Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation

2026-07-15

AI Summary

This study addresses a critical security vulnerability in large language models (LLMs) deployed for cybersecurity log analysis: passive prompt injection attacks, wherein malicious payloads embedded in log fields persistently manipulate model outputs, creating what the authors term “confused deputy” vulnerabilities. The work formally defines and empirically validates this threat within log-processing contexts, introducing Context Stitching—an attack technique that fragments and distributes payloads across multiple log entries. To facilitate systematic evaluation, the authors construct LogInject-1.0, the first adversarial log benchmark dataset. Experiments demonstrate high baseline attack success rates (88.2% peak, 83.4% average), with Context Stitching achieving 76.4%. A proposed composite defense strategy reduces attack success by 90.4%, yet a residual risk of 8.4% persists, highlighting the need for further mitigation research.

Abstract

Large Language Models are increasingly deployed in Security Operations Centers for log analysis tasks including summarization, alert triage, and threat investigation. These systems ingest logs from external-facing services and process network logs as natural language contexts to generate security insights. We demonstrate that this architectural pattern introduces a critical vulnerability: adversaries can embed prompt injection payloads in log-generating fields that persist in storage and are executed when analysts query the LLM, achieving what we term passive prompt injection. We present LogInject, a systematic framework for evaluating these threats. Using LogInject-1.0, a benchmark of 12,847 log entries including 2,569 adversarial samples, we evaluate three production LLMs across four attack objectives: activity concealment, false positive generation, information exfiltration, and output hijacking. Our findings reveal an up to 88.2% attack success rate (83.4% average across models) under the baseline conditions. We introduce Context Stitching, a novel technique that fragments payloads across multiple log entries to evade stateless filters while exploiting LLM long-context reasoning, achieving a 76.4% success rate. As mitigation, we evaluate layered defenses by combining input filtering, prompt hardening, and output validation, demonstrating a 90.4% attack reduction, although 8.4% residual vulnerability persists. Our results establish that LLM-based log analysis creates an inherent confused deputy vulnerability where untrusted data and trusted instructions compete indistinguishably for model attention, requiring defense in-depth architectures and continued human oversight for security-critical decisions.

Problem

• Prompt Injection
• LLM Security
• Network Security Logs
• Confused Deputy
• Context Contamination

Innovation

• passive prompt injection
• LogInject
• Context Stitching
• confused deputy vulnerability
• LLM security