Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 6 papers
Filter3

Attack type

Jailbreaks26Extraction and theft6

Attack technique

Automated search6Multi-turn escalation2Role-play and persuasion3Side channels4

Impact

Data and privacy leaks5

System type

Models and APIs4

Attacker access

Black-box3

Attack surface / entry point

Inference services and hardware4

Layer

Infrastructure layer4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 248papers have no tags yet and are not included in filtered results.
Attack type：Extraction and theftAttack technique：Multi-turn escalationAttack technique：Side channelsClear all

Another 248papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.09981

    研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题

    提出利用路由元数据推断敏感话题的侧信道攻击

    arXiv
    2610.09981
    Published
    Layer
    Infrastructure layer
    Setting
    LLM applications
    Evaluated models
    RouteLLM (BERT router), notdiamond-0001, Vela (vLLM Semantic Router)

    Abstract论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.06848

    TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击

    提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员

    arXiv
    2610.06848
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5

    AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。

    Paper analysisRead analysis
  3. AttacksarXiv 2608.17485

    KeyPooling: Measuring where LLM API relay paths break prompt cache isolation

    Proposing KeyPooling to measure where API relays break prompt cache isolation

    arXiv
    2608.17485
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    grok-4-fast-non-reasoning, grok-4-1-fast-non-reasoning, grok-3 and others11
    AbstractShared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.

    KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.

    Paper analysisRead analysis
  4. AttacksarXiv 2602.20595

    OptiLeak：在多租户 LLM 服务中用强化学习高效重建提示词

    提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示

    arXiv
    2602.20595
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen-2.5-3B-Instruct, Qwen-2.5-7B-Instruct, Qwen-2.5-14B-Instruct and others4

    AbstractOPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。

    Paper analysisRead analysis
  5. AttacksarXiv 2602.07379

    Aegis: Governance, Integrity, and Security for AI Voice Agents

    提出 Aegis 红队框架，多轮攻击高风险语音 Agent

    arXiv
    2602.07379
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4o, GPT-4o-mini, Gemini-1.5 Pro and others7
    AbstractAegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.

    Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.

    Paper analysisRead analysis
You have reached the end