Threats and Defenses in Large Language Models: A Review of Adversarial and Model Poisoning Techniques

Large language models (LLMs) now power assistance, search, code, and agentic workflows, but their broad integration enlarges the attack surface. This review organizes the threat landscape across two planes. At inference time, we cover prompt injection and jailbreaks, universal adversarial suffixes and transferability, tool/agent abuse, retrieval-channel attacks, and privacy leakage from memorization. In the training/model plane, we examine data poisoning in pretraining and finetuning, backdoors and triggers, federated/model-replacement attacks, and supply-chain risks. We synthesize practical mitigations into a defense-in-depth blueprint: alignment (instruction tuning and preference optimization) complemented by guardrails (policy models and filters), retrieval/tool hardening (sanitization, least privilege, sandboxing), robust data curation, and backdoor detection/auditing. We also present a taxonomy and attack→defense mapping with assumptions and residual risk, emphasizing that no single mechanism suffices and that attackers adapt. Key takeaways: (i) short adversarial strings and indirect injections reliably bypass static policies; (ii) small amounts of poisoned data or compromised checkpoints can implant durable triggers; (iii) privacy risks persist through memorization and API design choices; and (iv) effective practice couples layered technical controls with continuous evaluation, red-teaming, and monitoring. We conclude with open problems spanning compositional attacks, longitudinal safety evaluation, supply-chain assurance, scalable privacy, robust policy models, deception detection, and NLP-specific poisoning forensics.