Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection

2026-07-27

AI Summary

This study addresses the vulnerability of large language models (LLMs) to adversarial prompt injection attacks in the context of Security Operations Center (SOC) log analysis, where logs containing clear indicators of compromise are misclassified as benign. It presents the first systematic investigation into such attacks targeting LLM-based log interpretation, introducing an evaluation framework that generates and optimizes adversarial log samples to assess the robustness of state-of-the-art LLMs. The findings reveal that despite the susceptibility of multiple advanced models to these attacks, their generated explanations often contain subtle yet discernible traces of the injected prompts. These latent cues can be leveraged to effectively detect prompt injection attempts, offering a novel avenue for developing defensive mechanisms against such threats in security-sensitive applications.

Abstract

Large Language Models (LLMs) are increasingly integrated into Security Operations Center (SOC) workflows, where they support analysts in tasks such as the interpretation of system logs. However, the ability of LLMs to directly process untrusted textual input also introduces new attack surfaces. In particular, attackers can inject contextual information or explicit instructions into log entries in order to influence how malicious activity is interpreted by the model. Despite the growing adoption of LLMs for log analytics, the robustness of such systems against adversarial log injection remains largely unexplored. To address this gap, this paper presents a framework for evaluating prompt injection attacks against LLM-based log interpretation. Using log traces generated during real cyber attacks, our approach creates adversarial examples through generic injection generation, refinement, and attack-specific optimization. Our evaluation across multiple state-of-the-art LLMs shows that these injections can cause malicious log traces to be classified as benign despite containing clear indicators of compromise. As a potential remedy, we show that the explanations generated by the LLMs alongside their classifications frequently contain indicators of adversarial manipulation that can be leveraged to detect such attacks.

Problem

• prompt injection
• LLM-based log interpretation
• adversarial log injection
• security operations center
• system logs

Innovation

• prompt injection
• adversarial log injection
• LLM-based log interpretation
• security operations center
• explanation-based detection