Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 11 papers

Filter4

Attack type

Jailbreaks6 Prompt injection46 Poisoning and backdoors36 Extraction and theft11

Attack technique

Side channels4

Impact

Data and privacy leaks9

System type

Models and APIs7 AI Agent3 Multi-agent systems3

Attack surface / entry point

User input53 Retrieval corpus3 Memory writes1 Inter-agent messages3 Images, audio and video5 Training data7 Weights and gradients10 Inference services and hardware8

Layer

Application layer3 Infrastructure layer7

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.

Attack type：Extraction and theft Attack surface / entry point：Memory writes Attack surface / entry point：Inter-agent messages Attack surface / entry point：Inference services and hardware Clear all

Another 255papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09981Oct 7
研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题
提出利用路由元数据推断敏感话题的侧信道攻击
arXiv
2610.09981
Published
Oct 7
Layer
Infrastructure layer
Setting
LLM applications
Evaluated models
RouteLLM (BERT router), notdiamond-0001, Vela (vLLM Semantic Router)
- AttacksExtraction and theft
- TechniqueSide channels
Abstract论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
Paper analysisRead analysis
AttacksarXiv 2610.06848Oct 6
TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
arXiv
2610.06848
Published
Oct 6
Layer
Infrastructure layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5
- AttacksExtraction and theft
- TechniqueSide channels
AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.02504Oct 2
HXAI：分布式能源系统中的分层隐私保护可解释 AI 框架
提出 HXAI 分层隐私解释框架，本地保留细解释并只发布加噪摘要
arXiv
2610.02504
Published
Oct 2
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
gradient-boosted tree regression models
- AttacksExtraction and theft
AbstractHXAI 把无噪声局部 SHAP 留在家庭内，只聚合差分隐私摘要。
HXAI 是面向分布式能源系统的分层隐私保护解释框架，服务规划、监测与诊断，而不是实时控制。
Paper analysisRead analysis
AttacksarXiv 2609.06749Sep 7
PMA 攻击：针对隐私保护 LLM 中嵌入到嵌入混淆的语义流形对齐方法
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
arXiv
2609.06749
Published
Sep 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
BERT-base, RoBERTa-base, T5-base and others6
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
DefensesarXiv 2609.01677Sep 1
Skill-as-API：面向智能体软件工程的机密多智能体协作协议
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
arXiv
2609.01677
Published
Sep 1
Layer
Application layer
Setting
Multi-agent systems, coding agent
- DefensesInstruction–data separation
- AttacksExtraction and theft
- ComponentMCP and skills
Abstract协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。
Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
Paper analysisRead analysis
DefensesarXiv 2608.25431Aug 26
GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking
Propose GIFT, isolating user data in shared LLM serving using encryption and GPU information flow tracking
arXiv
2608.25431
Published
Aug 26
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen2.5-14B, Qwen2.5-32B, Qwen2.5-72B and others6
- DefensesInstruction–data separation
- AttacksExtraction and theft
AbstractGIFT uses cryptographic isolation plus GPU information flow rules to enforce user data isolation on vLLM and DistServe, and reports throughput overhead.
GIFT is the authors' user data isolation system for shared LLM serving, with GIFT-CC enabling confidential computing. In the conclusion, the authors state it is the first IFT design for this scenario.
Paper analysisRead analysis
AttacksarXiv 2608.17485Aug 18
KeyPooling: Measuring where LLM API relay paths break prompt cache isolation
Proposing KeyPooling to measure where API relays break prompt cache isolation
arXiv
2608.17485
Published
Aug 18
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
grok-4-fast-non-reasoning, grok-4-1-fast-non-reasoning, grok-3 and others11
- AttacksExtraction and theft
- TechniqueSide channels
AbstractShared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.
KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.03272Aug 4
多智能体协同过滤系统的连接性攻击与防御研究
复现 AgentCF 上的多智能体攻防并刻画连通性作用
arXiv
2608.03272
Published
Aug 4
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B, Claude Haiku 4.5, Mixtral 8×7B and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。
作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。
Paper analysisRead analysis
AttacksarXiv 2603.11132Mar 12
WebWeaver: Breaking the topology confidentiality of LLM multi-agent systems via covert context inference
Propose WebWeaver, which compromises only a single agent and recovers the multi-agent communication topology from conversation context.
arXiv
2603.11132
Published
Mar 12
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Llama 3.1 8B, Qwen 2.5 7B, Mistral NeMo 12B and others6
- AttacksExtraction and theft
- TechniqueGradient and representation optimization
AbstractWebWeaver infers topology from context.
WebWeaver is an inference attack against the confidentiality of LLM-MAS communication topology: it controls only one arbitrary agent and recovers the full graph from dialogue context, rather than querying agent IDs.
Paper analysisRead analysis
DefensesarXiv 2603.10726Mar 11
PrefixWall: Mitigating Prefix Cache Side Channels in Shared LLM Systems
Proposes PrefixWall, which selectively isolates shared prefixes to mitigate timing side channels
arXiv
2603.10726
Published
Mar 11
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
gemma-3-4b-it, llava-onevision-qwen2-0.5b-ov-hf, llava-onevision-qwen2-7b-ov-chat-hf and others9
- AttacksExtraction and theft
AbstractPrefixWall uses cache metadata to selectively cut off cross-user prefix continuation, preserving APC while limiting the TTFT side channel.
PrefixWall is a system-level defense for multi-tenant LLM services that limits the TTFT side channel of Automatic Prefix Caching while preserving prefix reuse.
Paper analysisRead analysis
AttacksarXiv 2602.20595Feb 24
OptiLeak：在多租户 LLM 服务中用强化学习高效重建提示词
提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示
arXiv
2602.20595
Published
Feb 24
Layer
Infrastructure layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen-2.5-3B-Instruct, Qwen-2.5-7B-Instruct, Qwen-2.5-14B-Instruct and others4
- AttacksExtraction and theft
- TechniqueSide channels
AbstractOPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop