Amnesia: Adversarial Activation Steering on Specific Semantic Layers of Large Language Models(original, opens in a new tab)

Proposes the Amnesia activation steering attack to bypass model safety refusals at inference time.

The researchers propose Reasoning-Oriented Programming, which jailbreaks large vision-language models through chained semantic fragments(original, opens in a new tab)

They propose VROP, which decomposes harmful intent into benign visual gadgets to jailbreak vision-language models.

ADVERSA: Measuring Multi-Turn Guardrail Degradation and Judge Reliability in Large Language Models(original, opens in a new tab)

Use ADVERSA to measure guardrail degradation and reviewer reliability under multi-turn adversarial pressure.

The Continuation vs. Refusal Debate: Mechanism Analysis of Continuation-Triggered Jailbreaks in Large Language Models(original, opens in a new tab)

Analyze the attention head mechanism behind continuation-triggered jailbreaks and propose HCS.

每日论文：Tree of Attacks 自动越狱黑盒大语言模型(original, opens in a new tab)

一篇每日论文解读介绍了 Tree of Attacks with Pruning（TAP），一种无需模型权重、仅靠查询访问的自动化黑盒越狱框架。TAP 用一个带思维链推理的 Attacker LLM 迭代生成并改进对抗提示，由 Evaluator LLM 打分，只有 10 分才算成功，并以分支因子 b=4、最大宽度 w=10、最大深度 d=10 的树搜索与剪枝控制查询量。基准测试中，TAP 在 GPT-4o 上越狱成功率为 94%、平均 16.2 次查询，Gemini-Pro 上 98%、16.2 次查询，PaLM-2 上 96%、12.4 次查询，相比 PAIR 成功率更高、查询更少。

Researchers release Judge Reliability Harness, stress-testing LLM judge reliability(original, opens in a new tab)

Propose JRH, stress-testing the reliability of LLM judge scoring.

SPOC: safety-aware planning under partial observability and physical constraints(original, opens in a new tab)

SPOC 基准在 AI2-THOR 仿真中用单臂移动机械臂评估具身任务规划的安全性，要求模型在部分可观测和物理约束下逐步规划。它以约束成功率（CSR）作为主要安全指标，轨迹中任一安全约束被违反即该样本 CSR 归零。在隐式安全规则设置下，gpt5-mini 与 gpt5-nano 等基线模型的 CSR 为 0%；Qwen 3 Instruct 30B 为 20%，o4-mini 最高为 28%。从完全可观测转为部分可观测使 CSR 下降 12%，加入物理约束再下降 8% 至 9%。

Efficient refusal ablation for large language models via optimal transport(original, opens in a new tab)

Proposes PCA-OT representation-layer refusal ablation, rewriting activations at inference time to bypass refusal.

Internal Safety Collapse in Frontier Large Language Models(original, opens in a new tab)

提出 TVD，在合法双用途任务中触发模型内部安全坍缩。

Understanding and mitigating dataset contamination in large language model steering(original, opens in a new tab)

Use Lee-Valiant robust mean to mitigate steering dataset poisoning.

MUSE: A Run-Unit-Centric Unified Multimodal Safety Evaluation Platform for Large Language Models(original, opens in a new tab)

提出 MUSE 平台，以持久 run 评测多模态多轮越狱。

RA-Det：利用鲁棒性不对称检测 AI 生成图像(original, opens in a new tab)

提出 RA-Det，利用鲁棒性不对称检测 AI 生成图像。

VidDoS：针对视频大语言模型的通用拒绝服务攻击(original, opens in a new tab)

研究者提出 VidDoS，一个面向 Video-LLM 的通用能耗延迟攻击（ELA）框架，通过通用优化生成与实例无关的触发器，无需在推理时计算梯度。

Jailbreaking embodied LLMs via action-level manipulation(original, opens in a new tab)

Propose Blindfold, which jailbreaks embodied LLMs via action-level manipulation.

Defensive Refusal Bias: How Safety Alignment Frustrates Cyber Defenders(original, opens in a new tab)

评测合法网络防御请求中安全敏感词引发的误拒。

VLA 模型中的跨本体对抗迁移(original, opens in a new tab)

Failure-First 的综述认为，针对共享同一基础模型的 VLA 模型，攻击可在不同机器人本体间迁移。文章援引 BadVLA（NeurIPS 2025）通过目标解耦优化注入隐蔽后门，在物理或视觉触发下接近 100% 攻击成功率，且干净任务上性能正常；VLA-Fool（arXiv:2511.16203）用局部对抗补丁或特定噪声分布使任务成功率最多下降 100%；UPA-RFAS（arXiv:2511.21192）显示单个物理补丁可跨不同 VLA 模型、下游操作任务和相机视角迁移。作者指出 AdvBench、HarmBench、JailbreakBench、StrongREJECT 等现有基准只评测单轮对话安全，MITRE ATLAS 与 AgentDojo 仅覆盖数字攻击面，尚无标准化的跨本体对抗基准。该简报为文献综述，尚未在 VLA 硬件上完成实测。

研究者提出 Staged Decoding 与 SFT 数据集，减少大推理模型推理轨迹中的隐私泄露(original, opens in a new tab)

提出 Staged Decoding 与指令跟随训练，减少推理轨迹隐私泄露。

Silent Exfiltration: How Implicit Prompt Injection Lets LLM Agents Leak Data Undetected(original, opens in a new tab)

来自 eBay 的研究者提出隐式提示注入与分片外传，使 Agent 经工具无痕泄露上下文。

Why it was selectedThe paper uses a locally reproducible testbed to quantify implicit prompt injection triggered by URL previews and compares the effectiveness of prompt-layer versus network-layer defenses.

A multi-turn framework for evaluating AI misuse in fraud and cybercrime scenarios(original, opens in a new tab)

提出 LFT 多轮框架，评测模型对欺诈与网络犯罪的可执行协助。

Analyzes large language models' vulnerability to prompt injection and jailbreak attacks(original, opens in a new tab)

Evaluates open-source models' vulnerability to direct prompt injection and jailbreaks, and inference-time defenses.

ICON：基于推理时纠正的 Agent 间接提示注入防御(original, opens in a new tab)

Proposes an inference-time defense, ICON, that detects attention over-focusing and redirects it to correct indirect prompt injection in agents.

OptiLeak: Efficiently Reconstructing Prompts with Reinforcement Learning in Multi-Tenant LLM Services(original, opens in a new tab)

Proposes OPTILEAK, which reconstructs other people's prompts token by token via a KV cache side channel.

CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents(original, opens in a new tab)

The researchers propose CIBER, an automated benchmark for evaluating the security of code interpreter agents, combining dynamic attack generation, isolated sandboxes, and state-aware evaluation.

Red-teaming Claude Opus and ChatGPT security advisors for trusted execution environments(original, opens in a new tab)

Using TEE-REDBENCH to evaluate TEE advisors for mechanism hallucination and prompt-induced failures.

Prompt injection is role confusion(original, opens in a new tab)

提出 CoT Forgery，经用户消息或工具输出注入伪造推理。

Why it was selectedThe paper attributes prompt injection to models judging role provenance by style rather than labels, and its role probe method can be used to test whether defenses truly change internal representations.

When do LLM preferences predict downstream behavior?(original, opens in a new tab)

检验实体偏好对捐赠建议、拒答和任务表现的预测力。

TFL: Targeted Bit-Flip Attack against Large Language Models(original, opens in a new tab)

Proposes TFL targeted bit flips that make a selected prompt output a false answer while unrelated queries remain correct.

Trojan Horse in Recruitment: A Red-Teaming Case Study of Indirect Prompt Injection in Standard vs. Reasoning Models(original, opens in a new tab)

Using invisible instructions in the resume for indirect prompt injection to manipulate hiring recommendations.

GAP Benchmark: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents(original, opens in a new tab)

提出 GAP 基准，测量 Agent 文本安全与工具调用安全的分离。

AgentLAB: A Benchmark for Long-Horizon Attack Evaluation of LLM Agents(original, opens in a new tab)

提出 AgentLAB 基准，评测 LLM 智能体对长程攻击的易受性。

IndicJR: A Judge-Free Benchmark for Jailbreak Robustness in South Asian Languages(original, opens in a new tab)

提出免评判基准 IndicJR，评测南亚语言越狱鲁棒性。

Vulnerability of LLM Re-rankers to Prompt Injection Attacks(original, opens in a new tab)

测量 LLM 重排序器对文档内提示注入的脆弱性。

约翰斯·霍普金斯大学提出 CaPE：面向多智能体协作的安全可解释多模态路径规划(original, opens in a new tab)

约翰斯·霍普金斯大学提出 CaPE（Code as Path Editor）框架，让 VLM 把人类语音合成为可逐行验证的 DSL 路径编辑代码，由 Verifier 拒绝会导致碰撞的代码行，而非直接预测坐标。仿真中两车停车场协商成功率 90%、三车降至 60%，VirtualHome 家务协作 80%；在 6m×6m 真实场地里 Stretch 3 与人共同搬运管道成功率 70%，传统规划器仅 20%。

FERRET：基于扩展的多模态自动化红队测试框架(original, opens in a new tab)

提出 FERRET 框架，用扩展生成多轮多模态越狱对话。

研究者提出面向多轮对话的视觉记忆注入攻击 VMI(original, opens in a new tab)

提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息。

Zombie Agent: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injection(original, opens in a new tab)

提出 Zombie Agent 攻击，经网页间接注入将载荷写入长期记忆并跨会话触发。

Why it was selectedThe paper provides a complete attack chain for cross-session persistent injection and persistence data on two types of memory architectures, which can be used to assess protection gaps in the memory writing stage.

通过反向推理实现小型奖励模型(original, opens in a new tab)

研究者提出 FLIP（FLipped Inference for Prompt reconstruction）奖励建模方法，通过反向推理从给定回答推断最可能产生它的指令，再用推断指令与原始指令的相似度（F1）作为奖励信号，无需参考答案或评分细则。在四个领域、13 个小语言模型（0.6B 至 8B 参数）上，FLIP 平均超过 LLM-as-a-Judge 基线 79.6%。在 GRPO 训练和并行采样的测试时扩展下，该方法提升了下游表现，并报告对常见奖励作弊形式更鲁棒、在更长输出上更有效。代码已在 GitHub 开源。

When benchmarks lie: evaluating malicious prompt classifiers under real-world distribution shift(original, opens in a new tab)

提出 LODO 评测恶意提示探针的跨数据集泛化。

Rubrics as an attack surface: covert preference drift in LLM judges(original, opens in a new tab)

提出改评分标准的搜索攻击，使 LLM 评判者在基准达标下发生偏好漂移。

Why it was selectedThe paper shows that rubric modifications can pass benchmark validation yet still directionally shift judge preferences, and through preference training this propagates into policy-level behavioral drift.

Distraction：多模态大语言模型越狱方法(original, opens in a new tab)

研究者提出 CS-DJ（Contrasting Subimage Distraction Jailbreaking）框架，通过复杂图像分散多模态大语言模型的注意力来绕过安全对齐。该方法把有害查询拆成子查询并用红色文字转成图像，再用 CLIP 检索与查询差异最大的子图，制造语义分布外（SOOD）状态；论文用 Distraction Distance 度量这种偏移，并称偏移越大攻击成功率越高。论文认为这是架构层面的多模态缺陷，而非某一家模型特有的问题。