Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 12 papers

Filter5

Attack type

Prompt injection11 Poisoning and backdoors22 Extraction and theft7 Detection evasion3 Malicious use2

Impact

Data and privacy leaks9

System type

LLM applications10

Attacker access

Black-box6

Attack surface / entry point

User input9

Layer

Application layer12

System component

MCP and skills8 RAG12 Guardrails and judges14 Monitors8 Permissions and sandboxing4 Vision3 Embeddings3 Multimodal6

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack type：Extraction and theft Attack type：Detection evasion Attack type：Malicious use Layer：Application layer System component：RAG Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05586Oct 5
AgentDoxx：联网搜索 Agent 对匿名访谈文本的再识别评测
构建 AGENTDOXX 基准，评测联网搜索 Agent 对匿名访谈的再识别
arXiv
2610.05586
Published
Oct 5
Layer
Application layer
Setting
web agent
Evaluated models
GPT-5.6 Terra, GPT-5 Mini, GPT-4.1 Mini and others10
- AttacksMalicious use
- ComponentRAG
Abstract论文提出了已知身份的重识别基准 AGENTDOXX，揭示搜索与记忆双重风险及现有防御在检索轨迹中的泄露漏洞。
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.14649Sep 14
CIG-MIA：利用上下文信息增益对 RAG 系统发起成员推断攻击
提出 CIG-MIA，用上下文信息增益推断 RAG 知识库成员身份
arXiv
2609.14649
Published
Sep 14
Layer
Application layer
Setting
LLM applications
Attacker
Gray-box, Black-box
Evaluated models
Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3, Llama-2-13b-chat-hf and others6
- AttacksExtraction and theft
- ComponentRAG
AbstractCIG-MIA 用注入前后的答案似然差推断 RAG 库成员，灰盒可分性高于所列基线。
CIG-MIA 是针对 RAG 外部知识库的成员推断攻击，同时覆盖灰盒和纯文本黑盒。
Paper analysisRead analysis
AttacksarXiv 2609.12448Sep 11
GraphProfiler 用个人知识图谱推断敏感属性并溯源到具体帖子
提出 GraphProfiler，用个人知识图谱从帖子历史推断敏感属性并溯源
arXiv
2609.12448
Published
Sep 11
Layer
Application layer
Setting
LLM applications
- AttacksMalicious use
- ComponentRAG
AbstractGraphProfiler 用源链接个人知识图谱做属性推断，准确率接近文本基线，并把证据定位到少量源帖。
GraphProfiler 是一个可审计的 LLM 敏感属性画像器：用源链接个人知识图谱，把推断落到具体帖子。
Paper analysisRead analysis
DefensesarXiv 2609.04767Sep 4
SHAQ: Privacy-preserving retrieval in vector databases using shadow queries
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
arXiv
2609.04767
Published
Sep 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
GTR-T5 encoder, DPR
- AttacksExtraction and theft
- ComponentEmbeddings
AbstractSHAQ replaces document embeddings with shadow query embeddings.
SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
Paper analysisRead analysis
DefensesarXiv 2608.17829Aug 18
LeakGauge：用行为探针在解码前检测上下文泄露攻击信号
提出 LeakGauge，用行为后缀的 prefill 对数概率检测上下文泄露
arXiv
2608.17829
Published
Aug 18
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Gemma-4-E4B-it, Gemma-4-31B-it, Qwen2.5-14B-Instruct and others11
- DefensesDetection and filtering
- AttacksExtraction and theft
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2608.12361Jul 5
基于搜索增强 LLM 的中文新词毒性共识检测框架 SeTox
提出 SeTox 检索增强框架，检测中文新词的隐性毒性
arXiv
2608.12361
Published
Jul 5
Layer
Application layer
Setting
LLM applications
Evaluated models
SeTox-Qwen2.5-7B
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractSeTox 用检索把公共共识接入静态 LLM，以检测中文毒性新词。
SeTox 研究中文新词上的隐性毒性检测：词表加检索增强，使静态 LLM 在不重训练的情况下利用公开网页上下文。
Paper analysisRead analysis
AttacksarXiv 2605.24312May 23
MEntA 用 5 次查询实现 RAG 成员推断攻击
提出 MEntA，用非模板查询推断文档是否属于 RAG 检索库
arXiv
2605.24312
Published
May 23
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Phi4-14B, Llama3.1-8B, CommandR-7B and others5
- AttacksExtraction and theft
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2605.19847May 19
论文揭示多租户 RAG 账号合谋使隐私泄露随账号数线性增长
提出零知识审计协议，核验多租户 RAG 的合谋差分隐私
arXiv
2605.19847
Published
May 19
Layer
Application layer
Setting
LLM applications
- AttacksExtraction and theft
- ComponentRAG
Abstract揭示多租户 RAG 合谋泄露按根号 k 放大，提出带零知识证明的无泄露审计协议。
论文针对多租户 RAG 服务在多账户协同攻击下隐私边界失效的问题展开研究。
Paper analysisRead analysis
AttacksarXiv 2602.02569Jan 31
DECEIVE-AFC：针对检索式 LLM 事实核查系统的对抗性主张攻击
提出 DECEIVE-AFC，以声明改写诱导搜索增强事实核查误判
arXiv
2602.02569
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
HiSS, LEMMA, DEFAME and others4
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentRAG
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop