Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Attack type：Detection evasion Attack surface / entry point：User input Attack surface / entry point：Training data Layer：Model layer Layer：Application layer Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.29130Sep 24
ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断
提出 ClaimMirage，以域名自述声称改变 LLM 威胁告警判断
arXiv
2609.29130
Published
Sep 24
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.3 70B Instruct-Turbo, Gemma 3 4B it, Gemma 3 12B it and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract作者称自述声称可增减告警。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
DefensesarXiv 2608.12361Jul 5
基于搜索增强 LLM 的中文新词毒性共识检测框架 SeTox
提出 SeTox 检索增强框架，检测中文新词的隐性毒性
arXiv
2608.12361
Published
Jul 5
Layer
Application layer
Setting
LLM applications
Evaluated models
SeTox-Qwen2.5-7B
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractSeTox 用检索把公共共识接入静态 LLM，以检测中文毒性新词。
SeTox 研究中文新词上的隐性毒性检测：词表加检索增强，使静态 LLM 在不重训练的情况下利用公开网页上下文。
Paper analysisRead analysis
AttacksarXiv 2605.22258May 21
CITA：面向中文隐式毒性的攻击与防御数据生成框架
提出 CITA 三阶段框架，生成可绕过毒性检测器的中文隐式毒性文本
arXiv
2605.22258
Published
May 21
Layer
Application layer
Setting
LLM applications
Evaluated models
Tencent, Baidu, Gemini 3.1 Pro and others11
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2604.10893Apr 13
研究者提出 Adaptive Stealing 自适应窃取水印攻击方法
提出 Adaptive Stealing，自适应窃取印章以擦除或伪造水印
arXiv
2604.10893
Published
Apr 13
Layer
Model layer
Setting
Models and APIs
Evaluated models
OPT-2.7b, Llama3-8b
- AttacksDetection evasion
AbstractAS 用逐步选印章做水印伪造与擦除，作者称其攻击效果高于固定策略的 WS。
AS 是一种窃取生成式 LLM 水印的算法，用来在密钥和检测接口不可用时伪造或擦除水印。
Paper analysisRead analysis
AttacksarXiv 2602.13576Feb 14
Rubrics as an attack surface: covert preference drift in LLM judges
提出改评分标准的搜索攻击，使 LLM 评判者在基准达标下发生偏好漂移
arXiv
2602.13576
Published
Feb 14
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Qwen3-14B, Gemma-3-27B-it, DeepSeek-V3 and others8
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
AbstractRIPD 指 benchmark 合规的 rubric 修改仍可使 judge 偏好在 target 域定向漂移，并经 DPO 传入策略。
作者把自然语言 rubric 视为 LLM judge 的可编辑控制接口，并称只靠 benchmark 验证不足以稳住 target 域偏好。
Paper analysisRead analysis
AttacksarXiv 2602.00979Feb 1
GradingAttack: Revealing Security Vulnerabilities in LLM-Based Educational Grading Agents
提出 GradingAttack，用梯度后缀与角色扮演操纵教育评分智能体判定
arXiv
2602.00979
Published
Feb 1
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen2.5-7B, Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct and others8
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2602.02569Jan 31
DECEIVE-AFC：针对检索式 LLM 事实核查系统的对抗性主张攻击
提出 DECEIVE-AFC，以声明改写诱导搜索增强事实核查误判
arXiv
2602.02569
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
HiSS, LEMMA, DEFAME and others4
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2510.10987Oct 13, 2025
DITTO：通过知识蒸馏伪造水印 LLM 的作者归属
提出 DITTO 框架，蒸馏提取水印信号并注入外部模型以伪造归属
arXiv
2510.10987
Published
Oct 13, 2025
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.1-8B, Llama3.2-3B, GPT-OSS 20B and others4
- AttacksDetection evasion
Abstract论文针对大模型水印归属假设的脆弱性，提出黑盒仿冒攻击 DITTO，实现跨架构和采样方案的高检测率与低困惑度仿冒。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop