Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack type：Model tampering Attack type：Detection evasion Attack technique：Gradient and representation optimization Attack technique：Encoding and obfuscation Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2610.05894Oct 5
研究者提出闭环偏见注入攻击
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
arXiv
2610.05894
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
Paper analysisRead analysis
AttacksarXiv 2610.03166Oct 2
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
arXiv
2610.03166
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
Paper analysisRead analysis
AttacksarXiv 2610.01062Oct 1
Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架
提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱
arXiv
2610.01062
Published
Oct 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B-Instruct, Gemma-2-9B-IT, Llama-3.1-8B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
AbstractKAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。
Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。
Paper analysisRead analysis
AttacksarXiv 2609.39788Sep 30
研究：多智能体系统潜在通信链路可被训练用于提升有害顺从
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
arXiv
2609.39788
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。
学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
Paper analysisRead analysis
InterpretabilityarXiv 2609.24801Sep 22
研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
arXiv
2609.24801
Published
Sep 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Prompt Guard 2 (86M), Llama 3.1 8B
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentGuardrails and judges
Abstract作者称检测靠分散的词法线索。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2608.07430Aug 8
研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱
提出 SN-Guided Diffusion，利用安全神经元实现离线越狱
arXiv
2608.07430
Published
Aug 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen2.5-7B-Instruct, LLaDA-8B-Instruct, Dream-Instruct-7B and others15
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。
论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.19855Jul 22
研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测
提出最小范数攻击集成，用鲁棒性曲线评测图像分类器
arXiv
2607.19855
Published
Jul 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C1–C20（CIFAR-10，Table 1）, I1–I10（ImageNet，Table 1）
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Abstract预算可控的最小范数集成用 AOI 逼近攻击前沿，DOI 给出不依赖单一ε的防御排序。
这篇工作把对抗鲁棒评测从单一 ε、固定集成，改成可按查询预算收紧的曲线估计。
Paper analysisRead analysis
AttacksarXiv 2606.09700Jun 9
The researchers propose the HPAA attack: bypassing 13 content moderation systems with typographic visual cues
提出 HPAA 攻击，用排版视觉线索绕过内容审核系统
arXiv
2606.09700
Published
Jun 9
Layer
Prompt layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Llama-Guard-3-8B, Perspective API, ShieldGemma-2B and others13
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract揭示了排版视觉线索与分词差异带来的审核盲区，HPAA 以极低查询实现近乎完全规避。
这篇论文研究了人类视觉感知与大模型分词处理机制之间的差异所导致的内容审核漏洞。
Paper analysisRead analysis
AttacksarXiv 2605.22258May 21
CITA：面向中文隐式毒性的攻击与防御数据生成框架
提出 CITA 三阶段框架，生成可绕过毒性检测器的中文隐式毒性文本
arXiv
2605.22258
Published
May 21
Layer
Application layer
Setting
LLM applications
Evaluated models
Tencent, Baidu, Gemini 3.1 Pro and others11
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2605.21541May 20
研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
arXiv
2605.21541
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。
FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
Paper analysisRead analysis
AttacksarXiv 2605.08513May 9
Apple 研究者发现抑制单个神经元即可绕过 LLM 安全对齐
提出单神经元激活干预，抑制拒答神经元或放大概念神经元以绕过安全对齐
arXiv
2605.08513
Published
May 9
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others11
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract作者称大模型安全由拒答门控与概念底座构成，干预单个神经元足以双向击穿对齐，且拒答神经元在预训练阶段已然存在。
Paper analysisRead analysis
AttacksarXiv 2605.07481May 8
Vaporizer：研究者用改写类攻击破解大语言模型输出水印方案
提出 Vaporizer，用词法变换、翻译和释义破解 LLM 输出水印
arXiv
2605.07481
Published
May 8
Layer
Prompt layer
Setting
Models and APIs
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2604.03117Apr 3
Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models
Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.
arXiv
2604.03117
Published
Apr 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.
UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.
Paper analysisRead analysis
AttacksarXiv 2603.10080Mar 10
Amnesia：针对大语言模型特定语义层的对抗性激活引导
提出 Amnesia 激活引导攻击，推理时绕过模型安全拒答
arXiv
2603.10080
Published
Mar 10
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Llama-3-8B-Instruct, Qwen-7B-Chat
- AttacksModel tampering
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2602.09431Feb 10
Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models
Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models
arXiv
2602.09431
Published
Feb 10
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
LLaVA, Qwen2.5-VL, InternVL3 and others10
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractGDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.
GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.
Paper analysisRead analysis
AttacksarXiv 2602.05444Feb 5
Causal front-door adjustment for robust jailbreak attacks on LLMs
提出 CFA2，用 SAE 定位防御方向并正交化输出权重实现越狱
arXiv
2602.05444
Published
Feb 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama 3.1 8B Instruct, Llama2 7B Chat, Mistral 7B Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2602.00979Feb 1
GradingAttack: Revealing Security Vulnerabilities in LLM-Based Educational Grading Agents
提出 GradingAttack，用梯度后缀与角色扮演操纵教育评分智能体判定
arXiv
2602.00979
Published
Feb 1
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen2.5-7B, Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct and others8
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop