Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 305papers have no tags yet and are not included in filtered results.

Attack type：Detection evasion Attack surface / entry point：User input Clear all

Another 305papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.02853Oct 2
研究提出基于收缩约束状态空间模型的有界可达性与越狱检测方法
提出收缩约束 SSM 安全头，认证嵌入扰动并检测越狱
arXiv
2610.02853
Published
Oct 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
ToySSMClassifier, S4 safety head
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Abstract收缩给出玩具 LTI 的有界认证。
给 SSM 安全头一个收缩条件，并在越狱检测上使用收缩正则的 S4 头。。
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.00883Oct 1
DeBERTa-ConPara：面向部署的 AI 生成文本检测，推理端 Unicode 归一化提升对抗鲁棒性
提出推理时 Unicode 归一化的检测器，识别遭字符级扰动的 AI 生成文本
arXiv
2610.00883
Published
Oct 1
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
microsoft/deberta-v3-large, deberta-v3-base, bert-large-cased and others4
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract推理时归一化消除两类 Unicode 攻击，训练时归一化则会删掉对抗监督。
DeBERTa-ConPara 是一个面向部署的 AI 文本检测器：DeBERTa-v3-large 在多数据集原始文本上训练，推理前做确定性 Unicode 归一化，用一个固定阈值面对没有目标域标签的场景。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.00417Sep 30
研究：合成数据溯源识别在改写后准确率大幅下降
检验合成数据来源识别是否等于再训练适配筛选
arXiv
2610.00417
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B-Instruct, DistilRoBERTa, word TF-IDF logistic regression and others5
- DefensesWatermarking and provenance
- AttacksDetection evasion
Abstract来源识别在原文上准确，改写后精确归因下降。
作者在金融风险文本上把来源识别和训练样本是否有用拆成两次测量，并写明这不是电信部署实验。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.33898Sep 28
研究揭示训练效率与模型脆弱性的权衡：高效训练更易受对抗与隐私攻击
比较高效与高成本训练的对抗和隐私脆弱性并分析损失几何
arXiv
2609.33898
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18, Swin Transformer, Qwen2.5-Math-7B-Instruct and others7
- AttacksExtraction and theft
Abstract效用匹配下，三种高效训练都伴随更高的隐私与对抗脆弱性及更尖的损失几何。
作者在视觉分类和数学推理语言模型上，检查用更少数据或更简对齐换取训练效率时，安全性质是否一起变化。比较在任务效用接近的前提下进行。视觉侧用 KNN-Shapley 的高重要性小子集对照低重要性大子集，并用预训练微调对照从头训练。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.29130Sep 24
ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断
提出 ClaimMirage，以域名自述声称改变 LLM 威胁告警判断
arXiv
2609.29130
Published
Sep 24
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.3 70B Instruct-Turbo, Gemma 3 4B it, Gemma 3 12B it and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract作者称自述声称可增减告警。
Paper analysisRead analysis
InterpretabilityarXiv 2609.24801Sep 22
研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
arXiv
2609.24801
Published
Sep 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Prompt Guard 2 (86M), Llama 3.1 8B
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentGuardrails and judges
Abstract作者称检测靠分散的词法线索。
Paper analysisRead analysis
AttacksarXiv 2609.15989Sep 15
研究者提出 plan injection 攻击，可绕过思维链监控
提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器
arXiv
2609.15989
Published
Sep 15
Layer
Prompt layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
Qwen2.5-Coder-7B-Instruct, Qwen3-8B, DeepSeek-R1-0528 and others6
- AttacksDetection evasion
- TechniqueReasoning-chain manipulation
- ComponentMonitors
Abstract论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。
Paper analysisRead analysis
AttacksarXiv 2609.08236Sep 8
研究：内容不变的风格包装可翻转 LLM 安全评判器的判定
提出内容不变样式包装，翻转安全评审器的判定
arXiv
2609.08236
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o-mini (gpt4o), GPT-4o-mini (strongreject), DeepSeek-Chat and others7
- AttacksDetection evasion
- TechniqueRole-play and persuasion
- ComponentGuardrails and judges
Abstract论文揭示特定安全评审器易受保持内容不变的外层包装诱导改变判定，并指出安全评估应将判定稳定性作为重要考量指标。
这是一项关于大语言模型自动化安全评审系统表面样式脆弱性的评估研究。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
DefensesarXiv 2608.12361Jul 5
基于搜索增强 LLM 的中文新词毒性共识检测框架 SeTox
提出 SeTox 检索增强框架，检测中文新词的隐性毒性
arXiv
2608.12361
Published
Jul 5
Layer
Application layer
Setting
LLM applications
Evaluated models
SeTox-Qwen2.5-7B
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractSeTox 用检索把公共共识接入静态 LLM，以检测中文毒性新词。
SeTox 研究中文新词上的隐性毒性检测：词表加检索增强，使静态 LLM 在不重训练的情况下利用公开网页上下文。
Paper analysisRead analysis
AttacksarXiv 2606.09700Jun 9
研究者提出 HPAA 攻击：用排版视觉线索绕过 13 个内容审核系统
提出 HPAA 攻击，用排版视觉线索绕过内容审核系统
arXiv
2606.09700
Published
Jun 9
Layer
Prompt layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Llama-Guard-3-8B, Perspective API, ShieldGemma-2B and others13
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract揭示了排版视觉线索与分词差异带来的审核盲区，HPAA 以极低查询实现近乎完全规避。
这篇论文研究了人类视觉感知与大模型分词处理机制之间的差异所导致的内容审核漏洞。
Paper analysisRead analysis
AttacksarXiv 2605.26156May 24
BITE：用上下文赌博机操纵风格偏置攻击 LLM 评委
提出 BITE，用上下文赌博机选择风格修改抬高 LLM 评委打分
arXiv
2605.26156
Published
May 24
Layer
Prompt layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
o3-mini, Gemini-2.5-Flash, Llama-3.3-70B-Instruct and others8
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
AbstractBITE 用黑盒赌博机利用风格偏差抬分，作者称这对 LLM-as-a-judge 构成威胁。
BITE 是黑盒风格操纵：在保持答案语义的同时，抬高 LLM 评审给出的分数。
Paper analysisRead analysis
AttacksarXiv 2605.22258May 21
CITA：面向中文隐式毒性的攻击与防御数据生成框架
提出 CITA 三阶段框架，生成可绕过毒性检测器的中文隐式毒性文本
arXiv
2605.22258
Published
May 21
Layer
Application layer
Setting
LLM applications
Evaluated models
Tencent, Baidu, Gemini 3.1 Pro and others11
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2605.07481May 8
Vaporizer：研究者用改写类攻击破解大语言模型输出水印方案
提出 Vaporizer，用词法变换、翻译和释义破解 LLM 输出水印
arXiv
2605.07481
Published
May 8
Layer
Prompt layer
Setting
Models and APIs
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2604.10893Apr 13
研究者提出 Adaptive Stealing 自适应窃取水印攻击方法
提出 Adaptive Stealing，自适应窃取印章以擦除或伪造水印
arXiv
2604.10893
Published
Apr 13
Layer
Model layer
Setting
Models and APIs
Evaluated models
OPT-2.7b, Llama3-8b
- AttacksDetection evasion
AbstractAS 用逐步选印章做水印伪造与擦除，作者称其攻击效果高于固定策略的 WS。
AS 是一种窃取生成式 LLM 水印的算法，用来在密钥和检测接口不可用时伪造或擦除水印。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop