Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 39 papers
Filter4

Attack type

Jailbreaks61Prompt injection22Poisoning and backdoors16Extraction and theft12Detection evasion20Malicious use11

Attack technique

Cross-modal payloads4Dormant triggers6

Defense type

Model hardening7Inference-time intervention4Detection and filtering4

Impact

Harmful content8Data and privacy leaks13Output manipulation13

System type

Models and APIs31LLM applications5AI Agent3

Attacker access

Black-box5

Attack surface / entry point

User input13Images, audio and video18Training data13Weights and gradients8Distribution channels6

Layer

Prompt layer7Model layer11Application layer6Training and data layer15

System component

MCP and skills45Memory43RAG31Guardrails and judges15Monitors13Reasoning chains10Permissions and sandboxing14Fine-tuning and open weights34Vision17Audio6Image generation15Embeddings9Multimodal39
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Attack type：Poisoning and backdoorsAttack type：Extraction and theftAttack type：Malicious useSystem component：MultimodalClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.13333

    LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

    Proposes LETHE, which perturbs reference images to block unauthorized image-to-video

    arXiv
    2610.13333
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
    AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.

    LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.09941

    OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

    提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向

    arXiv
    2610.09941
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
    Abstract一次投影去掉劫持方向。

    OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.09819

    FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

    提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门

    arXiv
    2610.09819
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    HuBERT-base, WavLM-base

    Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.05601

    Tracer 框架可从遗忘后的扩散模型中识别被擦除概念

    提出 TRACER，从权重差识别扩散模型被擦除概念

    arXiv
    2610.05601
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
    AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。

    TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。

    Paper analysisRead analysis
  8. AttacksarXiv 2610.05453

    研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私

    提出 PLW，用微调把先前对话敏感触发编码进后续生成图像

    arXiv
    2610.05453
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    OmniGen2, BAGEL-7B

    AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。

    Paper analysisRead analysis
  9. DefensesarXiv 2610.03980

    FADE：面向视频扩散模型的帧感知多概念擦除框架

    提出 FADE，对文生视频模型做帧感知多概念擦除

    arXiv
    2610.03980
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-T2V-1.3B, Wan2.1-T2V-14B, CogVideoX-2B and others4
    AbstractFADE 用闭式编辑、帧感知适配器和软路由，在单骨干上擦除多概念并压低逐帧残差。

    FADE 是面向文生视频扩散 Transformer 的多概念遗忘方法，用来抑制指定物体、画风、裸体、暴力、仇恨和名人身份，并尽量保持其他生成。作者要处理两件事。与帧无关的抑制会让概念在少数帧重现，片段均值会掩盖这一失败。

    Paper analysisRead analysis
  11. DefensesarXiv 2609.39548

    NDDL：用正常扩散动力学为文生图模型做后门防御

    提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token

    arXiv
    2609.39548
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
    AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。

    NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  15. Evaluation and benchmarksarXiv 2609.33481

    IDUnlearn-Bench：面向视觉语言模型的个体级遗忘基准

    提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留

    arXiv
    2609.33481
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others6
    AbstractIDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。

    IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。

    Paper analysisRead analysis
  17. DefensesarXiv 2609.27399

    GUARD：在 CosyVoice2 上做说话人身份遗忘以阻止重识别

    提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别

    arXiv
    2609.27399
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    CosyVoice2-0.5B, F5-TTS, FireRedTTS
    AbstractGUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。

    GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。

    Paper analysisRead analysis
  18. DefensesarXiv 2609.23586

    VidMark：面向视频生成模型知识产权保护的高效水印方案

    提出 VidMark 水印方案，核验视频生成模型的输出来源与所有权

    arXiv
    2609.23586
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Stable Video Diffusion (SVD), Open-Sora, Wan
    AbstractVidMark 加解码器引导微调，把模型签名写入 VGM 输出并用于两项核验。

    Huang 等人提出一套面向视频生成模型的生成内嵌水印方案，用来同时判断一条视频是否来自受保护模型，以及一个嫌疑模型是否为该模型的拷贝。

    Paper analysisRead analysis
Load more