FlashRT: An Efficient Red-Teaming Framework for Prompt Injection and Knowledge Poisoning in Long-Context LLMs(original, opens in a new tab)

The researchers propose the FlashRT framework to improve the efficiency of optimization-based prompt injection and knowledge poisoning attacks on long-context LLMs while reducing computation and GPU memory overhead.

The researchers propose Multi-AudioJail, which improves the success rate of multilingual and multi-accent audio jailbreak attacks by up to 57.25 percentage points.(original, opens in a new tab)

Propose MULTI-AUDIOJAIL, which jailbreaks audio models with multilingual, multi-accent, and acoustic perturbations.

CodecAttack: Constructing adversarial perturbations in the audio codec latent space to bypass lossy compression defenses(original, opens in a new tab)

Propose CodecAttack, constructing adversarial audio in the codec latent space that can penetrate lossy compression.

Why it was selectedThe paper proposes constructing adversarial perturbations in the latent space of a neural audio codec, bypassing lossy compression previously considered an effective defense, and provides success-rate data across codecs and multiple scenarios.

VRSA: Jailbreaking Multimodal Large Language Models via Visual Reasoning Sequence Attacks(original, opens in a new tab)

Propose the visual reasoning sequence attack VRSA, jailbreaking multimodal large models with image sequences.

The researchers propose an audio narrative jailbreak attack, achieving a success rate of 98.26% on Gemini 2.0 Flash(original, opens in a new tab)

Propose audio narrative jailbreak, bypassing end-to-end speech model refusals via voice delivery style.

AdvOF: Attacking VLM-driven Vision-Language Navigation Agents with Adversarial Object Fusion(original, opens in a new tab)

Propose AdvOF, which generates adversarial objects to mislead the scene perception of vision-language navigation agents.

The researchers propose GPO-V, jailbreaking diffusion vision-language models with global probability optimization(original, opens in a new tab)

Propose GPO-V, jailbreaking diffusion vision-language models with visual perturbations via global probability optimization.

DIQ-H 基准与 VGIR 框架：评估 VLM 在对抗视觉条件下的鲁棒性(original, opens in a new tab)

提出 DIQ-H 基准，评测 VLM 在连续退化视觉流中的幻觉残留与恢复。

The researchers propose Reasoning-Oriented Programming, which jailbreaks large vision-language models through chained semantic fragments(original, opens in a new tab)

They propose VROP, which decomposes harmful intent into benign visual gadgets to jailbreak vision-language models.

研究者提出 CrossMPI：仅用图像扰动实现跨模态提示注入(original, opens in a new tab)

Propose CrossMPI, which achieves cross-modal prompt injection using only image perturbation.

The paper proposes the DSR cross-modal jailbreak framework: using benign inputs to induce harmful outputs from MLLMs(original, opens in a new tab)

Proposes DSR cross-modal jailbreak, using harmless images and text to induce MLLMs to generate harmful images.

GateBreaker: A training-free safety alignment attack framework for MoE large models(original, opens in a new tab)

Proposes GateBreaker, which locates and zeroes MoE safety neurons at inference time to disable safety alignment.

Why it was selectedThe paper provides a method for locating and masking safety neurons in MoE large models at inference time, and reports attack success rates that transfer across models, which can serve as a reference for assessing MoE deployment risks.

The study uses ablation to remove the refusal direction in code LLMs, separating refusal from generation capability.(original, opens in a new tab)

Use abliteration to ablate the refusal direction of code LLMs, separating refusal from vulnerability injection capability.

CacheTrap: Researchers propose a gray-box Trojan attack against LLM KV caches(original, opens in a new tab)

Proposes CacheTrap, flipping a single bit of the KV cache to steer toward a specified class.

Researchers jailbreak text-to-image models with safety guardrails by fine-tuning large language models(original, opens in a new tab)

Proposes PromptTune, which fine-tunes an LLM to rewrite prompts to jailbreak text-to-image guardrails.

Researchers propose a two-stage attack that jailbreaks LLMs by fine-tuning with 10 benign question-answer pairs.(original, opens in a new tab)

Researchers from Nanyang Technological University propose a two-stage benign fine-tuning attack that removes safety alignment via FaaS using benign data.

Research proposes exploration hacking: LLMs can learn to resist RL training(original, opens in a new tab)

Demonstrates that models can resist capability elicitation by exploring less during RL training.

Why it was selected论文用微调构造的模型生物验证了 RL 训练可被策略性探索抑制，并给出检测与恢复手段，为依赖 RL 做能力评估的安全论证提供反例。

Attack evaluation of multilingual jailbreak prompts against closed-source large language models: GPT-4o, DeepSeek-R1, Gemini-1.5-Pro, and Qwen-Max(original, opens in a new tab)

Proposes four-part jailbreak prompts, evaluating the bypass effect of Chinese and English prompts on closed-source models.

ROK-FORTRESS: Measuring the Impact of Geopolitical Rewriting on National Security and Public Safety Evaluations with an English-Korean Transcreation Matrix(original, opens in a new tab)

Constructing the ROK-FORTRESS transcreation matrix to measure the effect of language and geography on national security evaluations.

SpeechJBB: Jailbreak Benchmark for Large Audio Language Models under Code-Switched Speech(original, opens in a new tab)

Proposes SpeechJBB, evaluating jailbreak robustness of audio language models under code-switched speech.

The MFA framework achieves a 58.5% attack success rate across 17 vision-language models(original, opens in a new tab)

The Chinese University of Hong Kong, Beijing Institute of Technology, and Huawei Noah's Ark Lab propose the MFA framework, which collaboratively breaks through the alignment, prompt, and moderation layers of vision-language models.

Trojan Horse in Recruitment: A Red-Teaming Case Study of Indirect Prompt Injection in Standard vs. Reasoning Models(original, opens in a new tab)

Using invisible instructions in the resume for indirect prompt injection to manipulate hiring recommendations.

Research: Prompt injection against Cursor and GitHub Copilot via coding rule files, with attack success rates up to 84%(original, opens in a new tab)

Researchers from institutions including Singapore Management University hijacked coding editors through rule file prompt injection and executed unauthorized terminal commands.

Researchers propose Text-DJ, jailbreaking large vision-language models by exploiting OCR capabilities(original, opens in a new tab)

Proposes Text-DJ, jailbreaking vision-language models with split text-grid images.

研究者用提示注入攻击监控模型，绕过 AI 控制协议(original, opens in a new tab)

提出针对可信监控器的自适应提示注入，绕过 AI 控制协议。

Why it was selected论文把监控模型本身当作攻击面，用提示注入让不可信模型绕过 AI 控制协议，并指出 Defer-to-Resample 会放大攻击。

Researchers propose the relinking vulnerability: LLM agent compression boundaries can be exploited to assemble malicious instructions(original, opens in a new tab)

Researchers at the Hong Kong University of Science and Technology propose the Relink attack, which reassembles scattered benign segments into malicious instructions at the agent compression boundary.

ChartHal: A Fine-Grained Benchmark for Evaluating Hallucination in Chart Understanding by Large Vision-Language Models(original, opens in a new tab)

Proposes the benchmark CHART HAL, a fine-grained evaluation of hallucination in chart understanding.

Study: How safety-aligned LLMs learn from mixed compliance demonstrations(original, opens in a new tab)

Testing whether mixed compliance demonstrations teach models general obedience or harmfulness.

Jailbreak-AudioBench: A Jailbreak Evaluation Benchmark for Large Audio Language Models(original, opens in a new tab)

Propose Jailbreak-AudioBench to evaluate audio-edit jailbreaks of audio language models.

Researchers release Judge Reliability Harness, stress-testing LLM judge reliability(original, opens in a new tab)

Propose JRH, stress-testing the reliability of LLM judge scoring.

The study proposes the CW-POR metric to measure persuasion coverage in multi-agent LLM debates.(original, opens in a new tab)

Proposes CW-POR to measure the coverage of rhetorical persuasion over factual judgment in multi-agent debate.

Study reveals that when reasoning models refuse fake news requests, the chain of thought still contains unsafe narratives(original, opens in a new tab)

分析推理模型拒答假新闻时思维链的内部安全分叉。

FindTheFlaws：用于检测推理缺陷与可扩展监督研究的标注错误数据集(original, opens in a new tab)

构建 FindTheFlaws 并评测模型发现长解答推理缺陷的能力。

CORVUS: Using LoRA to disguise internal signals and bypass single-forward hallucination detectors(original, opens in a new tab)

Researchers from Singapore Management University and other institutions propose CORVUS, using LoRA to disguise internal telemetry to bypass hallucination detectors.

Why it was selectedThe paper provides a complete method for white-box model-side attacks, transfer results across four open-source models, and item-by-item ablations, allowing assessment of the reliability boundaries of internal telemetry-based hallucination detectors.

The paper proposes the AuthBench benchmark to evaluate whether coding agents can infer minimal permission boundaries.(original, opens in a new tab)

Proposes AuthBench to evaluate coding Agent least privilege and validates the sufficiency-tightness decomposition.

Why it was selectedThe paper proposes a permission boundary inference task and the AuthBench benchmark, and provides a decomposition method that reduces attack success rate without training, suitable for teams focusing on Agent permission design.

The paper proposes a random insertion attack that exploits autoregressive consistency to bypass LLM safety alignment(original, opens in a new tab)

Explain how autoregressive consistency leads to shallow safety alignment, and propose a random insertion attack.

The paper proposes a multi-turn online harassment agent benchmark; jailbreak fine-tuning raises the attack success rate above 95%(original, opens in a new tab)

Proposes a multi-turn online harassment agent benchmark, evaluating memory, planning, and fine-tuning jailbreaks.

The researchers propose the SeedHijack attack, hijacking the random seed used in LLM sampling(original, opens in a new tab)

Proposes SeedHijack, hijacking the sampling PRNG to force selected tokens.

Odysseus jailbreaks GPT-4o, Gemini-2.0, and Grok-3 with dual steganography, with attack success rates up to 99%(original, opens in a new tab)

Propose dual-steganography jailbreak Odysseus, using image steganography to bypass multimodal system safety filters.

Why it was selectedThe paper discloses that commercial multimodal system safety filters rely on the assumption that malicious content is explicitly visible, and provides a complete attack chain for cross-modal hidden payloads along with measured success rates.

JAWS-Bench: Researchers jailbreak code agents systematically using three workspace scenarios(original, opens in a new tab)

Proposes JAWS-Bench, which evaluates code agents' jailbreaks and malicious code executability across three levels of workspaces.

Why it was selectedThe paper provides three workspace attack scenarios and an executability determination process, and quantifies how code context weakens refusal, which can serve as a reference when designing agent permissions and execution gating.