Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Attack type：Detection evasion Attack type：Malicious use Layer：Application layer Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.09793Oct 7
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
arXiv
2610.09793
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
DefensesarXiv 2610.08668Oct 7
SBW：面向 LLM 智能体的语义行为水印方法
提出 SBW，为 LLM Agent 轨迹做抗改写与伪造的语义行为水印
arXiv
2610.08668
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-3B-Instruct, LLaMA-3.2-3B, Qwen2.5-7B and others5
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractSBW 在语义簇上做溯源水印，改写检测高于精确符号，链式重放仍开放。
SBW 是免训练的智能体行为水印，把所有者标识放在离散动作选择上，而不是输出 token。
Paper analysisRead analysis
DefensesarXiv 2610.05870Oct 5
MBZUAI 提出可校准的真实图像认证方法
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
arXiv
2610.05870
Published
Oct 5
Layer
Application layer
Setting
LLM applications
Attacker
White-box
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentImage generation
Abstract论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05586Oct 5
AgentDoxx：联网搜索 Agent 对匿名访谈文本的再识别评测
构建 AGENTDOXX 基准，评测联网搜索 Agent 对匿名访谈的再识别
arXiv
2610.05586
Published
Oct 5
Layer
Application layer
Setting
web agent
Evaluated models
GPT-5.6 Terra, GPT-5 Mini, GPT-4.1 Mini and others10
- AttacksMalicious use
- ComponentRAG
Abstract论文提出了已知身份的重识别基准 AGENTDOXX，揭示搜索与记忆双重风险及现有防御在检索轨迹中的泄露漏洞。
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.02869Oct 2
AgentTrap：面向自主渗透测试 Agent 的有状态反馈欺骗蜜罐
提出 AgentTrap 有状态蜜罐，欺骗并反击自主渗透测试 Agent
arXiv
2610.02869
Published
Oct 2
Layer
Application layer
Setting
coding agent
Evaluated models
AIDA, Claude Code, PentestGPT and others8
- AttacksMalicious use
Paper analysisRead analysis
AttacksarXiv 2610.01768Oct 1
LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄
提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传
arXiv
2610.01768
Published
Oct 1
Layer
Application layer
Setting
coding agent
Evaluated models
Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
- AttacksMalicious use
Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。
LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。
Paper analysisRead analysis
AttacksarXiv 2609.39607Sep 30
Pretext 攻击绕过 NVIDIA SkillSpector 等 Agent 技能扫描器
提出 PRETEXT 攻击，迭代改写技能文本绕过技能扫描器并让 Agent 执行木马
arXiv
2609.39607
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
glm (z-ai/glm-5.1), qwen3t (qwen/qwen3-235b-a22b-thinking-2507), gpt-oss (openai/gpt-oss-120b)
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentMCP and skills
Abstract论文提出了针对多阶段技能检测器的白盒攻击，揭示了单纯依赖大模型自适应检测的局限。
PRETEXT 是一项针对基于“静态规则加语义大模型”的智能体技能安全检测框架的白盒攻击与协同进化评估研究。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33102Sep 27
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
arXiv
2609.33102
Published
Sep 27
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
Risky behaviorarXiv 2609.30266Sep 25
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
arXiv
2609.30266
Published
Sep 25
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
Paper analysisRead analysis
AttacksarXiv 2609.29130Sep 24
ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断
提出 ClaimMirage，以域名自述声称改变 LLM 威胁告警判断
arXiv
2609.29130
Published
Sep 24
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.3 70B Instruct-Turbo, Gemma 3 4B it, Gemma 3 12B it and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract作者称自述声称可增减告警。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
研究者用控制 token 注入删除 gpt-oss-20b 推理链并绕过思维链监控
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
DefensesarXiv 2609.22724Sep 19
MATE：面向移动 Agent 的策略感知安全审计方法
提出移动 Agent 轨迹审计器 MATE，判断轨迹是否违反可编辑安全策略
arXiv
2609.22724
Published
Sep 19
Layer
Application layer
Setting
Browser and computer use
Attacker
Black-box
Evaluated models
MATE-0.5B, MATE-1.5B, MATE-3B
- DefensesMonitoring and auditing
- AttacksMalicious use
- RiskDangerous agent actions
- ComponentMonitors
AbstractMATE 用合成轨迹微调轻量审计器，在可编辑策略下判断移动智能体轨迹是否违规并给出解释。
MATE 是面向移动 GUI 智能体的轻量策略条件轨迹审计器，在给定自然语言安全策略时判断轨迹是否违规并解释原因。
Paper analysisRead analysis
AttacksarXiv 2609.19722Sep 17
ALIBI：向二进制注入虚假安全叙事可让 LLM 恶意软件分析器误判
提出 ALIBI，向恶意二进制注入不执行掩护叙事使分析器误判为良性
arXiv
2609.19722
Published
Sep 17
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Gemini 2.5 Pro, GPT-5.5 Pro, Claude Opus 4.7
- AttacksDetection evasion
- TechniqueRole-play and persuasion
AbstractALIBI 用二进制内的掩护叙事重释可疑静态证据，Gemini 上翻转多，另两模型主要为降级。
ALIBI 是针对 LLM 恶意软件分诊的语义掩护叙事攻击：不覆盖系统指令，而把仍可见的可疑静态证据重释成良性安全产品的预期行为。
Paper analysisRead analysis
AttacksarXiv 2609.12448Sep 11
GraphProfiler 用个人知识图谱推断敏感属性并溯源到具体帖子
提出 GraphProfiler，用个人知识图谱从帖子历史推断敏感属性并溯源
arXiv
2609.12448
Published
Sep 11
Layer
Application layer
Setting
LLM applications
- AttacksMalicious use
- ComponentRAG
AbstractGraphProfiler 用源链接个人知识图谱做属性推断，准确率接近文本基线，并把证据定位到少量源帖。
GraphProfiler 是一个可审计的 LLM 敏感属性画像器：用源链接个人知识图谱，把推断落到具体帖子。
Paper analysisRead analysis
DefensesarXiv 2609.08394Sep 8
Windows 恶意软件检测器作为复合 AI 系统：准确率、效率与对抗鲁棒性的权衡
提出 OBELISK 三级流水线，权衡恶意软件检测的准确率、开销与鲁棒性
arXiv
2609.08394
Published
Sep 8
Layer
Application layer
Setting
LLM applications
Attacker
White-box, Black-box
Evaluated models
GBDT-ALL, GBDT-YARA, NEBULA-ALL and others4
- DefensesDetection and filtering
- AttacksDetection evasion
Abstract三级过滤以不大的检测损失换速度，同一机制扩大攻击面，部署应按约束选配置。
OBELISK 把 Windows PE 恶意软件检测做成 YARA、EMBER-GBDT 与 Nebula 的顺序流水线，用来同时看检出、计算开销和对抗鲁棒性。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop