Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 44 papers

Filter3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.

Attack type：Detection evasion Layer：Model layer Layer：Application layer Clear all

Another 261papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
DefensesarXiv 2610.11848Oct 8
SemField: training-free semantic watermark
Proposes the semantic watermark SemField, which still identifies the attribution of generated text after paraphrasing and structural changes.
arXiv
2610.11848
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.2-1B, Qwen3-1.7B, OPT-1.3B
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractTraining-independent document-level semantic watermark.
SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.09793Oct 7
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
arXiv
2610.09793
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
DefensesarXiv 2610.08668Oct 7
SBW：面向 LLM 智能体的语义行为水印方法
提出 SBW，为 LLM Agent 轨迹做抗改写与伪造的语义行为水印
arXiv
2610.08668
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-3B-Instruct, LLaMA-3.2-3B, Qwen2.5-7B and others5
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractSBW 在语义簇上做溯源水印，改写检测高于精确符号，链式重放仍开放。
SBW 是免训练的智能体行为水印，把所有者标识放在离散动作选择上，而不是输出 token。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06339Oct 5
BabelFake：面向多语言音视频 DeepFake 检测的基准数据集
构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
arXiv
2610.06339
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SpeechForensics, AVH-Align, (B)RAVEn
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentAudio
AbstractBabelFake 为五语同意采集基准。
BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
Paper analysisRead analysis
DefensesarXiv 2610.05870Oct 5
MBZUAI 提出可校准的真实图像认证方法
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
arXiv
2610.05870
Published
Oct 5
Layer
Application layer
Setting
LLM applications
Attacker
White-box
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentImage generation
Abstract论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
Paper analysisRead analysis
DefensesarXiv 2610.04763Oct 4
UT Austin 将 SynthID 水印嵌入基因组语言模型，凭 DNA 序列和密钥追溯 AI 生成片段
把 SynthID 嵌入基因组语言模型采样，并用位置无关检测追溯生成序列
arXiv
2610.04763
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
Carbon-500M, GENERator-v2-eukaryote-1.2b-base
- DefensesWatermarking and provenance
- AttacksDetection evasion
Abstract两个六碱基基因组模型嵌入 SynthID 后，位置无关验证能找回水印，作者称这只是统计检测。
作者在两个六碱基基因组模型的采样里嵌入 SynthID，并让验证者在不知道起点、链和 token phase 时做一次校正后的检出。
Paper analysisRead analysis
DefensesarXiv 2610.04235Oct 3
Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架
提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
arXiv
2610.04235
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-TTS (0.6B), Dots.tts (2B)
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2610.03166Oct 2
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
arXiv
2610.03166
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
Paper analysisRead analysis
DefensesarXiv 2610.02817Oct 2
RMCW：基于 Reed-Muller 码的抗删除 LLM 水印方法
提出抗删除水印 RMCW，在生成时注入 Reed-Muller 结构并做局部检验
arXiv
2610.02817
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
OPT-1.3B, Llama-3.1-8B-Instruct
- DefensesWatermarking and provenance
- AttacksDetection evasion
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2610.03124Oct 2
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
arXiv
2610.03124
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
Paper analysisRead analysis
DefensesarXiv 2610.00780Oct 1
TAILOR：面向图像水印的组合方案定制框架
提出 TAILOR，按请求组合图像水印以满足抗攻击与画质延迟规格
arXiv
2610.00780
Published
Oct 1
Layer
Model layer
Setting
Models and APIs
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2609.39607Sep 30
Pretext 攻击绕过 NVIDIA SkillSpector 等 Agent 技能扫描器
提出 PRETEXT 攻击，迭代改写技能文本绕过技能扫描器并让 Agent 执行木马
arXiv
2609.39607
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
glm (z-ai/glm-5.1), qwen3t (qwen/qwen3-235b-a22b-thinking-2507), gpt-oss (openai/gpt-oss-120b)
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentMCP and skills
Abstract论文提出了针对多阶段技能检测器的白盒攻击，揭示了单纯依赖大模型自适应检测的局限。
PRETEXT 是一项针对基于“静态规则加语义大模型”的智能体技能安全检测框架的白盒攻击与协同进化评估研究。
Paper analysisRead analysis
DefensesarXiv 2609.37310Sep 29
AutoMark：让自动研究流程自主发现更优 LLM 水印方案
提出 AutoMark，自动搜索并统计检验 LLM 文本水印
arXiv
2609.37310
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen3.8-27B, GPT-6 Astra and others5
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractAutoMark 的贡献同时包含搜索出的水印，以及用于约束自动研究误报与评测漏洞的验证框架。
AutoMark 是一套自动水印研究框架：先检查生成分布和误报性质，再比较检测、编辑鲁棒性与质量，最后人工分析组件并做留出评测。
Paper analysisRead analysis
DefensesarXiv 2609.36372Sep 29
TTMark：超越单 token 熵的成对无失真水印
提出成对无失真水印 TTMARK，增强低熵下的机器文本检测
arXiv
2609.36372
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama3.2-3B-Instruct, Mistral-v0.3-7B-Instruct, Qwen2.5-7B-Instruct
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractTTMARK 用水印化相邻 token 对利用条件熵，在多种无失真方案上提高检测并保持生成质量。
TTMARK 是一种成对、无失真的文本水印：对相邻 token 的联合分布重加权，而不是逐 token 独立重加权。
Paper analysisRead analysis
DefensesarXiv 2609.34744Sep 28
现代图像后置水印信道的优化与安全：SNW 方案
提出带密钥的 SNW，抵御事后图像水印的身份伪造
arXiv
2609.34744
Published
Sep 28
Layer
Model layer
Setting
Models and APIs
Evaluated models
SNW
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentImage generation
AbstractSNW 用密钥与满秩各向同性投影提高事后水印的 Shannon 容量，并对 PCA 完全安全。
Gesny 与 Giboulot 针对生成内容追溯所依赖的多比特事后图像水印，批评端到端 DNN 方案既无容量理论、又无密钥。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

SemField: training-free semantic watermark

BRANCH 方法绕过 6 套多扫描器护栏系统

用时序逻辑监控工具 Agent

PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

SBW：面向 LLM 智能体的语义行为水印方法

BabelFake：面向多语言音视频 DeepFake 检测的基准数据集

MBZUAI 提出可校准的真实图像认证方法

UT Austin 将 SynthID 水印嵌入基因组语言模型，凭 DNA 序列和密钥追溯 AI 生成片段

Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架

LiBRA：通过双向隐空间优化实现检测感知的图像水印去除

RMCW：基于 Reed-Muller 码的抗删除 LLM 水印方法

论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效

TAILOR：面向图像水印的组合方案定制框架

Pretext 攻击绕过 NVIDIA SkillSpector 等 Agent 技能扫描器

AutoMark：让自动研究流程自主发现更优 LLM 水印方案

TTMark：超越单 token 熵的成对无失真水印

现代图像后置水印信道的优化与安全：SNW 方案

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法