LIMA: Defining, Benchmarking and Detecting Cross-Layer Vulnerabilities in LLM...
summary
Study defines the LIF-Model Attack surface (LIMA) and curates 60 disclosed vulnerabilities into a six-class taxonomy, finding 42% LIMA issues that include heap overflows, path traversal and an RCE in LocalAI. The authors build LIMABench with 58 reproducible PoCs and a reproduction framework, and create LIMAScan, a dynamic tester that crafts GGUF metadata payloads to probe live llama.cpp, vLLM, Ollama and LocalAI instances, detecting 13 known bugs and discovering and exploiting 7 new vulnerabilities.
AI-written summary · about
chapters (7)
- 0:00LIMA vulnerabilities in LLM frameworks
- 1:58Local LLM inference frameworks
- 4:50LIMA attack surface before model init
- 6:39LIMA vulnerability in LocalAI
- 8:26Limitations of LIMA defenses
- 9:29LIMABench and LIMAScan tools
- 12:39Future work and conclusion
related talks
44mI Abuse Your LLM Live with 10 Security Vulnerabilities
49mBreaching LLM-Powered Applications: Overcoming Security and Privacy Challenges
27mSecuring The Gateway And Mitigating Risks In LLM API Integration
29mWorms, Tokens, and Trust The Industrialization of Supply Chain Attacks
28mSecuring LLMs: Insights into OWASP top 10
44mAI Showdown: The Good, The Glitchy, and The Risky
50mSecuring LLM-Powered Applications: Overcoming Security and Privacy Challenges
47mHarnessing LLMs for Next-Level Security Analysis