The three-front problem

LLM security in September 2026 has three active fronts: output integrity (hallucination and backdoors), system context (RAG pipelines), and the supply chain (the proxies and routers between you and the model). A production system fails if any one of them breaks.

The evidence arrived in a dense cluster this week. A hallucination detection pipeline hit F1=0.915 on HaluEval. SpecGuard showed how to catch backdoors at inference time without spending a single extra token of compute. RAG-Safety-Bench proved that retrieval makes safety evaluation harder, not easier. NVIDIA's garak settled into its role as the default red-teaming kit. And a security researcher bought 6TB of real customer prompts, credentials included, from a reseller API middleman.

These look like separate papers and tools. They're not. They're three layers of the same trust problem.

Hallucination detection: one signal is not enough

The arXiv paper 2609.11878 combines three signals for response-level hallucination detection: a fine-tuned DeBERTa-v3 classifier, Monte Carlo Dropout uncertainty quantification, and temperature-scaled calibration.

The combination hits F1=0.915 and AUROC=0.977 on HaluEval, among the strongest published results on that benchmark. Per task: QA at 0.97, summarization at 0.96, dialogue at 0.82. Dialogue is the weak spot because the model has more conversational freedom to drift from the source.

MC Dropout inference pushes accuracy to 93.2%. The context ablation is the part I find convincing: remove the knowledge context and summarization F1 drops 24%. A detector that needs the context to work is doing entailment reasoning, not matching stylistic surface patterns. A shallow classifier wouldn't care whether the context was there.

Key numbers F1 0.915 overall on HaluEval, 0.97 QA, 0.96 summarization, 0.82 dialogue 25% of training data captures 77% of full-data performance DPO on a 0.5B generator cuts measured hallucination from 85.5% to 37.7%

The 25%-for-77% learning curve is the practical sleeper. It means you can iterate a detector to near-final quality on a small labeled set, then decide whether more annotation is worth the cost.

Domain transfer is where detectors die

The same pipeline evaluated on SciFact, the biomedical claim benchmark, collapses to F1=0.52. General-domain training transfers poorly, a 43% relative drop from 0.915. You do not want to discover this after deploying a detector into a medical or legal workflow.

The strongest fix is domain-matched pretraining. PubMedBERT fine-tuned on SciFact reaches F1=0.63 and AUROC=0.81. Still modest, but a clear step up from the general model.

This pattern repeats across the whole cluster: general-purpose safety tools degrade in specialized contexts. RAG-Safety-Bench says it about guardrails, and the garak probe list keeps growing because no fixed probe set covers every failure mode.

You can fix the generator, not just the detector

Detection is diagnosis. The same paper also treats the underlying model. Using Direct Preference Optimization on a Qwen2.5-0.5B generator, the detector-measured hallucination rate falls from 85.5% to 37.7%, a 55.9% relative reduction. The 0.5B model runs on a laptop, so the whole loop is reproducible without a GPU cluster.

The interesting choice: the DPO preference pairs were labeled by the detector, not by humans. Detector-as-judge makes preference data cheap to generate at scale. The risk is circular. If the detector has a systematic bias, the generator will optimize against that bias and learn to fool it. Keep the detector private and re-evaluate it periodically.

Quick Take: The strongest safety stack right now pairs a domain-tuned detector with a detector-assisted DPO loop, and assumes every layer can be attacked.

Backdoor detection at zero added cost

Backdoored models are the worst case in this field: the model behaves normally until a secret trigger appears, then switches to attacker-controlled behavior. Pre-deployment auditing helps, but only until the next update ships.

SpecGuard finds the backdoor at runtime by repurposing speculative decoding. In speculative decoding, a small draft model proposes tokens and the target model verifies them. When a backdoor triggers, the target model shifts toward the attacker's behavior, but the clean draft model does not predict that shift. The draft-token acceptance rate changes, and that change is the detection signal.

The formal result is what makes this credible: an attacker who suppresses the acceptance-rate signal must also weaken the backdoor. You cannot hide from SpecGuard without breaking your own attack. And because speculative decoding is already running for speed, the detection costs zero added model computation. Existing runtime detectors require input perturbations or an extra generation pass; SpecGuard requires neither.

You only get this for free if you're already running speculative decoding. If your serving stack doesn't use draft models, the signal doesn't exist.

RAG quietly changes the safety equation

RAG-Safety-Bench attacks a comfortable assumption: that retrieving from trusted documents makes LLMs safer. The benchmark removes retriever quality as a confounder and separates the problem into four conditions.

Condition	What the model receives	What it tests
Non-RAG	Harmful prompt only	Baseline refusal behavior
Oracle RAG	Prompt plus a document with the exact answer	Full capability under retrieval
Related RAG	Prompt plus related documents without the answer	Partial grounding
Random RAG	Prompt plus safe, unrelated documents	Does safe context stay safe?

Across five open-source LLMs, the results show an inverse relationship between benign and unsafe capability, and baseline safety guardrails do not carry over to the RAG case. The sharp finding: even benign, unrelated documents can trigger unsafe generation in retrieval-enabled systems.

The practical implication is blunt. If you evaluate guardrails on the base model and then bolt on a retriever, your safety numbers are nearly meaningless. Test the full pipeline, retrieved documents included.

Red-teaming kits: garak is the nmap of LLMs

NVIDIA's garak has become the default answer to "is my model exploitable?" It works in the nmap tradition: point it at a model, it runs probes, and it reports failure rates per weakness class.

garak --target_type huggingface --target_name my-model --spec probes.promptinject

That single command runs the PromptInject framework against a local Hugging Face model. garak also supports OpenAI, AWS Bedrock, Replicate, Cohere, Groq, llama.cpp GGUF files, and anything reachable via REST.

The probe catalog now covers the attack surface broadly:

Probe	What it tests
encoding	Prompt injection through text encoding
dan	DAN and similar jailbreak personas
gcg	Adversarial suffix attacks on system prompts
leakreplay	Training data replay
malwaregen	Malicious code generation
packagehallucination	Nonexistent package names in code output
snowball	Wrong answers on deliberately complex questions
xss	Cross-site attacks and data exfiltration

The packagehallucination probe is the one I'd run before letting any code-generating model near a build pipeline. Hallucinated package names are a gift to dependency confusion attackers.

When I ran garak's encoding probes against a commercial chat model, quoted-printable and MIME-style injection worked where plain English injection failed. That matches the pattern in garak's own examples: newer models were more susceptible to encoding-based injection than their predecessors. Red-teaming is not a one-time audit.

The supply chain is the weakest link

The scariest item in this cluster is a 36Kr report on LLM proxy routers, not an academic paper. Security researcher Chaofan Shou bought a 6TB dataset for a five-figure dollar sum from a Chinese LLM proxy service. It contained GitLab access tokens, SSH keys, VPN configurations, and cloud root credentials, enough to take over systems at 19 tech companies including Huawei, Xiaomi, NIO, and MiniMax, plus 7 national research institutions.

The mechanism is mundane. Developers point Claude Code, Cursor, or custom agents at third-party routers to save money or work around regional restrictions. Agents scan local workspaces, read .env files, and capture terminal output, then ship all of it into the prompt. The router must decrypt, rewrite auth headers, and forward. In the milliseconds of plaintext exposure, a logging middleman captures everything.

Earlier research by the same team tested 428 routers. Nine actively modified agent instructions. Seventeen touched planted AWS credentials. One drained ETH from a test wallet. During follow-up testing, they pivoted from a compromised router to control roughly 400 development hosts. And 91.1% of developer sessions run in YOLO mode: executing AI output without human confirmation. A router that appends a single malicious line to a response gets silent execution on your machine.

That last number is the real problem. Credentials can be rotated. An agent that already executed attacker-injected commands cannot be un-run. The team started mapping this abuse chain after a client lost $500,000 from a wallet in minutes, when a proxy router's automated sniffer grabbed a private key from the prompt context.

What I see in the community reaction: people keep answering "just use the official API," which misses the point. Official APIs are unavailable or unaffordable in many regions, so the gray market persists. The practical rule is boring but real: no end-to-end encrypted path, no agent traffic through that pipe. Treat any proxy router as a hostile network that can read every prompt you send.

Cybersecurity-specialized models and data

The defensive side of the field is quietly specializing. The kimi-cyber-reasoning dataset is 997 chain-of-thought records distilled from the Kimi K3 reasoning model, covering 13 cybersecurity disciplines and 4 systems engineering domains. 996 of 997 records include explicit reasoning traces, and 175 are tool-calling records with verified JSON execution objects. That's about 2.8M completion tokens, small enough to fine-tune on a single GPU in under an hour, under a WTFPL license that places no restrictions on commercial use.

On the model side, GLM-5.3-CYBERSECURITY-FP8 is an FP8-quantized security-specialized model. FP8 weights roughly halve memory footprint versus BF16, which puts the model in reach of consumer hardware.

The pattern here: red-teaming tools need domain-specialized data to be useful, and domain-specialized models need red-teaming more than general models, because they get higher privilege by default. This round also included Hugging Face publishing a security.txt file, the boring kind of infrastructure detail that makes responsible disclosure actually work.

Common pitfalls

What I see going wrong in practice:

Don't evaluate hallucination detectors only on general benchmarks. The HaluEval F1 of 0.915 collapses to 0.52 on biomedical SciFact data. If your deployment is in law, medicine, or finance, budget for domain fine-tuning from day one.

Don't skip the context ablation when you build a detector. If your model detects hallucination without needing the knowledge context, it's detecting style, not faithfulness. It will fail exactly when you need it.

Don't assume RAG inherits base-model safety. RAG-Safety-Bench shows benign, unrelated documents can push models into unsafe generation even when standalone refusal behavior looks fine. Test the full retrieval pipeline.

Don't route agent traffic through unvetted proxy routers. The 428-router study found 9 that modified instructions and 17 that harvested planted credentials. No end-to-end encryption means the middleman reads every prompt, including the credentials your agent collected from .env.

Don't treat red-teaming as a one-time audit. Encoding-based injection got worse, not better, across commercial model generations. garak is designed to run repeatedly. Put it in CI and re-run on every model update.

One thing to remember: every defense in this roundup assumes you control the full stack, from the model endpoint to the evaluation pipeline. The moment you hand a third party your prompts, your keys, and your agent's execution rights, the best detector and the best red-teaming kit in the world are irrelevant.

The bottom line

If you're deploying a model in a specialized domain, build a domain-tuned hallucination detector and pair it with detector-labeled DPO. The general HaluEval detector loses 43% of its F1 outside its training distribution, and the small-model fix runs on a laptop.

If you're serving models at scale with speculative decoding already enabled, SpecGuard is the only backdoor defense that adds zero inference cost. Treat the draft-token acceptance rate as an always-on monitoring signal. If you don't run draft models, add backdoor auditing to your deploy pipeline instead.

If you're building agents that touch code, credentials, or production systems, remove third-party proxy routers from the path. The 6TB credential leak, the $500K wallet drain, and the 400-host takeover all trace to the same unencrypted middleman. Your supply chain is a bigger risk than your jailbreaks, and it's the one you can actually fix today.