings. His work has been supported by a U.S. Intelligence Community Postdoctoral Fellowship and an Amazon Research Award.
DATE: November 02, 2026 Monday @ 14:30
Place: Mithat Coruh Amphiteathre