Stop Tracking Me! Proactive Defenses Against LLM Attribute Inference Attacks(original, opens in a new tab)

Proposes a user-side defense TRACE-RPS, which anonymizes text before sharing and appends a suffix to suppress attribute inference.

AgentLeak: A Benchmark for Privacy Leakage in Internal Channels of Multi-Agent LLM Systems(original, opens in a new tab)

提出 AgentLeak 基准，测量多智能体内部通道隐私泄露。

大语言模型数据投毒的规模趋势(original, opens in a new tab)

一篇论文研究了大语言模型数据投毒的规模趋势，在 24 个前沿模型（含 Llama、Qwen、Yi 系列）上发现模型规模越大越易受投毒影响，从少量投毒数据中学会有害行为的效率更高。论文还指出分词器中的特殊 token 可被直接注入用户输入并当作结构命令执行，在 GPT-3.5 上取得 96% 的越狱成功率，作者将其类比为 SQL 注入。研究把投毒分为恶意微调、数据整理不当和蓄意污染三类威胁模型，并称现有微调 API 的审核不一致，用仅含 2% 越狱改造有害数据的样本微调 GPT-4o 后，模型对有害提示的拒答率降至 4%。Gemma-2 呈现相反的规模趋势，作者认为可能为防护提供线索。

Safety Recovery of Reasoning Models Only Needs a Few Early Steps of Guidance(original, opens in a new tab)

Propose inference-time defense SafeThink, which monitors the chain of thought and injects a redirect prefix when below a threshold.

Peak + Accumulation: A proxy-layer scoring formula for multi-turn LLM attack detection(original, opens in a new tab)

Proposes an agent-level peak + accumulation formula to detect attacks distributed across multiple rounds.

Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System(original, opens in a new tab)

Proposes Aura, which uses a trusted kernel to mediate the identity, perception, and action control of mobile agents.

VideoSTF reveals output repetition problems in video large models, with temporal perturbation attack success rates up to 98%(original, opens in a new tab)

Propose VIDEO STF to evaluate output repetition in video LLMs and stress-test temporal perturbations.

Can large language models automatically jailbreak GPT-4V?(original, opens in a new tab)

研究者提出 AutoJailbreak，一种借助大语言模型自动优化越狱提示词、针对 GPT-4V 的自动越狱方法，论文称攻击成功率超过 95.3%。该方法用 LLM 做红队测试来精炼越狱提示，并采用 weak-to-strong 上下文学习提示提升效率，还引入带 early stopping 的搜索以减少优化时间和 token 开销。实验显示其显著超过常规方法。Failure-First 的解读指出，攻击者只需 API 访问和一个有能力的模型，无需接触 GPT-4V 内部权重，且在一个目标上训练的攻击模型往往能迁移到其他目标，攻击自动化会降低越狱成本。

Detecting Jailbreak Attempts in Clinical Training LLMs via Automatic Linguistic Feature Extraction(original, opens in a new tab)

Fine-tune an encoder to extract linguistic features and classify, detecting jailbreaks in clinical training dialogues.

Researchers propose the vision-centric jailbreak attack VJA, achieving an attack success rate of 80.9% against Nano Banana Pro(original, opens in a new tab)

清华大学与鹏城实验室等机构的研究者提出纯视觉越狱攻击 VJA，把有害编辑指令编码进图像。

Why it was selected论文给出视觉提示越狱在多个商业图像编辑模型上的成功率，并配套基准与免训练防御，便于评估图像编辑链路的安全缺口。

Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models(original, opens in a new tab)

Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models.

MUZZLE: An Adaptive Agent Red-Teaming Framework for Indirect Prompt Injection Attacks on Web Agents(original, opens in a new tab)

提出 MUZZLE，自动红队测试 Web Agent 的间接提示注入。

Red-Teaming Multimodal Reasoning: Cross-Modal Entanglement Attacks Jailbreak Vision-Language Models(original, opens in a new tab)

Proposes COMET cross-modal entanglement attack to jailbreak vision-language models.

Automated red-teaming pipeline stress-tests alignment audits, finds prompt-level strategic deception can render audits ineffective(original, opens in a new tab)

提出自动化红队流水线，用系统提示词压测对齐审计能否抵御策略性欺骗。

Why it was selected论文首次记录基于激活的上下文策略性欺骗，并给出白盒与黑盒审计方法在自动红队下的失效证据，为对齐审计的鲁棒性评估提供可复现方法。

RLBF: Retrospective Feedback Reinforcement Learning for LLM Safety(original, opens in a new tab)

Proposes RLBF, which trains the model to retract violating segments mid-generation and continue writing.

大规模 WildTeaming：从真实世界越狱到（对抗性）更安全的语言模型(original, opens in a new tab)

WildTeaming 是一个自动化的 LLM 安全红队框架，通过挖掘真实用户与聊天机器人的对话，发现 5.7K 个新颖越狱策略簇，并组合多种策略系统性地探索新越狱。论文称其生成的对抗攻击在多样性和成功率上最高达到现有最优越狱方法的 4.6 倍，分析覆盖 1.6M 条真实用户交互。作者据此构建开源安全数据集 WildJailbreak，包含 262K 条直接请求与对抗性越狱的提示词和回复对，并提供有害查询与形式相似但无害的良性查询两类对照数据，以缓解过度拒答。实验显示，用真实越狱样本微调可显著提升模型鲁棒性，同时尽量不降低通用能力。

Lost in translation? A comparative study of cross-lingual transfer of composite harms in large language models(original, opens in a new tab)

Proposes CompositeHarm, comparing cross-lingual transfer of syntactic manipulation and semantic harm.

CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution(original, opens in a new tab)

Proposes indirect prompt injection guardrail CausalArmor, selectively scrubbing untrusted segments based on causal attribution.

当 LLM 遇上 DRL：通过 DRL 引导搜索提升越狱效率(original, opens in a new tab)

论文提出 RLbreaker，一种由深度强化学习（DRL）驱动的黑盒越狱攻击方法，把越狱提示的构造建模为搜索问题，用 RL 智能体选择改写、扩写、缩短等变异策略以最大化攻击成功率。作者称该方法设计了定制的奖励函数和 PPO 算法，在六个 SOTA LLM 上比现有越狱攻击更有效，并对三种 SOTA 防御保持稳健，消融实验验证了关键设计选择。摘要还称在可访问模型上训练出的智能体可跨模型迁移，该帖文提到其可用于 GPT-4 和 Claude 等闭源系统。帖文作者认为，随着攻击自动化程度提高，攻击成本与防御成本之间的不对称会进一步加剧，防御方需要假定攻击者掌握自动化攻击工具。

AgentSys: Secure and Dynamic LLM Agents via Explicit Hierarchical Memory Management(original, opens in a new tab)

华盛顿大学圣路易斯分校与约翰霍普金斯大学的研究者提出 AGENTSYS 分层记忆隔离，防御 Agent 间接提示注入。

Aegis: Governance, Integrity, and Security for AI Voice Agents(original, opens in a new tab)

Proposes the Aegis red teaming framework for multi-round attacks on high-risk voice agents.

Revisiting the robustness of LLM safety alignment through selective geometric control(original, opens in a new tab)

提出 ShaPO，只在安全关键子空间做最坏情况偏好对齐。

JailbreakBench：面向大语言模型越狱的开源鲁棒性基准(original, opens in a new tab)

JailbreakBench 是一个面向大语言模型越狱的开源鲁棒性基准，包含持续更新的越狱提示词库、100 条行为数据集、标准化评测框架和排行榜。论文指出，现有越狱评测缺乏统一标准，成本与成功率的计算方式不可比，且许多工作不公开对抗提示词、使用闭源代码或依赖不断变化的专有 API，导致难以复现。该基准的评测显示，即使是前沿模型也存在可测量的越狱漏洞，不同模型的鲁棒性差异很大，部分防御对某些攻击有效却对其他攻击失效。评测框架发布在 GitHub，排行榜跟踪不同大语言模型的攻击与防御表现。

ShallowJail: Guiding Jailbreak Attacks Against Large Language Models(original, opens in a new tab)

Proposes ShallowJail, which achieves jailbreaks by rewriting hidden states with steering vectors at inference time.

新论文：攻击选择使可信监控的 AI 控制安全率从 99% 降至 59%(original, opens in a new tab)

一篇新论文研究 AI 控制中的攻击选择问题，即 AI 自行选择何时发起攻击以躲过监控。作者称，在纳入攻击选择后，可信监控方案的安全率从 99% 降至 59%，说明这类方案可能没有此前认为的那样安全。论文链接为 http://arxiv.org/abs/2602.04930。

Confundo: Learning to Generate Robust Poisoning Content for Real RAG Systems(original, opens in a new tab)

Proposes Confundo, which fine-tunes a poisoning generator to produce chunking-resistant robust poisoned content for RAG.

MPIB: A Benchmark for LLM Medical Prompt Injection Attacks and Clinical Safety(original, opens in a new tab)

The researchers propose the medical prompt injection benchmark MPIB to evaluate the clinical safety of LLMs and RAG systems under direct prompt injection and RAG indirect injection.

Safe steering or falling off a cliff? Re-examining the specificity and robustness of inference-time interventions(original, opens in a new tab)

系统评估推理时转向的特异性与安全鲁棒性。

Why it was selectedThe paper proposes a three-dimensional framework for evaluating the specificity of inference-time interventions, and shows that steering that reduces over-refusal appears safe under standard evaluations yet significantly increases jailbreak success rates.

REBEL: Recovering Hidden Knowledge through Evolutionary Evaluation Loops(original, opens in a new tab)

提出进化式黑盒提示搜索 REBEL，恢复已遗忘模型的隐藏知识。

Chunky Post-Training: Data-Driven Generalization Failures(original, opens in a new tab)

提出 SURF 与 TURF，回溯后训练数据块导致的行为错用。

Why it was selectedThe paper attributes models' erroneous triggering of refusals, rebuttals, and other behaviors under specific phrasings to distributional imbalances in post-training data, and provides reusable tools for localization.

Learning to Inject: Automated Prompt Injection via Reinforcement Learning(original, opens in a new tab)

ETH Zürich 研究者提出 AutoInject，用强化学习自动学习提示注入后缀。

Masked Mirror: Covert Prompt Injection Attacks Against LLM-Based Phishing Detection(original, opens in a new tab)

提出隐蔽提示注入攻击 LLM 钓鱼检测器，并给出防御 InjectDefuser。

BadTemplate: Training-Free Backdoor Attacks on Large Language Models via Chat Templates(original, opens in a new tab)

提出 BadTemplate，通过改 chat template 植入免训练后门。

The researchers propose the MM-Plan multimodal jailbreak framework, with an attack success rate of 46.3% against Claude 4.5 Sonnet(original, opens in a new tab)

Proposes the MM-Plan multimodal jailbreak framework, automatically planning multi-turn image edits to jailbreak visual exclusivity targets.

Study reveals that when reasoning models refuse fake news requests, the chain of thought still contains unsafe narratives(original, opens in a new tab)

分析推理模型拒答假新闻时思维链的内部安全分叉。

Safety evaluation is like a coin toss: LLM judges cannot reliably measure adversarial robustness(original, opens in a new tab)

慕尼黑工业大学、Mila 等机构的研究者审计安全裁判在对抗分布偏移下衡量鲁棒性的可靠性。

Routing-aware Safety Alignment for Mixture-of-Experts Models(original, opens in a new tab)

Propose routing-aware safety alignment RASA, which fine-tunes only jailbreak-activated experts and constrains routing.

How Few-shot Examples Affect Prompt-based Defenses Against LLM Jailbreak Attacks(original, opens in a new tab)

Analyzing the effect of few-shot demonstrations on the jailbreak resistance of RoP and ToP prompt defenses.

Steering Externalities: Benign Activation Steering Inadvertently Increases Jailbreak Risk in Large Language Models(original, opens in a new tab)

分析良性激活转向如何削弱拒绝并放大越狱风险。

An empirical study on noisy data and LLM pretraining loss divergence(original, opens in a new tab)

Analyze the impact of controlled uniform random noise on pretraining loss divergence.