Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 5 papers

Filter5

Attack type

Jailbreaks15 Prompt injection102 Poisoning and backdoors22 Detection evasion5

System type

AI Agent4

Attack surface / entry point

User input11 Web pages and interfaces3 Documents and messages5 Tool responses4 Tool and skill descriptions4 Training data0 Weights and gradients1 Distribution channels3

Layer

Model layer4 Application layer5 Training and data layer3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

Attack type：Detection evasion Attack surface / entry point：Tool responses Attack surface / entry point：Training data Attack surface / entry point：Weights and gradients Layer：Application layer Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
DefensesarXiv 2610.09793Oct 7
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
arXiv
2610.09793
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
Paper analysisRead analysis
DefensesarXiv 2610.08668Oct 7
SBW：面向 LLM 智能体的语义行为水印方法
提出 SBW，为 LLM Agent 轨迹做抗改写与伪造的语义行为水印
arXiv
2610.08668
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-3B-Instruct, LLaMA-3.2-3B, Qwen2.5-7B and others5
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractSBW 在语义簇上做溯源水印，改写检测高于精确符号，链式重放仍开放。
SBW 是免训练的智能体行为水印，把所有者标识放在离散动作选择上，而不是输出 token。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

System type

Attack surface / entry point

Layer

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

用时序逻辑监控工具 Agent

SBW：面向 LLM 智能体的语义行为水印方法

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring