Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 4 papers
Filter5

Attack type

Jailbreaks35Extraction and theft1Detection evasion3

Attack technique

Gradient and representation optimization1Automated search10Encoding and obfuscation3Role-play and persuasion3Defense-targeted6

System type

Models and APIs3

Attacker access

Black-box4White-box3

Attack surface / entry point

User input3

Layer

Prompt layer4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Attack type：Extraction and theftAttack type：Detection evasionAttack technique：Gradient and representation optimizationAttack technique：Encoding and obfuscationAttacker access：Black-boxClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2606.09700

    The researchers propose the HPAA attack: bypassing 13 content moderation systems with typographic visual cues

    提出 HPAA 攻击，用排版视觉线索绕过内容审核系统

    arXiv
    2606.09700
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    Llama-Guard-3-8B, Perspective API, ShieldGemma-2B and others13
    Abstract揭示了排版视觉线索与分词差异带来的审核盲区，HPAA 以极低查询实现近乎完全规避。

    这篇论文研究了人类视觉感知与大模型分词处理机制之间的差异所导致的内容审核漏洞。

    Paper analysisRead analysis
  2. AttacksarXiv 2605.21541

    研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果

    提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击

    arXiv
    2605.21541
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
    AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。

    FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。

    Paper analysisRead analysis
  3. AttacksarXiv 2604.01039

    Evaluating and hardening LLM system instructions against encoding attack extraction

    Extract system instructions with encoding and structured requests, and harden them by rewriting with CoT

    arXiv
    2604.01039
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4.1-mini, GPT-3.5-turbo, Gemini-2.5-flash and others7
    AbstractEncoded requests can elicit system instructions after a direct refusal.

    This work evaluates and hardens the confidentiality of LLM system instructions under encoded extraction. The authors are concerned with: when direct extraction has been rejected, whether the model still surrenders protected content when the same request is rewritten as a formatting or encoding task.

    Paper analysisRead analysis
  4. AttacksarXiv 2509.09112

    研究：字符级扰动可破坏 LLM 水印，并提出基于遗传算法的去除攻击

    提出字符级扰动与遗传算法去除 LLM 水印

    arXiv
    2509.09112
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    OPT-1.3B, LLaMA-3-8B
    Abstract字符级扰动靠更大攻击范围移除水印。

    这篇工作评估推理时 LLM 水印在黑盒、有限查询下的移除难度，并比较字符级、token 级和句子级编辑。

    Paper analysisRead analysis
You have reached the end