Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 5 papers
Filter4

Attack type

Jailbreaks13Prompt injection140Poisoning and backdoors26Detection evasion5Malicious use3

Impact

Unauthorized actions3

System type

AI Agent4

Attack surface / entry point

User input9Web pages and interfaces2Documents and messages5Tool responses4Tool and skill descriptions4Distribution channels3

Layer

Application layer5
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
Attack type：Detection evasionAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Tool responsesLayer：Application layerClear all

Another 254papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12292

    The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

    Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations

    arXiv
    2610.12292
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    LAYA-TD, LAYA-EN, LAYA-ML and others5

    AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.09793

    用时序逻辑监控工具 Agent

    提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链

    arXiv
    2610.09793
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    Black-box
    Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。

    这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。

    Paper analysisRead analysis
  3. DefensesarXiv 2610.08668

    SBW：面向 LLM 智能体的语义行为水印方法

    提出 SBW，为 LLM Agent 轨迹做抗改写与伪造的语义行为水印

    arXiv
    2610.08668
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen2.5-3B-Instruct, LLaMA-3.2-3B, Qwen2.5-7B and others5
    AbstractSBW 在语义簇上做溯源水印，改写检测高于精确符号，链式重放仍开放。

    SBW 是免训练的智能体行为水印，把所有者标识放在离散动作选择上，而不是输出 token。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  5. DefensesarXiv 2607.13716

    CAVA：面向智能体 AI 运行时治理的规范动作验证与证明

    提出 CAVA，将异构智能体运行时事件规范为可哈希动作并绑定审批与回执

    arXiv
    2607.13716
    Published
    Layer
    Application layer
    Setting
    AI Agent
    AbstractCAVA 用规范动作指纹承接异构运行时治理。

    CAVA 是给异构智能体运行时用的动作语义层，用来回答“被批准和被审计的到底是哪一个动作”。

    Paper analysisRead analysis
You have reached the end