Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack type：Extraction and theft Attack type：Detection evasion Attack technique：Gradient and representation optimization Attack technique：Encoding and obfuscation System type：Models and APIs Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2610.03166Oct 2
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
arXiv
2610.03166
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
Paper analysisRead analysis
InterpretabilityarXiv 2609.24801Sep 22
研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
arXiv
2609.24801
Published
Sep 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Prompt Guard 2 (86M), Llama 3.1 8B
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentGuardrails and judges
Abstract作者称检测靠分散的词法线索。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.19855Jul 22
研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测
提出最小范数攻击集成，用鲁棒性曲线评测图像分类器
arXiv
2607.19855
Published
Jul 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C1–C20（CIFAR-10，Table 1）, I1–I10（ImageNet，Table 1）
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Abstract预算可控的最小范数集成用 AOI 逼近攻击前沿，DOI 给出不依赖单一ε的防御排序。
这篇工作把对抗鲁棒评测从单一 ε、固定集成，改成可按查询预算收紧的曲线估计。
Paper analysisRead analysis
AttacksarXiv 2605.21541May 20
研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
arXiv
2605.21541
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。
FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
Paper analysisRead analysis
AttacksarXiv 2605.07481May 8
Vaporizer：研究者用改写类攻击破解大语言模型输出水印方案
提出 Vaporizer，用词法变换、翻译和释义破解 LLM 输出水印
arXiv
2605.07481
Published
May 8
Layer
Prompt layer
Setting
Models and APIs
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2604.03117Apr 3
Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models
Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.
arXiv
2604.03117
Published
Apr 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.
UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.
Paper analysisRead analysis
AttacksarXiv 2604.01039Apr 1
Evaluating and hardening LLM system instructions against encoding attack extraction
Extract system instructions with encoding and structured requests, and harden them by rewriting with CoT
arXiv
2604.01039
Published
Apr 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4.1-mini, GPT-3.5-turbo, Gemini-2.5-flash and others7
- AttacksExtraction and theft
- TechniqueEncoding and obfuscation
AbstractEncoded requests can elicit system instructions after a direct refusal.
This work evaluates and hardens the confidentiality of LLM system instructions under encoded extraction. The authors are concerned with: when direct extraction has been rejected, whether the model still surrenders protected content when the same request is rewritten as a formatting or encoding task.
Paper analysisRead analysis
AttacksarXiv 2602.09431Feb 10
Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models
Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models
arXiv
2602.09431
Published
Feb 10
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
LLaVA, Qwen2.5-VL, InternVL3 and others10
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractGDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.
GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.
Paper analysisRead analysis
AttacksarXiv 2601.21531Jan 29
Adversarial robustness of large vision-language models under visual token compression
提出 CAGE 攻击，在视觉 token 压缩下用图像扰动使预测偏离
arXiv
2601.21531
Published
Jan 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
LLaVA, Qwen2.5-VL, InternVL3-8B and others5
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractCAGE 对齐压缩瓶颈后，压缩 LVLM 的稳健准确率低于全 token 编码器攻击。
CAGE 研究的是：LVLM 在推理时剪枝或合并视觉 token 之后，对抗稳健性该怎么估。
Paper analysisRead analysis
AttacksarXiv 2601.01296Jan 4
Aggressive compression enables LLM weight stealing
提出面向渗出的权重压缩，评估推理服务器权重窃取可行性
arXiv
2601.01296
Published
Jan 4
Layer
Infrastructure layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-1.5B, Qwen2-7B, Qwen2.5-1.5B and others8
- AttacksExtraction and theft
- TechniqueEncoding and obfuscation
Abstract作者用残差量化加微调压缩权重，并称法医水印便宜且微调后仍可解码。
这篇工作把 LLM 权重渗出看成 APT：攻击者已有未加密权重，但必须把完整权重藏进推理 API 的合法输出。作者认为可压缩性是被忽略的因素，因为推理量化要求解压后仍能低开销前向，而偷权重的人可以接受事后微调。
Paper analysisRead analysis
AttacksarXiv 2509.09112Sep 11, 2025
研究：字符级扰动可破坏 LLM 水印，并提出基于遗传算法的去除攻击
提出字符级扰动与遗传算法去除 LLM 水印
arXiv
2509.09112
Published
Sep 11, 2025
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
OPT-1.3B, LLaMA-3-8B
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
Abstract字符级扰动靠更大攻击范围移除水印。
这篇工作评估推理时 LLM 水印在黑盒、有限查询下的移除难度，并比较字符级、token 级和句子级编辑。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop