Suchen Liu | Searcharxiv

arXiv2026

What If Prompt Injection Never Left? Rethinking Agent Security through Cross-Session Stored Prompt Injection

Modern agentic systems fundamentally reshape the security boundary of LLMs by introducing persistent system state including memories, filesystems, tools, and other long-lived contextual artifacts that survives across sessions. As external information crosses this boundary and becomes part of persistent agent state, malicious instructions are no longer confined to a single interaction, but can silently persist and influence future executions long after the original attacker interaction has ended. We introduce Cross-Session Stored Prompt Injection, a new threat vector inspired by stored cross-site scripting that redefines prompt injection for agentic systems by extending its threat model across both time, where attacks persist and activate across sessions, and space, where adversarial instructions propagate beyond the immediate prompt into persistent system state. To systematically characterize this emerging threat, we formalize the lifecycle of cross-session stored prompt injection, develop a taxonomy of persistence channels and incorporation mechanisms, and build a sandbox toolkit for evaluation. Our findings suggest that the fundamental challenge of agent security is not merely filtering untrusted inputs, but governing how external information acquires authority as it crosses persistent system boundaries. We hope this work motivates a broader shift from interaction-centric security toward state-centric security, making the secure management of persistent agent state a first-class security principle for the agentic era.

cs.CR↗

arXiv2025

LLM4Hint: Leveraging Large Language Models for Hint Recommendation in Offline Query Optimization

Query optimization is essential for efficient SQL query execution in DBMS, and remains attractive over time due to the growth of data volumes and advances in hardware. Existing traditional optimizers struggle with the cumbersome hand-tuning required for complex workloads, and the learning-based methods face limitations in ensuring generalization. With the great success of Large Language Model (LLM) across diverse downstream tasks, this paper explores how LLMs can be incorporated to enhance the generalization of learned optimizers. Though promising, such an incorporation still presents challenges, mainly including high model inference latency, and the substantial fine-tuning cost and suboptimal performance due to inherent discrepancy between the token sequences in LLM and structured SQL execution plans with rich numerical features. In this paper, we focus on recurring queries in offline optimization to alleviate the issue of high inference latency, and propose \textbf{LLM4Hint} that leverages moderate-sized backbone LLMs to recommend query optimization hints. LLM4Hint achieves the goals through: (i) integrating a lightweight model to produce a soft prompt, which captures the data distribution in DBMS and the SQL predicates to provide sufficient optimization features while simultaneously reducing the context length fed to the LLM, (ii) devising a query rewriting strategy using a larger commercial LLM, so as to simplify SQL semantics for the backbone LLM and reduce fine-tuning costs, and (iii) introducing an explicit matching prompt to facilitate alignment between the LLM and the lightweight model, which can accelerate convergence of the combined model. Experiments show that LLM4Hint, by leveraging the LLM's stronger capability to understand the query statement, can outperform the state-of-the-art learned optimizers in terms of both effectiveness and generalization.

cs.DB↗