Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 24 papers
Filter5

Attack type

Jailbreaks29Prompt injection16Poisoning and backdoors10Model tampering8Extraction and theft3Detection evasion12

Attack technique

Gradient and representation optimization20Automated search37Encoding and obfuscation15Role-play and persuasion6Conversation structure manipulation4Reasoning-chain manipulation5Cross-modal payloads7Side channels4Defense-targeted24Dormant triggers54Selection manipulation9

Impact

Harmful content3Data and privacy leaks3Output manipulation17

System type

Models and APIs12LLM applications6AI Agent6

Attacker access

Black-box3Gray-box3

Attack surface / entry point

User input7Retrieval corpus4Images, audio and video9Training data5

Layer

Prompt layer8Application layer11Training and data layer3

System component

RAG4Reasoning chains3Vision6Multimodal8
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
Attack type：Poisoning and backdoorsAttack type：Extraction and theftAttack type：Detection evasionAttack technique：Gradient and representation optimizationAttack technique：Conversation structure manipulationClear all

Another 254papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  3. AttacksarXiv 2610.04985

    研究揭示 Jev 作为应用决策层的安全与隐私风险

    评估应用决策层的输入注入与隐私推断风险

    arXiv
    2610.04985
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box, Gray-box
    Evaluated models
    Jev, NanoJev
    AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。

    Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.03166

    LiBRA：通过双向隐空间优化实现检测感知的图像水印去除

    提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测

    arXiv
    2610.03166
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Stable Signature, YU1, HiDDeN and others4

    AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.01367

    研究：高质量数据筛选挡不住投毒

    提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本

    arXiv
    2610.01367
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
    Abstract质量筛选挡不住部分高分样本的安全削弱。

    Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.39788

    研究：多智能体系统潜在通信链路可被训练用于提升有害顺从

    提出只训练或篡改多智能体潜在通信链路来提高有害遵从

    arXiv
    2609.39788
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
    Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。

    学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。

    Paper analysisRead analysis
  7. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  8. InterpretabilityarXiv 2609.24801

    研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定

    用词级归因指导同义词替换，翻转提示注入检测并验证越狱

    arXiv
    2609.24801
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Prompt Guard 2 (86M), Llama 3.1 8B

    Abstract作者称检测靠分散的词法线索。

    Paper analysisRead analysis
  10. AttacksarXiv 2608.09867

    Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

    利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链

    arXiv
    2608.09867
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13

    Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。

    Paper analysisRead analysis
  12. Evaluation and benchmarksarXiv 2607.19855

    研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测

    提出最小范数攻击集成，用鲁棒性曲线评测图像分类器

    arXiv
    2607.19855
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    C1–C20（CIFAR-10，Table 1）, I1–I10（ImageNet，Table 1）
    Abstract预算可控的最小范数集成用 AOI 逼近攻击前沿，DOI 给出不依赖单一ε的防御排序。

    这篇工作把对抗鲁棒评测从单一 ε、固定集成，改成可按查询预算收紧的曲线估计。

    Paper analysisRead analysis
  13. AttacksarXiv 2606.11265

    论文提出 CRCP 投毒框架，揭示 RAG 分块与重排序下的投毒失效问题

    提出 CRCP 框架，优化分块与重排下的 RAG 语料投毒

    arXiv
    2606.11265
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, DeepSeek-R1, Qwen3-Max and others11
    AbstractCRCP 把投毒做成多阶段一致性问题。

    CRCP 研究的是带分块和重排的 RAG 语料投毒，而不是只提高文档级检索分数。

    Paper analysisRead analysis
  14. AttacksarXiv 2606.09499

    研究者提出针对世界模型的机器人学习管线投毒攻击

    提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略

    arXiv
    2606.09499
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
    Abstract只改视频帧经世界模型投毒。

    只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。

    Paper analysisRead analysis
  15. AttacksarXiv 2605.28074

    SilentRetrieval: Hijacking retrieval-augmented generation with semantically preserved adversarial data poisoning

    提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成

    arXiv
    2605.28074
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Llama-2-7B-Chat, Mistral-7B-Instruct-v0.2, Qwen-7B-Chat and others10
    Abstract两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。

    SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。

    Paper analysisRead analysis
  16. AttacksarXiv 2605.21541

    研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果

    提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击

    arXiv
    2605.21541
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
    AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。

    FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。

    Paper analysisRead analysis
  18. AttacksarXiv 2604.03117

    Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models

    Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.

    arXiv
    2604.03117
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
    AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.

    UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.

    Paper analysisRead analysis
  19. AttacksarXiv 2603.11132

    WebWeaver：以隐蔽的上下文推断攻破 LLM 多智能体系统拓扑机密性

    提出 WebWeaver ，只攻陷单个智能体并从对话上下文恢复多智能体通信拓扑

    arXiv
    2603.11132
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Llama 3.1 8B, Qwen 2.5 7B, Mistral NeMo 12B and others6
    AbstractWebWeaver 用上下文推断拓扑。

    WebWeaver 是针对 LLM-MAS 通信拓扑机密性的推断攻击：只控制一个任意智能体，从对话上下文恢复全图，而不是查询智能体 ID。

    Paper analysisRead analysis
  20. AttacksarXiv 2602.09431

    Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models

    Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models

    arXiv
    2602.09431
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    No-box (offline transfer)
    Evaluated models
    LLaVA, Qwen2.5-VL, InternVL3 and others10
    AbstractGDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.

    GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.

    Paper analysisRead analysis
Load more