---
title: "MCP-Guard — paper by Xing et al. (2026) — summary and ideas"
description: "The authors present MCP-Guard, a proxy that sits between the MCP Host and Server and checks traffic in… 97.7% precision. 30 references."
authors: ["Wenpeng Xing", "Zhonghao Qi", "Yupeng Qin", "Yilin Li", "Caini Chang", "Jiahui Yu", "Changting Lin", "Zhenzhen Xie", "Meng Han"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.240/"
doi: "10.18653/v1/2026.findings-acl.240"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/xing-2026-mcp-guard-multi-stage-defense/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/xing-2026-mcp-guard-multi-stage-defense/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/14/) / MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI

# MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI

**Authors:** [Wenpeng Xing](https://md.research.elamur.ai/free/en/authors/wenpeng-xing/), Zhonghao Qi, Yupeng Qin, Yilin Li, Caini Chang, [Jiahui Yu](https://md.research.elamur.ai/free/en/authors/jiahui-yu/), [Changting Lin](https://md.research.elamur.ai/free/en/authors/changting-lin/), Zhenzhen Xie and [Meng Han](https://md.research.elamur.ai/free/en/authors/meng-han/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.240/) · [PDF](https://aclanthology.org/2026.findings-acl.240.pdf) · [DOI 10.18653/v1/2026.findings-acl.240](https://doi.org/10.18653/v1/2026.findings-acl.240) · [OpenAlex](https://openalex.org/W7166887183)

**Citations:** 1 citations (OpenAlex, 2026-10-14)

## Summary
Connecting LLM agents to external tools through the Model Context Protocol (MCP) opens new attack routes, including prompt injection, Tool Poisoning, Shadowing and data exfiltration. Existing protections are mostly regex gateways or offline scanners, and they miss semantically disguised payloads at runtime. The authors present MCP-Guard, a proxy that sits between the MCP Host and Server and checks traffic in three escalating steps. First, cheap pattern-based detectors catch obvious attacks. Second, a fully fine-tuned Multilingual E5 classifier scores semantic maliciousness. Third, an LLM arbitrator is called only for uncertain cases and can fall back on the neural score. To train and test the detector, they built MCP-AttackBench, a GPT-4-augmented collection of 70,448 samples covering MCP-specific threats. The best configuration reaches an F1 of 95.4%. The cascade also roughly halves latency compared with running an LLM detector alone, and it generalizes well to outside benchmarks. This shows that layered runtime inspection can make agent–tool ecosystems safer without large slowdowns.

## Key points
- **Stage I (regex filters):** 97.7% precision but only 38.9% recall, at about 1.8 ms per request. It acts as a fast first sieve.
- **Stage II (E5 classifier):** an off-the-shelf E5 model reaches 65.37% accuracy. After fine-tuning on MCP-AttackBench it reaches 96.01% accuracy and 95.1% F1.
- **Full pipeline with GPT-4o-mini:**
  - Average latency is 505.9 ms, a 1.56× speedup over standalone GPT-4o-mini (788.4 ms) and about 12× faster than MCP-Shield.
  - Across backbones, the average speedup is 2.04×.
  - The average F1 gain over standalone LLMs is 23.4 points, including a 61.2-point gain for TinyLlama-1.1B.
- **External benchmarks:** on AgentDefense, MCPSecBench and RAS-Eval, Deepseek-chat as arbitrator averages 97.21% F1. Llama-3-8B averages 96.51% F1 with about 85 ms latency.
- **Limitations and release:** the system covers text-only payloads and depends on the current MCP transport. MCP-AttackBench is planned for release under a research-only license, with personal data and credentials removed.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Zhejiang University](https://md.research.elamur.ai/free/en/universities/zhejiang-university/) — University, Hangzhou, China · 172 works · 12,988 citations
- [Chinese University of Hong Kong](https://md.research.elamur.ai/free/en/universities/chinese-university-of-hong-kong/) — University, Hong Kong, China · 126 works · 14,073 citations
- [Shandong University](https://md.research.elamur.ai/free/en/universities/shandong-university/) — University, Jinan, China · 17 works · 789 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works

## Cite

Cite as: Wenpeng Xing, Zhonghao Qi, Yupeng Qin, Yilin Li, Caini Chang, Jiahui Yu, Changting Lin, Zhenzhen Xie and Meng Han. 2026. MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{xing2026mcp,
  title = {{MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI}},
  author = {Wenpeng Xing, Zhonghao Qi, Yupeng Qin, Yilin Li, Caini Chang, Jiahui Yu, Changting Lin, Zhenzhen Xie and Meng Han},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.240},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.240}
}
```

- [← previous McMasters of Change: Predicting Well-Being States and Transitions from Longitudinal Language](https://md.research.elamur.ai/free/en/papers/zhang-2026-mcmasters-change-predicting-well-being/)
- [next → mdok-style at SemEval-2026 Task 10: Finetuning LLMs for Conspiracy Detection](https://md.research.elamur.ai/free/en/papers/macko-2026-mdok-style-semeval-2026-task-2026-semeval-1-64/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/14/)

## References

30 references, 2 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Anthropic. 2025. Introducing the model context protocol. [https://www.anthropic.com/news/](https://www.anthropic.com/news/) model-context-protocol. Accessed: 2025-08-1. [↗](https://www.anthropic.com/news/)
2. Luca Beurer-Kellner and Marc Fischer. 2025. Mcp security notification: Tool poisoning attacks. Invariant Labs Blog. [find](https://scholar.google.com/scholar?q=Luca+Beurer%2DKellner+and+Marc+Fischer%2E+2025%2E+Mcp+security+notification%3A+Tool+poisoning+attacks%2E+Invariant+Labs+Blog%2E)
3. Manish Bhatt, Vineeth Sai Narajala, and Idan Habler. 2025. Etdi: Mitigating tool squatting and rug pull attacks in model context protocol (mcp) by using oauth-enhanced tool definitions and policy-based access control. arXiv preprint arXiv:2506.01333. — [arXiv:2506.01333](https://arxiv.org/abs/2506.01333) [find](https://scholar.google.com/scholar?q=Manish+Bhatt%2C+Vineeth+Sai+Narajala%2C+and+Idan+Habler%2E+2025%2E+Etdi%3A+Mitigating+tool+squatting+and+rug+pull+attacks+in+model+context+protocol+%28mcp%29+by+using+oauth%2Denhanced+tool+definitions+and+policy%2Dbase)
4. Ivo Brett. 2025. Simplified and secure mcp gateways for enterprise ai integration. Preprint. Available at [https://independent.academia.edu/ivobrett](https://independent.academia.edu/ivobrett). [↗](https://independent.academia.edu/ivobrett)
5. Cloudflare. 2025. Mcp connectors on cloudflare workers. Cloudflare Blog. [find](https://scholar.google.com/scholar?q=Cloudflare%2E+2025%2E+Mcp+connectors+on+cloudflare+workers%2E+Cloudflare+Blog%2E)
6. Junfeng Fang, Zijun Yao, Ruipeng Wang, Haokai Ma, Xiang Wang, and Tat-Seng Chua. 2025. We should identify and mitigate third-party safety risks in mcp-powered agent systems. arXiv preprint arXiv:2506.13666v1. — [arXiv:2506.13666](https://arxiv.org/abs/2506.13666) [find](https://scholar.google.com/scholar?q=Junfeng+Fang%2C+Zijun+Yao%2C+Ruipeng+Wang%2C+Haokai+Ma%2C+Xiang+Wang%2C+and+Tat%2DSeng+Chua%2E+2025%2E+We+should+identify+and+mitigate+third%2Dparty+safety+risks+in+mcp%2Dpowered+agent+systems%2E+arXiv+preprint+arXiv%3A2506%2E)
7. Yuchuan Fu, Xiaohan Yuan, and Dongxia Wang. 2025. Ras-eval: A comprehensive benchmark for security evaluation of llm agents in real-world environments. arXiv preprint arXiv:2506.15253. 4885 9 — [arXiv:2506.15253](https://arxiv.org/abs/2506.15253) [find](https://scholar.google.com/scholar?q=Yuchuan+Fu%2C+Xiaohan+Yuan%2C+and+Dongxia+Wang%2E+2025%2E+Ras%2Deval%3A+A+comprehensive+benchmark+for+security+evaluation+of+llm+agents+in+real%2Dworld+environments%2E+arXiv+preprint+arXiv%3A2506%2E15253%2E+4885+9+%E2%80%94+%5BarXiv)
8. Yongjian Guo, Puzhuo Liu, Wanlun Ma, Zehang Deng, Xiaogang Zhu, Peng Di, Xi Xiao, and Sheng Wen. 2025. Systematic analysis of mcp security. arXiv preprint arXiv:2508.12538. — [arXiv:2508.12538](https://arxiv.org/abs/2508.12538) [find](https://scholar.google.com/scholar?q=Yongjian+Guo%2C+Puzhuo+Liu%2C+Wanlun+Ma%2C+Zehang+Deng%2C+Xiaogang+Zhu%2C+Peng+Di%2C+Xi+Xiao%2C+and+Sheng+Wen%2E+2025%2E+Systematic+analysis+of+mcp+security%2E+arXiv+preprint+arXiv%3A2508%2E12538%2E+%E2%80%94+%5BarXiv%3A2508%2E12538%5D%28https%3A)
9. Xinyi Hou, Yanjie Zhao, Shenao Wang, and Haoyu Wang. 2025. Model context protocol (mcp): Landscape, security threats, and future research directions. arXiv preprint arXiv:2503.23278. Huazhong University of Science and Technology, China. — [arXiv:2503.23278](https://arxiv.org/abs/2503.23278) [find](https://scholar.google.com/scholar?q=Xinyi+Hou%2C+Yanjie+Zhao%2C+Shenao+Wang%2C+and+Haoyu+Wang%2E+2025%2E+Model+context+protocol+%28mcp%29%3A+Landscape%2C+security+threats%2C+and+future+research+directions%2E+arXiv+preprint+arXiv%3A2503%2E23278%2E+Huazhong+Universi)
10. Invariant-Labs. 2024. Mcp-scan: A lightweight security detection framework. [https://github.com/](https://github.com/) invariantlabs-ai/mcp-scan. Accessed: 2025-07-31. [↗](https://github.com/)
11. Huihao Jing, Haoran Li, Wenbin Hu, Qi Hu, Xu Heli, Tianshu Chu, Peizhao Hu, and Yangqiu Song. 2025. Mcip: Protecting mcp safety via model contextual integrity protocol. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 1177–1194. [find](https://scholar.google.com/scholar?q=Huihao+Jing%2C+Haoran+Li%2C+Wenbin+Hu%2C+Qi+Hu%2C+Xu+Heli%2C+Tianshu+Chu%2C+Peizhao+Hu%2C+and+Yangqiu+Song%2E+2025%2E+Mcip%3A+Protecting+mcp+safety+via+model+contextual+integrity+protocol%2E+In+Proceedings+of+the+2025+Conf)
12. Nikita Kryzhanouski. 2024. Mcp-shield: Safety-constrained multi-agent path planning. [https://github.com/riseandignite/mcp-shield](https://github.com/riseandignite/mcp-shield). Accessed: 2025-07-31. [↗](https://github.com/riseandignite/mcp-shield)
13. Sonu Kumar, Anubhav Girdhar, Ritesh Patil, and Divyansh Tripathi. 2025. Mcp guardian: A security-first layer for safeguarding mcp-based ai system. arXiv preprint arXiv:2504.12757. — [arXiv:2504.12757](https://arxiv.org/abs/2504.12757) [find](https://scholar.google.com/scholar?q=Sonu+Kumar%2C+Anubhav+Girdhar%2C+Ritesh+Patil%2C+and+Divyansh+Tripathi%2E+2025%2E+Mcp+guardian%3A+A+security%2Dfirst+layer+for+safeguarding+mcp%2Dbased+ai+system%2E+arXiv+preprint+arXiv%3A2504%2E12757%2E+%E2%80%94+%5BarXiv%3A2504%2E12757%5D)
14. Minghao Li, Wenpeng Xing, Yong Liu, Wei Zhang, and Meng Han. 2025. Optimizing and attacking embodied intelligence: Instruction decomposition and adversarial robustness. In 2025 IEEE International Conference on Multimedia and Expo (ICME), pages 1–6. IEEE. [find](https://scholar.google.com/scholar?q=Minghao+Li%2C+Wenpeng+Xing%2C+Yong+Liu%2C+Wei+Zhang%2C+and+Meng+Han%2E+2025%2E+Optimizing+and+attacking+embodied+intelligence%3A+Instruction+decomposition+and+adversarial+robustness%2E+In+2025+IEEE+International+Conf)
15. Rongchang Li, Minjie Chen, Chang Hu, Han Chen, Wenpeng Xing, and Meng Han. 2024. Gentel-safe: A unified benchmark and shielding framework for defending against prompt injection attacks. arXiv preprint arXiv:2409.19521. — [arXiv:2409.19521](https://arxiv.org/abs/2409.19521) [find](https://scholar.google.com/scholar?q=Rongchang+Li%2C+Minjie+Chen%2C+Chang+Hu%2C+Han+Chen%2C+Wenpeng+Xing%2C+and+Meng+Han%2E+2024%2E+Gentel%2Dsafe%3A+A+unified+benchmark+and+shielding+framework+for+defending+against+prompt+injection+attacks%2E+arXiv+preprint)
16. Vineeth Sai Narajala, Ken Huang, and Idan Habler. 2025. Securing genai multi-agent systems against tool squatting: A zero trust registry-based approach. arXiv preprint arXiv:2504.19951. — [arXiv:2504.19951](https://arxiv.org/abs/2504.19951) [find](https://scholar.google.com/scholar?q=Vineeth+Sai+Narajala%2C+Ken+Huang%2C+and+Idan+Habler%2E+2025%2E+Securing+genai+multi%2Dagent+systems+against+tool+squatting%3A+A+zero+trust+registry%2Dbased+approach%2E+arXiv+preprint+arXiv%3A2504%2E19951%2E+%E2%80%94+%5BarXiv%3A2504%2E)
17. Brandon Radosevich and John Halloran. 2025. Mcp safety audit: Llms with the model context protocol allow major security exploits. arXiv preprint arXiv:2504.03767. — [arXiv:2504.03767](https://arxiv.org/abs/2504.03767) [find](https://scholar.google.com/scholar?q=Brandon+Radosevich+and+John+Halloran%2E+2025%2E+Mcp+safety+audit%3A+Llms+with+the+model+context+protocol+allow+major+security+exploits%2E+arXiv+preprint+arXiv%3A2504%2E03767%2E+%E2%80%94+%5BarXiv%3A2504%2E03767%5D%28https%3A%2F%2Farxiv%2Eor)
18. Arun Sanna. 2025. Agentdefense-bench: A security benchmark for mcp-based ai agents. [find](https://scholar.google.com/scholar?q=Arun+Sanna%2E+2025%2E+Agentdefense%2Dbench%3A+A+security+benchmark+for+mcp%2Dbased+ai+agents%2E)
19. Bin Wang, Zexin Liu, Hao Yu, Ao Yang, Yenan Huang, Jing Guo, Huangsheng Cheng, Hui Li, and Huiyu Wu. 2025a. Mcpguard: Automatically detecting vulnerabilities in mcp servers. arXiv preprint arXiv:2510.23673. — [arXiv:2510.23673](https://arxiv.org/abs/2510.23673) [find](https://scholar.google.com/scholar?q=Bin+Wang%2C+Zexin+Liu%2C+Hao+Yu%2C+Ao+Yang%2C+Yenan+Huang%2C+Jing+Guo%2C+Huangsheng+Cheng%2C+Hui+Li%2C+and+Huiyu+Wu%2E+2025a%2E+Mcpguard%3A+Automatically+detecting+vulnerabilities+in+mcp+servers%2E+arXiv+preprint+arXiv%3A2510%2E)
20. Liang Wang, Nan Yang, Xiaolong Huang, Binxing Jiao, Linjun Yang, Daxin Jiang, Rangan Majumder, and Furu Wei. 2022. [Text embeddings by weakly-supervised contrastive pre-training](https://md.research.elamur.ai/free/en/papers/wang-2022-text-embeddings-weakly-supervised-contrastive/). arXiv preprint arXiv:2212.03533.
21. Zihan Wang, Hongwei Li, Rui Zhang, Yu Liu, Wenbo Jiang, Wenshu Fan, Qingchuan Zhao, and Guowen Xu. 2025b. Mpma: Preference manipulation attack against model context protocol. arXiv preprint arXiv:2506.02040. — [arXiv:2506.02040](https://arxiv.org/abs/2506.02040) [find](https://scholar.google.com/scholar?q=Zihan+Wang%2C+Hongwei+Li%2C+Rui+Zhang%2C+Yu+Liu%2C+Wenbo+Jiang%2C+Wenshu+Fan%2C+Qingchuan+Zhao%2C+and+Guowen+Xu%2E+2025b%2E+Mpma%3A+Preference+manipulation+attack+against+model+context+protocol%2E+arXiv+preprint+arXiv%3A2506)
22. Wenpeng Xing, Minghao Li, Mohan Li, and Meng Han. 2025a. Towards robust and secure embodied ai: A survey on vulnerabilities and attacks. arXiv preprint arXiv:2502.13175. — [arXiv:2502.13175](https://arxiv.org/abs/2502.13175) [find](https://scholar.google.com/scholar?q=Wenpeng+Xing%2C+Minghao+Li%2C+Mohan+Li%2C+and+Meng+Han%2E+2025a%2E+Towards+robust+and+secure+embodied+ai%3A+A+survey+on+vulnerabilities+and+attacks%2E+arXiv+preprint+arXiv%3A2502%2E13175%2E+%E2%80%94+%5BarXiv%3A2502%2E13175%5D%28https%3A%2F%2Fa)
23. Wenpeng Xing, Mohan Li, Chunqiang Hu, Haitao XuN-ingyu Zhang, Bo Lin, and Meng Han. 2025b. Latent fusion jailbreak: Blending harmful and harmless representations to elicit unsafe llm outputs. arXiv preprint arXiv:2508.10029. — [arXiv:2508.10029](https://arxiv.org/abs/2508.10029) [find](https://scholar.google.com/scholar?q=Wenpeng+Xing%2C+Mohan+Li%2C+Chunqiang+Hu%2C+Haitao+XuN%2Dingyu+Zhang%2C+Bo+Lin%2C+and+Meng+Han%2E+2025b%2E+Latent+fusion+jailbreak%3A+Blending+harmful+and+harmless+representations+to+elicit+unsafe+llm+outputs%2E+arXiv+pr)
24. Zhenhua Xu, Meng Han, and Wenpeng Xing. 2025a. Evertracer: Hunting stolen large language models via stealthy and robust probabilistic fingerprint. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 7019– 7042. [find](https://scholar.google.com/scholar?q=Zhenhua+Xu%2C+Meng+Han%2C+and+Wenpeng+Xing%2E+2025a%2E+Evertracer%3A+Hunting+stolen+large+language+models+via+stealthy+and+robust+probabilistic+fingerprint%2E+In+Proceedings+of+the+2025+Conference+on+Empirical+Me)
25. Zhenhua Xu, Meng Han, Xubin Yue, and Wenpeng Xing. 2025b. Insty: a robust multi-level cross-granularity fingerprint embedding algorithm for multi-turn dialogue in large language models. SCI-ENTIA SINICA Informationis, 55(8):1906. [find](https://scholar.google.com/scholar?q=Zhenhua+Xu%2C+Meng+Han%2C+Xubin+Yue%2C+and+Wenpeng+Xing%2E+2025b%2E+Insty%3A+a+robust+multi%2Dlevel+cross%2Dgranularity+fingerprint+embedding+algorithm+for+multi%2Dturn+dialogue+in+large+language+models%2E+SCI%2DENTIA+SINI)
26. Zhenhua Xu, Zhebo Wang, Maike Li, Wenpeng Xing, Chunqiang Hu, Chen Zhi, and Meng Han. 2025c. Rap-sm: Robust adversarial prompt via shadow models for copyright verification of large language models. arXiv preprint arXiv:2505.06304. — [arXiv:2505.06304](https://arxiv.org/abs/2505.06304) [find](https://scholar.google.com/scholar?q=Zhenhua+Xu%2C+Zhebo+Wang%2C+Maike+Li%2C+Wenpeng+Xing%2C+Chunqiang+Hu%2C+Chen+Zhi%2C+and+Meng+Han%2E+2025c%2E+Rap%2Dsm%3A+Robust+adversarial+prompt+via+shadow+models+for+copyright+verification+of+large+language+models%2E+ar)
27. Zhenhua Xu, Xubin Yue, Zhebo Wang, Qichen Liu, Xixiang Zhao, Jingxuan Zhang, Wenjun Zeng, Wengpeng Xing, Dezhang Kong, Changting Lin, et al. 2025d. Copyright protection for large language models: A survey of methods, challenges, and trends. arXiv preprint arXiv:2508.11548. — [arXiv:2508.11548](https://arxiv.org/abs/2508.11548) [find](https://scholar.google.com/scholar?q=Zhenhua+Xu%2C+Xubin+Yue%2C+Zhebo+Wang%2C+Qichen+Liu%2C+Xixiang+Zhao%2C+Jingxuan+Zhang%2C+Wenjun+Zeng%2C+Wengpeng+Xing%2C+Dezhang+Kong%2C+Changting+Lin%2C+et+al%2E+2025d%2E+Copyright+protection+for+large+language+models%3A+A+su)
28. Yixuan Yang, Daoyuan Wu, and Yufan Chen. 2025. Mcpsecbench: A systematic security benchmark and playground for testing model context protocols. arXiv preprint arXiv:2508.13220. — [arXiv:2508.13220](https://arxiv.org/abs/2508.13220) [find](https://scholar.google.com/scholar?q=Yixuan+Yang%2C+Daoyuan+Wu%2C+and+Yufan+Chen%2E+2025%2E+Mcpsecbench%3A+A+systematic+security+benchmark+and+playground+for+testing+model+context+protocols%2E+arXiv+preprint+arXiv%3A2508%2E13220%2E+%E2%80%94+%5BarXiv%3A2508%2E13220%5D%28ht)
29. Xubin Yue, Zhenhua Xu, Wenpeng Xing, Jiahui Yu, Mohan Li, and Meng Han. 2025. Pree: Towards harmless and adaptive fingerprint editing in large language models via knowledge prefix enhancement. Preprint. [find](https://scholar.google.com/scholar?q=Xubin+Yue%2C+Zhenhua+Xu%2C+Wenpeng+Xing%2C+Jiahui+Yu%2C+Mohan+Li%2C+and+Meng+Han%2E+2025%2E+Pree%3A+Towards+harmless+and+adaptive+fingerprint+editing+in+large+language+models+via+knowledge+prefix+enhancement%2E+Preprin)
30. Jingxuan Zhang, Zhenhua Xu, Rui Hu, Wenpeng Xing, Xuhong Zhang, and Meng Han. 2025. [Meraser: An effective fingerprint erasure approach for large language models](https://md.research.elamur.ai/free/en/papers/zhang-2025-meraser-effective-fingerprint-erasure-approach/). arXiv preprint arXiv:2506.12551. 4886 10

*Updated 1 November 2026*