Pith. sign in

REVIEW 5 major objections 6 minor 4 cited by

Understanding the Supply Chain and Risks of Large Language Model Applications

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper introduces LLMSCBench, the first dataset covering the full supply chains of 3,859 LLM applications, and uses it to show that these chains are deeply nested and carry widespread known vulnerabilities.

desk verdict A substantial first-of-its-kind LLM supply chain benchmark effort, but the headline deep-dependency finding conflates descendants with dependencies and the dataset is not shipped. read the letter →

arxiv 2507.18105 v1 pith:TUEFPBYW submitted 2025-07-24 cs.SE cs.CR

Yujie Ma , Lili Quan , Xiaofei Xie , Qiang Hu , Jiongchi Yu , Yao Zhang , Sen Chen This is my paper
classification cs.SEcs.CR
keywords LLMsupplychainsecuritybenchmarkdatasetdependencyanalysisvulnerabilityriskclassificationHuggingFaceecosystemlargelanguagemodels
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Large language model applications are not standalone artifacts: each one pulls in pretrained models, datasets, and software libraries that themselves depend on further components. This paper tries to establish that these dependency chains are deeper and riskier than current model- or data-level security analyses acknowledge, and that a purpose-built benchmark can make the whole chain visible. To that end it introduces LLMSCBench, a dataset of 3,859 real-world Hugging Face applications together with 109,211 models, 2,474 datasets, and 8,862 libraries, their interdependencies, and 1,555 risk issues collected from public vulnerability and discussion sources. The paper argues that the resulting measurements—deep fine-tuning lineages, heavy reuse of a small set of root models, and libraries with known critical vulnerabilities flowing into nearly half of all applications—show that supply-chain-level risk analysis is both possible and necessary. If the dataset is representative, it gives researchers and developers the first shared substrate for studying and benchmarking LLM supply chain security.

What carries the argument

The central artifact is LLMSCBench, a benchmark dataset built by a four-step pipeline that scrapes Hugging Face applications, reads the linked_model field and recursive fine-tuning metadata to build model dependency chains, uses an LLM-assisted and human-confirmed extraction over application and model descriptions to identify datasets, and resolves requirements.txt libraries recursively to capture transitive library dependencies. Risk data is attached by keyword-mining GitHub Issues and Hugging Face Discussions for applications, models, and datasets (manually verified), and by matching libraries against public vulnerability databases such as OSV.dev. These dependency graphs are what let the paper measure depth, width, reuse, and risk propagation that component-level analyses would miss.

What would settle it

Re-running the dependency analysis on a sample of LLM applications collected from a different source, such as GitHub repositories or application stores that publish lockfiles, and comparing the share of applications with known-vulnerable dependencies: if that share is far below 49%, or if fine-tuning chains resolve to much smaller depths than 40, the paper's ecosystem-wide claims would not survive.

Watch

Extended reading notes

Core claim

The paper's central claim is that LLM applications sit inside a multi-component supply chain—base models, datasets, and libraries along with their transitive dependencies—and that this chain is the right unit of analysis for understanding security risk. LLMSCBench operationalizes that claim by collecting 3,859 LLM applications from Hugging Face, tracing base components to their dependent components (2,975 base models expanding to 109,211 models through fine-tuning chains, 2,406 base datasets with 68 dependency chains, and 6,089 base libraries expanding to 8,862 through recursive resolution), and attaching 1,555 validated risk issues: 50 application-level, 325 model-level, 18 dataset-level, and 1,229 library-level vulnerability records. The empirical analysis finds deep nesting—fine-tuning chains up to depth 40, with 90.1% of models traceable to just 161 root models—and reports that 49% of applications depend on libraries with known vulnerabilities, most of which have published fixes. The conclusion is that comprehensive supply chain analysis is needed, and that datasets like LLMSCBench are a prerequisite for it.

Load-bearing premise

That the snapshot of Hugging Face applications—especially the 2,008 of 3,859 apps that expose their linked models, plus libraries listed in requirements.txt—is representative enough that conclusions such as '49% of applications depend on vulnerable libraries' describe the wider ecosystem and not just what Hugging Face happens to make visible.

Editorial extensions

If this is right

  • Risk assessment for LLM applications must include the full transitive dependency set, not just the model or dataset, because vulnerabilities propagate along these chains.
  • Because roughly 70% of applications with vulnerable dependencies have fixes available, routine dependency updates could remove most currently-known library risk.
  • Ecosystem risk is concentrated: with 90.1% of models traceable to 161 root models, compromising one root model or a few base libraries can cascade to a large fraction of applications.
  • The scarcity of model- and dataset-level risk data (325 and 18 issues after manual cleaning) points to the need for CVE-style vulnerability databases for components other than software libraries.
  • Compared with earlier datasets that cover only applications and sometimes their risks, LLMSCBench is positioned as the first spanning all four component types with documented interdependencies.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the collection is centered on Hugging Face and depends on explicit linked_model fields and requirements.txt files, the reported percentages may undercount dependencies that platforms do not expose; the true ecosystem figures could differ in either direction.
  • The same construction pipeline could be applied to other deployment channels, such as GitHub repositories, application stores, or enterprise registries, to test whether the depth and vulnerability patterns generalize beyond Hugging Face.
  • The dataset invites a direct research program that the paper does not carry out: turning a vulnerable transitive library or a poisoned fine-tuned model into a concrete exploit against a downstream application.
  • With only 18 dataset-level issues found, the paper's dataset-risk taxonomy is likely a floor; structured and standardized dataset issue reporting would probably reveal substantially more cases.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper introduces LLMSCBench, a claimed first comprehensive dataset for LLM supply-chain security, built from 3,859 Hugging Face applications. It collects 109,211 models, 2,474 datasets, and 8,862 libraries (9,862 in the abstract), together with dependency relationships and 1,555 risk-related issues (50 application issues, 325 model issues, 18 dataset issues, and 1,229 library CVEs). The authors analyze dependency depth and width, popularity distributions, and risk-type prevalence, reporting findings such as 42.8% of base models being fine-tuned from other models, maximum model dependency depth 40, 90.1% of models tracing to 161 root models, and 49% of applications depending on libraries with known vulnerabilities. The paper concludes with stakeholder implications and a brief threat-to-validity discussion.

Significance. If the dataset and measurements were sound, LLMSCBench would be a useful resource for researchers studying LLM supply-chain security, filling a gap between model-focused security studies and system-level analyses. The empirical findings, especially the library CVE statistics and application dependency patterns, would provide a concrete starting point for further studies. The paper also ships no executable artifact, but the design of the collection pipeline is described in enough detail to be partially reproduced. However, the contribution's validity hinges on correct construction of the model dependency graph and on the internal consistency of the reported numbers; both are currently in question. The paper's strength is the breadth of its data collection across four component types, but its central claim of 'deeply nested dependencies' is not established by the current analysis.

major comments (5)
  1. [Section 3.1 Step 2; Figure 3; Section 4.2; Finding 5] The model dependency graph conflates dependencies with dependents. Section 1 defines dependent components as components that applications 'rely on,' i.e., upstream dependencies. However, Step 2 constructs fine-tuning chains by crawling 'in both directions,' including models fine-tuned from the base model. Figure 3 illustrates this with Model-A at the root and Model-B, Model-C, etc., as chains of descendants. Such descendant chains are not dependencies of the application; they are dependents of the base model. Consequently, the maximum depth of 40, the claim that 90.1% of models trace to 161 root models, and the headline statement that LLM applications exhibit 'deeply nested dependencies' may be artifacts of the crawl direction rather than properties of application supply chains. The paper would need to re-run the analysis using only upstream fine-tuning edges (i.e., models from which each model was fine-tuned) to support the dependency-depth claims.
  2. [Abstract; Section 3.1; Figure 2] The dataset artifact is not provided, and the main numeric claims are internally inconsistent. No repository, DOI, or downloadable artifact link is given for LLMSCBench, despite the dataset being the paper's primary contribution. The abstract reports 9,862 libraries while Section 3.1 Step 4 and the conclusion report 8,862. The abstract and body state 1,555 total risk issues, but the itemized counts (50 + 325 + 18 + 1,229) sum to 1,622, and Figure 2 shows 1,640. Without the artifact and with these inconsistencies, key quantitative claims such as the total number of dependent models or libraries cannot be verified.
  3. [Section 4.1, Figure 7, Finding 4] The claimed percentage of application risks in the top two categories is arithmetically wrong. The text states that 'most of the risks (73.84%) lie in Application Security Vulnerability and Application-Layer Privacy Violation,' but Figure 7 shows 17 + 17 = 34 issues out of 50, which is 68%, not 73.84%. This error appears in both the main text and Finding 4. The mismatch is load-bearing because the 73.84% figure is used to argue that security and privacy are the dominant application-level risk classes.
  4. [Section 3.2, Steps 1 and 2] The risk-issue extraction procedure risks circularity in the reported risk distributions. The 13 risk categories are first defined (Section 3.2 Step 1) and then used as the keyword set to crawl user discussions (Step 2). The observed prevalence of each risk type is therefore partly an artifact of the search vocabulary: categories with more distinct or more commonly used keywords may be overrepresented, and risks not matching any keyword may be missed. The paper does not report the keyword lists, or any sensitivity analysis varying the vocabulary, even though Section 5.2 claims sensitivity analyses were conducted. This is particularly relevant for the headline percentages in Section 4.1 (73.84% / 68%) and Section 4.2 (86.46% for three categories).
  5. [Section 5.2; Sections 4.2 and 4.4] The external-validity limitation is acknowledged but the paper's conclusions are phrased more strongly than the evidence supports. Section 5.2 notes that the dataset comes from a single Hugging Face snapshot on 18 July 2025, that only 2,008 of 3,859 applications have explicit linked_model information, that dependent models and datasets are included only when clearly documented, and that libraries are limited to those in requirements.txt files. Given these constraints, the claim that 49% of applications depend on vulnerable libraries, or that the model graph shows 90.1% concentration, is a property of the collected sample, not a demonstrated ecosystem-wide fact. The abstract and Section 4.4 state these as general findings about LLM applications. At minimum, the paper should temper the wording and discuss the likely direction of bias (e.g., popular models may be overrepresented in fine-tuning graphs).
minor comments (6)
  1. [Abstract vs. Section 3.1 Step 4] The number of libraries is inconsistent: the abstract says 9,862, while Sections 3.1 and 7 say 8,862. Please correct the typo.
  2. [Abstract; Section 3.1; Figure 2] The total risk-issue count is inconsistent: the abstract and body say 1,555, the itemized counts sum to 1,622, and Figure 2 shows 1,640. Please align these figures.
  3. [Figure 4] The caption says 'Number of models over months,' but the surrounding text in Section 4.1 discusses the development trend of applications. The caption should say 'applications.'
  4. [Section 4.4, Figure 16] The text says 'Figure 16 presents the top 20 applications ranked by the number of their contained critical vulnerabilities,' but the figure caption describes the top 20 libraries by CVE count. Please correct the reference or the caption.
  5. [Section 4.4, Risk analysis] The severity counts do not reconcile: 29 + 365 + 543 + 207 = 1,144, but the paper earlier states 1,229 unique CVE records. The missing 85 records are unexplained; please clarify how CVEs without CVSS scores are handled.
  6. [Section 5.1, dataset providers paragraph] The claim that '28% of the risks come from the root cause of Vulnerable HuggingFace Datasets Library' is not tied to the numbers reported in Section 4.3, and the derivation of 28% is unclear. Please provide the calculation or remove the claim.

Circularity Check

1 steps flagged · score 4.0 of 10

Dataset construction is largely self-contained, but the "deeply nested dependencies" headline is partly self-definitional because model dependency chains are crawled in both upstream and downstream directions.

  1. self definitional [Section 3.1 Step 2; Section 4.2 Model Analysis and Finding 5]
    "Specifically, we develop an automated recursive crawler that traces fine-tuning relationships in both directions: (1) models fine-tuned from a given base model, and (2) models from which the base model was fine-tuned. ... Notably, the maximum depth of fine-tuning chains reaches up to 40, illustrating deeply nested dependencies."

    The paper's own Section 1 defines dependent components as what components "rely on" (upstream). The crawler, however, includes downstream descendants (models fine-tuned from the base model) in the same "dependency chains." A descendant fine-tuned from a base model is not a dependency of an application that uses the base model; it is a dependent. The Section 4.2 depth/width statistics (max depth 40, 90.1% of models traced to 161 roots, 106,236 "dependent models") are therefore properties of the Hugging Face fine-tuning graph, not of LLM-application supply chains. The headline finding "deeply nested dependencies" is generated by the bidirectional crawl definition, so the claimed supply-chain result reduces to the construction rather than to application dependencies.

full rationale

LLMSCBench is an empirical dataset paper: percentages such as 49% of applications with vulnerable dependencies are obtained by matching collected requirements.txt libraries against CVE databases, not by fitting a parameter to a target, so no fitted-input-called-prediction circularity occurs. The 13 risk categories are taken from prior taxonomies and used as search keywords; this is a mild selection loop, but the manual verification step means the reported counts are not strictly identical to the keyword counts, so it is not a definitional equivalence. The paper's self-citations (Quan et al. 2022; Yu et al. 2024) are methodological and non-load-bearing. The one localized circular step is the model dependency graph: because "model fine-tuning chains" are traced in both upstream and downstream directions, the "deeply nested dependencies" finding in Section 4.2 is an artifact of that definition rather than a measured property of applications' upstream supply chains. Section 5.2 honestly documents coverage limitations (Hugging Face snapshot, clear platform information required), which are external-validity threats rather than circularity. Overall, the central dataset and library vulnerability analysis are independent; the circularity is partial and confined to the model-dependency interpretation.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claims inherit the platform's metadata conventions. Dataset counts depend on which applications Hugging Face exposes, which models declare linked_model, whether the LLM-assisted dataset extraction is accurate, and whether the risk keywords capture real issues. These are domain assumptions, not free mathematical parameters.

free parameters (4)
  • Snapshot date and three-year inclusion window = 18 July 2025; 2022-2025
    All dataset counts and risk counts depend on the selected snapshot and the three-year window, which are choices made by the authors.
  • 13 risk categories = 13 categories from Slattery et al. and Das et al.
    The taxonomy selection shapes which issues are crawled and counted, and the observed risk-type distribution partly reflects this choice.
  • Crawl keyword set = Not disclosed in the paper
    Keywords derived from the 13 risk categories drive issue extraction; without them the extraction is not exactly reproducible.
  • Manual review consensus protocol = Not quantified
    Three authors manually reviewed candidate risk issues; no inter-annotator agreement is reported, so the 50/325/18 validated counts depend on uncalibrated human judgment.
assumptions (5)
  • domain assumption Hugging Face Spaces is a representative source of real-world LLM applications.
    All general conclusions about the LLM supply chain depend on this; Section 5.2 acknowledges the restriction to Hugging Face.
  • domain assumption linked_model metadata and model pages accurately record which models an application uses and how models are fine-tuned from one another.
    Section 3.1 Step 2 builds all model dependency chains from this metadata; only 2,008 of 3,859 apps expose linked_model.
  • domain assumption LLM-assisted extraction with human confirmation correctly recovers dataset usage from application and model descriptions.
    Section 3.1 Step 3 relies on this; no precision or recall numbers are reported for the LLM-assisted step.
  • domain assumption Keyword search over GitHub Issues and Hugging Face Discussions, followed by manual review, finds a representative sample of true risk issues.
    Section 3.2 Steps 2 and 3; the paper reports only 8.9% of candidates survive cleaning, so the filtering decisions substantially shape the risk counts.
  • domain assumption OSV/CVE records matched by package name and version accurately reflect exploitable vulnerabilities in the applications.
    Section 4.4 vulnerability matching assumes static version matching captures real exposure; dynamic usage context and reachability are not analyzed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Understanding the Supply Chain and Risks of Large Language Model Applications." pith.science (2026). https://pith.science/paper/TUEFPBYW

@misc{pith2026250718105,
  author       = {Pith},
  title        = {Pith review of: Understanding the Supply Chain and Risks of Large Language Model Applications},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TUEFPBYW}},
  note         = {Machine review of arXiv:2507.18105}
}
read the original abstract

The rise of Large Language Models (LLMs) has led to the widespread deployment of LLM-based systems across diverse domains. As these systems proliferate, understanding the risks associated with their complex supply chains is increasingly important. LLM-based systems are not standalone as they rely on interconnected supply chains involving pretrained models, third-party libraries, datasets, and infrastructure. Yet, most risk assessments narrowly focus on model or data level, overlooking broader supply chain vulnerabilities. While recent studies have begun to address LLM supply chain risks, there remains a lack of benchmarks for systematic research. To address this gap, we introduce the first comprehensive dataset for analyzing and benchmarking LLM supply chain security. We collect 3,859 real-world LLM applications and perform interdependency analysis, identifying 109,211 models, 2,474 datasets, and 9,862 libraries. We extract model fine-tuning paths, dataset reuse, and library reliance, mapping the ecosystem's structure. To evaluate security, we gather 1,555 risk-related issues-50 for applications, 325 for models, 18 for datasets, and 1,229 for libraries from public vulnerability databases. Using this dataset, we empirically analyze component dependencies and risks. Our findings reveal deeply nested dependencies in LLM applications and significant vulnerabilities across the supply chain, underscoring the need for comprehensive security analysis. We conclude with practical recommendations to guide researchers and developers toward safer, more trustworthy LLM-enabled systems.

Figures

Figures reproduced from arXiv: 2507.18105 by the authors.

Figure 1
Figure 1. Components in the LLM supply chain. 2.2. Security Issues in Large Language Models Within the LLM supply chain, core components are interconnected and serve as sources of security issues for LLM systems. Specifically, insecure libraries can enable attackers to compromise the entire LLM pipeline; for example, TensorFlow’s Keras framework has experienced vulnerabilities such as CVE-2024-3660, which allowed arbitrary co… view at source ↗
Figure 2
Figure 2. The workflow of LLMSCBench construction. 3.1. LLMSC Dependency Dataset Collection The basic LLMSC dependency dataset collection mainly includes the application collection, the collection of base models, datasets and libraries used in applications, and their dependent components collection. Specifically, the detailed dataset construction process of LLMSCBench is summarized as follows: Step 1: LLM-enabled application … view at source ↗
Figure 3
Figure 3. Template of model fine-tuning dependency chains. To analyze the model-level supply chain, we construct model dependency chains based on fine-tuning relationships. We leverage the Hugging Face model pages, which typically include metadata indicating whether a model is fine-tuned from another, to identify transitive dependencies. Specifically, we develop an automated recursive crawler that traces fine-tuning relations… view at source ↗
Figures from the paper (14 more)
Figure 4
Figure 4. Figure 4: Number of models over months in LLMSCBench (years: 2022–2025). Characteristics Analysis. Overall, the distribution of applications across categories is relatively balanced, with most categories containing approximately 130 applications. However, certain categories, suc…
Figure 5
Figure 5. Figure 5: Density plots of app likes, commit counts, and community activity. Development trend of LLM-enabled applications [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Distribution of likes considering different categories. Popularity of applications [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Collected risk issues in applications Finding 3: There is a clear upward trend in the development of LLM-enabled applications, with image generation-related applications receiving notably higher user engagement. This also highlights the growing importance of performing…
Figure 8
Figure 8. Figure 8: Distribution of model popularity As shown in [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: Distribution of the depth of model dependency Distribution of model dependency graphs. Based on the construction of the model fine-tuning chain, we collect a total of 109,211 models that are in the LLMSC [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Collected risk issues in models Risk Analysis. After the risk issue extraction, we filter out 325 relevant issues across 12 risk categories (the description of these categories can be found in [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]
Figure 11
Figure 11. Figure 11: A case of LLM hallucination risk 14 [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: Distribution of dataset popularity Characteristics Analysis [PITH_FULL_IMAGE:figures/full_fig_p015_12.png]
Figure 13
Figure 13. Figure 13: Frequency distribution of the number of members. Distribution of dataset dependency graphs. Among the 2,406 datasets, only 68 have the upstream (or down￾stream) dataset collections. The depth of all data collection dependency graphs is 2, indicating that no datasets e…
Figure 14
Figure 14. Figure 14: Library dependency distribution. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 15
Figure 15. Figure 15: Library dependency distribution. Risk analysis. First, we analyze the severity of libraries based on the CVSS scores. We found that LLMSCBench contains 29 low-severity (0 < CVSS < 4), 365 medium-severity (4 ≤ CVSS < 7) , 543 high-severity (7 ≤ CVSS < 9), and 207 criti…
Figure 16
Figure 16. Figure 16: Top 20 libraries by critical CVE counts (CVSS > 9). applications contain more than 5 dependencies with available fixed versions, indicating a greater potential for security improvement through proactive dependency management. This highlights the necessity for develope…
Figure 17
Figure 17. Figure 17: Cumulative distribution of dependencies across applications to avoid introducing potential risks to applications, such as pillow, langchain, and paddlepaddle, which contain the most critical vulnerabilities. Application managers from the platform side (e.g., Hugging F…

Discussion (0). Sign in to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Towards Demystifying and Repairing LLM-in-the-Loop Vulnerabilities

    cs.SE 2026-05 unverdicted novelty 7.0 of 10

    Authors create LLMCVE dataset of LLM-in-the-loop vulnerabilities and demonstrate that agent-based repair methods achieve low success rates on them, particularly prompt injections at 28.57% Pass@1.

  2. Towards Demystifying and Repairing LLM-in-the-Loop Vulnerabilities

    cs.SE 2026-05 unverdicted novelty 6.0 of 10

    LiL vulnerabilities are more severe than ecosystem and conventional bugs and drop LLM-based repair Pass@1 by ~10.8%, with three categories often at 0% success.

  3. LLM Harms: A Taxonomy and Discussion

    cs.CY 2025-12 unverdicted novelty 3.0 of 10

    This paper proposes a taxonomy of LLM harms in five categories and suggests mitigation strategies plus a dynamic auditing system for responsible development.

  4. LLM Harms: A Taxonomy and Discussion

    cs.CY 2025-12 reject novelty 3.0 of 10

    Proposes a five-bucket taxonomy of LLM harms and calls for dynamic auditing, but the systematic review behind it is not reproducible and contains mismatched citations.

Reference graph

Works this paper leans on

28 extracted references · 4 canonical work pages · cited by 2 Pith papers

  1. [1]

    Gpt in sheep’s clothing: The risk of customized gpts.arXiv preprint arXiv:2401.09075,

    Sagiv Antebi, Noam Azulay, Edan Habler, Ben Ganon, Asaf Shabtai, and Yuval Elovici. Gpt in sheep’s clothing: The risk of customized gpts.arXiv preprint arXiv:2401.09075,

    arXiv

  2. [5]

    Risk taxonomy, mitigation, and assessment benchmarks of large language model systems

    Tianyu Cui, Yanling Wang, Chuanpu Fu, Yong Xiao, Sijia Li, Xinhao Deng, Yunpeng Liu, Qinglin Zhang, Ziyi Qiu, Peiyang Li, et al. Risk taxonomy, mitigation, and assessment benchmarks of large language model systems. arXiv preprint arXiv:2401.05778,

    arXiv

  3. [6]

    Do membership inference attacks work on large language models?arXiv preprint arXiv:2402.07841,

    Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models?arXiv preprint arXiv:2402.07841,

    arXiv

  4. [7]

    Euronews

    Accessed: 2025-07-15. Euronews. ’harmful and toxic output’: Deepseek has ’major security and safety gaps,’ study warns. https://www.euronews.com/next/2025/01/31/ harmful-and-toxic-output-deepseek-has-major-security-and-safety-gaps-study-warns . Accessed: July

    work page 2025

  5. [8]

    Realtoxicityprompts: Evaluating neural toxic degeneration in language models.arXiv preprint arXiv:2009.11462,

    23 Understanding the Supply Chain and Risks of Large Language Model Applications Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A Smith. Realtoxicityprompts: Evaluating neural toxic degeneration in language models.arXiv preprint arXiv:2009.11462,

    arXiv 2009

  6. [9]

    Large language model supply chain: Open problems from the security perspective

    Qiang Hu, Xiaofei Xie, Sen Chen, Lili Quan, and Lei Ma. Large language model supply chain: Open problems from the security perspective. InProceedings of the 34th ACM SIGSOFT International Symposium on Software Testing and Analysis, pages 169–173, 2025a. Yuke Hu, Zheng Li, Zhihao Liu, Yang Zhang, Zhan Qin, Kui Ren, and Chun Chen. Membership inference attac...

    arXiv

  7. [10]

    Pleak: Prompt leaking attacks against large language model applications

    Bo Hui, Haolin Yuan, Neil Gong, Philippe Burlina, and Yinzhi Cao. Pleak: Prompt leaking attacks against large language model applications. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3600–3614,

    work page 2024

  8. [11]

    Exploring the robustness of decision- level through adversarial attacks on llm-based embodied models

    Shuyuan Liu, Jiawei Chen, Shouwei Ruan, Hang Su, and Zhaoxia Yin. Exploring the robustness of decision- level through adversarial attacks on llm-based embodied models. InProceedings of the 32nd ACM Interna- tional Conference on Multimedia, pages 8120–8128, 2024a. Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. Automatic and universal ...

    arXiv

Show all 28 references
  1. [12]

    Prompt injection attacks and defenses in llm-integrated applications

    24 Understanding the Supply Chain and Risks of Large Language Model Applications Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Prompt injection attacks and defenses in llm-integrated applications. corr, abs/2310.12815, 2023i. doi: 10.48550.arXiv prep...

  2. [13]

    Hallucination detection and hallucination mitigation: An investigation.arXiv preprint arXiv:2401.08358,

    Junliang Luo, Tianyu Li, Di Wu, Michael Jenkin, Steve Liu, and Gregory Dudek. Hallucination detection and hallucination mitigation: An investigation.arXiv preprint arXiv:2401.08358,

    arXiv

  3. [14]

    optimum habana

    Apache License 2.0, Accessed: 2025-07-15. optimum habana. The transformers required for optimum-habana 1.16.0 has security issues.https: //github.com/huggingface/optimum-habana/issues/1912. Accessed: July

    2025

  4. [17]

    Survey of vulnerabilities in large language models revealed by adversarial attacks.arXiv preprint arXiv:2310.10844,

    Erfan Shayegani, Md Abdullah Al Mamun, Yu Fu, Pedram Zaree, Yue Dong, and Nael Abu-Ghazaleh. Survey of vulnerabilities in large language models revealed by adversarial attacks.arXiv preprint arXiv:2310.10844,

    arXiv

  5. [18]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685,

    2024

  6. [19]

    The ai risk repository: A comprehensive meta-review, database, and taxonomy of risks from artificial intelligence.arXiv preprint arXiv:2408.12622,

    Peter Slattery, Alexander K Saeri, Emily AC Grundy, Jess Graham, Michael Noetel, Risto Uuk, James Dao, Soroush Pour, Stephen Casper, and Neil Thompson. The ai risk repository: A comprehensive meta-review, database, and taxonomy of risks from artificial intelligence.arXiv prepr...

    arXiv

  7. [20]

    Beyond memorization: Violating privacy via inference with large language models.arXiv preprint arXiv:2310.07298,

    Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. Beyond memorization: Violating privacy via inference with large language models.arXiv preprint arXiv:2310.07298,

    arXiv

  8. [21]

    Gpt store mining and analysis.arXiv preprint arXiv:2405.10210,

    Dongxun Su, Yanjie Zhao, Xinyi Hou, Shenao Wang, and Haoyu Wang. Gpt store mining and analysis.arXiv preprint arXiv:2405.10210,

    arXiv

  9. [22]

    Opening a pandora’s box: things you should know in the era of custom gpts.arXiv preprint arXiv:2401.00905,

    25 Understanding the Supply Chain and Risks of Large Language Model Applications Guanhong Tao, Siyuan Cheng, Zhuo Zhang, Junmin Zhu, Guangyu Shen, and Xiangyu Zhang. Opening a pandora’s box: things you should know in the era of custom gpts.arXiv preprint arXiv:2401.00905,

    arXiv

  10. [23]

    Large language model supply chain: A research agenda

    Shenao Wang, Yanjie Zhao, Xinyi Hou, and Haoyu Wang. Large language model supply chain: A research agenda. ACM Transactions on Software Engineering and Methodology, 34(5):1–46, 2025a. Shenao Wang, Yanjie Zhao, Zhao Liu, Quanchen Zou, and Haoyu Wang. Sok: Understanding vulnerab...

    arXiv

  11. [24]

    A new era in llm security: Exploring security concerns in real-world llm-based systems.arXiv preprint arXiv:2402.18649,

    Fangzhou Wu, Ning Zhang, Somesh Jha, Patrick McDaniel, and Chaowei Xiao. A new era in llm security: Exploring security concerns in real-world llm-based systems.arXiv preprint arXiv:2402.18649,

    arXiv

  12. [25]

    Llm app squatting and cloning.arXiv preprint arXiv:2411.07518,

    Yinglin Xie, Xinyi Hou, Yanjie Zhao, Kai Chen, and Haoyu Wang. Llm app squatting and cloning.arXiv preprint arXiv:2411.07518,

    arXiv

  13. [26]

    A comprehensive study of jailbreak attack versus defense for large language models.arXiv preprint arXiv:2402.13457,

    Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. A comprehensive study of jailbreak attack versus defense for large language models.arXiv preprint arXiv:2402.13457,

    arXiv

  14. [27]

    Gpts window shopping: An analysis of the landscape of custom chatgpt models.arXiv preprint arXiv:2405.10547, 2024a

    Benjamin Zi Hao Zhao, Muhammad Ikram, and Mohamed Ali Kâafar. Gpts window shopping: An analysis of the landscape of custom chatgpt models.arXiv preprint arXiv:2405.10547, 2024a. Shuai Zhao, Meihuizi Jia, Zhongliang Guo, Leilei Gan, Xiaoyu Xu, Xiaobao Wu, Jie Fu, Yichao Feng, F...

    arXiv

  15. [28]

    Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    arXiv

  16. [2020]

    Rodrigo Pedro, Daniel Castro, Paulo Carreira, and Nuno Santos

    doi: 10.1109/SP40000.2020.00095. Rodrigo Pedro, Daniel Castro, Paulo Carreira, and Nuno Santos. From prompt injections to sql injection attacks: How protected is your llm-integrated web application?arXiv preprint arXiv:2308.01990,

    2020

  17. [2022]

    Are llms correctly integrated into software systems?arXiv preprint arXiv:2407.05138,

    Yuchen Shao, Yuheng Huang, Jiawei Shen, Lei Ma, Ting Su, and Chengcheng Wan. Are llms correctly integrated into software systems?arXiv preprint arXiv:2407.05138,

    arXiv

  18. [2023]

    On the opportunities and risks of foundation models.arXiv preprint arXiv:2108.07258,

    Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. On the opportunities and risks of foundation models.arXiv preprint arXiv:2108.07258,

    arXiv

  19. [2024]

    Purple llama cyberseceval: A secure coding benchmark for language models.arXiv preprint arXiv:2312.04724,

    Manish Bhatt, Sahana Chennabasappa, Cyrus Nikolaidis, Shengye Wan, Ivan Evtimov, Dominik Gabi, Daniel Song, Faizan Ahmad, Cornelius Aschermann, Lorenzo Fontana, et al. Purple llama cyberseceval: A secure coding benchmark for language models.arXiv preprint arXiv:2312.04724,

    arXiv

  20. [2025]

    Are aligned neural networks adversarially aligned?, 2023.URL https://arxiv

    Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, et al. Are aligned neural networks adversarially aligned?, 2023.URL https://arxiv. org/abs/2306.15447,

    2023 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.