Abstract
Attack success rates alone do not establish the security of large language model (LLM) systems because results depend on the attacker, deployment conditions, and measured consequence. This survey complements existing attack and defense taxonomies by examining what individual experiments actually support. We pair a threat model describing attacker capabilities and objectives with a defense model specifying observable information, security functions, and enforceable responses. An attack-defense assurance matrix determines whether an evaluation addresses the conditions relevant to a stated security claim. A bounded claim grammar also records the attacker, system version, consequence, cost, evaluation oracle, and other conditions that limit the result. An evidence ladder organizes empirical requirements for a fixed security claim and threat model without ranking papers or defenses. We apply the framework across model behavior, retrieval and memory, agents and tools, supply chains, privacy, availability, and serving infrastructure. The resulting synthesis helps researchers and practitioners distinguish demonstrated protection from untested conditions, compare results under matched assumptions, and design evaluations that measure the security consequences relevant to deployment.