Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers

Filter4

Attack type

Jailbreaks5 Prompt injection47 Poisoning and backdoors15 Extraction and theft7 Detection evasion2

Impact

Data and privacy leaks6

System type

Models and APIs3 LLM applications3 AI Agent3

Attacker access

Black-box3

Attack surface / entry point

Retrieval corpus3

Layer

Model layer3 Application layer6

System component

MCP and skills7 RAG10 Guardrails and judges24 Monitors5 Reasoning chains9 Permissions and sandboxing3 Fine-tuning and open weights7 Vision13 Audio5 Video3 Image generation11 Embeddings6 Multimodal30

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack type：Extraction and theft Attack type：Detection evasion System component：Permissions and sandboxing System component：Embeddings Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2609.06749Sep 7
PMA 攻击：针对隐私保护 LLM 中嵌入到嵌入混淆的语义流形对齐方法
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
arXiv
2609.06749
Published
Sep 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
BERT-base, RoBERTa-base, T5-base and others6
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
DefensesarXiv 2609.04767Sep 4
SHAQ: Privacy-preserving retrieval in vector databases using shadow queries
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
arXiv
2609.04767
Published
Sep 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
GTR-T5 encoder, DPR
- AttacksExtraction and theft
- ComponentEmbeddings
AbstractSHAQ replaces document embeddings with shadow query embeddings.
SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
Paper analysisRead analysis
DefensesarXiv 2609.01677Sep 1
Skill-as-API：面向智能体软件工程的机密多智能体协作协议
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
arXiv
2609.01677
Published
Sep 1
Layer
Application layer
Setting
Multi-agent systems, coding agent
- DefensesInstruction–data separation
- AttacksExtraction and theft
- ComponentMCP and skills
Abstract协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。
Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
Paper analysisRead analysis
DefensesarXiv 2607.14737Jul 16
GeoDetect：面向视觉语言预训练模型的几何对抗检测方法
提出 GeoDetect 以几何分数检测视觉语言预训练模型的对抗样本
arXiv
2607.14737
Published
Jul 16
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
CLIPViT (ViT-B/16), CLIPCNN (ResNet-50), ALBEF and others4
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentEmbeddings
AbstractGeoDetect 用几何分数检测 VLP 对抗样本。
GeoDetect 是面向视觉-语言预训练模型的对抗样本检测方法，用嵌入几何而不是任务 logits 区分干净样本与对抗样本。
Paper analysisRead analysis
DefensesarXiv 2607.13716Jul 15
CAVA：面向智能体 AI 运行时治理的规范动作验证与证明
提出 CAVA，将异构智能体运行时事件规范为可哈希动作并绑定审批与回执
arXiv
2607.13716
Published
Jul 15
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- AttacksDetection evasion
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
AbstractCAVA 用规范动作指纹承接异构运行时治理。
CAVA 是给异构智能体运行时用的动作语义层，用来回答“被批准和被审计的到底是哪一个动作”。
Paper analysisRead analysis
AttacksarXiv 2607.01276Jul 1
研究者提出嵌入推断攻击 EIA，可在黑盒 IR 系统中识别所用嵌入模型
提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
arXiv
2607.01276
Published
Jul 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
e5-small, e5-small-v2, e5-base and others19
- AttacksExtraction and theft
- ComponentEmbeddings
AbstractEIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。
EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。。
Paper analysisRead analysis
AttacksarXiv 2602.07379Feb 7
Aegis: Governance, Integrity, and Security for AI Voice Agents
提出 Aegis 红队框架，多轮攻击高风险语音 Agent
arXiv
2602.07379
Published
Feb 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, GPT-4o-mini, Gemini-1.5 Pro and others7
- AttacksDenial of service
- TechniqueMulti-turn escalation
- ComponentAudio
AbstractAegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.
Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.
Paper analysisRead analysis
AttacksarXiv 2602.01757Feb 2
Zero2Text: Training-Free Cross-Domain Text Embedding Inversion Attack
提出 Zero2Text，无需训练地跨域反演文本嵌入
arXiv
2602.01757
Published
Feb 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GTR-Base, Qwen3-Embedding-0.6B, Text-Embedding-3-small and others4
- AttacksExtraction and theft
- TechniqueAutomated search
- ComponentEmbeddings
Abstract零训练在线对齐可在未知域、无泄漏对时从黑盒 embedding 还原句子。
Zero2Text 是一种不训练 decoder、也不使用泄漏文本–向量对的文本 embedding 反演，针对 RAG 向量库在严格黑盒、目标域未知时的还原。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop