Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 25 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Attack type：Poisoning and backdoors Attack type：Malicious use Attack surface / entry point：Code repositories and dependencies Attack surface / entry point：Images, audio and video Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.13333Oct 9
LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
arXiv
2610.13333
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
- AttacksMalicious use
- ComponentImage generation
AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.
LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Paper analysisRead analysis
AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
AttacksarXiv 2610.09264Oct 7
研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
arXiv
2610.09264
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
- AttacksPrompt injection
- TechniqueAutomated search
AbstractPackHallu 诱导规则文件换包。
PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
Paper analysisRead analysis
AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
AttacksarXiv 2610.01768Oct 1
LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄
提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传
arXiv
2610.01768
Published
Oct 1
Layer
Application layer
Setting
coding agent
Evaluated models
Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
- AttacksMalicious use
Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。
LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.32616Sep 26
Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作
提出 CAVE-BENCH，评测智能体在虚假指责下破坏已完成的正确工作
arXiv
2609.32616
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-Sonnet-5, Claude-Opus-5, GPT-5.6-Sol and others14
- AttacksPrompt injection
- RiskDangerous agent actions
Abstract论文提出了评估智能体在虚假指责下破坏已有正确成果的 CAVE-BENCH，发现强模型易推翻已知证据，提出了门控缓解方案。
Paper analysisRead analysis
DefensesarXiv 2609.28239Sep 23
ODPure：通过集成破坏共识实现目标检测后门净化
提出 ODPure，在输入阶段用腐蚀重建与共识净化目标检测后门
arXiv
2609.28239
Published
Sep 23
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
YOLOv5, Faster R-CNN
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2609.27399Sep 23
GUARD：在 CosyVoice2 上做说话人身份遗忘以阻止重识别
提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别
arXiv
2609.27399
Published
Sep 23
Layer
Model layer
Setting
Models and APIs
Evaluated models
CosyVoice2-0.5B, F5-TTS, FireRedTTS
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentAudio
AbstractGUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。
GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。
Paper analysisRead analysis
DefensesarXiv 2609.21363Sep 18
用扩散模型隐空间扰动防御视觉语言模型的地理位置隐私泄露
提出扩散潜空间地理扰动防御，抑制视觉语言模型泄露精确地理位置
arXiv
2609.21363
Published
Sep 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4.1, GPT-5, Gemini 2.5 Pro and others5
- AttacksMalicious use
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2609.13889Sep 12
PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
arXiv
2609.13889
Published
Sep 12
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
Paper analysisRead analysis
AttacksarXiv 2609.07051Sep 7
TrojanWorld：通过想象引导对世界模型智能体植入后门
提出 TrojanWorld，用物理触发器对世界模型智能体植入想象引导后门
arXiv
2609.07051
Published
Sep 7
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
TD-MPC2, DreamerV3, R2-Dreamer
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
AbstractTrojanWorld 揭示了世界模型智能体的供应链后门风险，通过在世界模型中操纵想象可实现对闭环动作的持续控制。
Paper analysisRead analysis
AttacksarXiv 2609.07048Sep 7
FreqDoor：面向视觉语言模型的频域后门攻击
提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门
arXiv
2609.07048
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentVision
AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。
FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
AttacksarXiv 2609.04260Sep 2
GhostWord：针对自动语音识别的细粒度后门攻击
提出 GhostWord 词级触发后门，对自动语音识别做数据投毒
arXiv
2609.04260
Published
Sep 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Whisper-Small, Whisper-Medium, MMS and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2608.00716Aug 1
生成图像更易被遗忘：面向合成图像检测的机器遗忘视角
提出机器遗忘式生成图像检测，用遗忘前后特征相似度区分自然图与生成图
arXiv
2608.00716
Published
Aug 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
DINOv2 ViT-S/14, DINOv2 ViT-B/14, DINOv2 ViT-L/14 and others9
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentVision
Abstract作者用剪枝或 LoRA 遗忘拉开生成图与自然图的特征相似度，并在多个检测基准上报告结果。
这篇工作把 AI 生成图像检测写成对预训练视觉模型的机器遗忘：原模型对两类图像损失都低，剪枝后生成图特征变得更不像原模型。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis
AttacksarXiv 2606.09499Jun 8
研究者提出针对世界模型的机器人学习管线投毒攻击
提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略
arXiv
2606.09499
Published
Jun 8
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentVideo
Abstract只改视频帧经世界模型投毒。
只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作

ODPure：通过集成破坏共识实现目标检测后门净化

GUARD：在 CosyVoice2 上做说话人身份遗忘以阻止重识别

用扩散模型隐空间扰动防御视觉语言模型的地理位置隐私泄露

PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

TrojanWorld：通过想象引导对世界模型智能体植入后门

FreqDoor：面向视觉语言模型的频域后门攻击

CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

GhostWord：针对自动语音识别的细粒度后门攻击

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

生成图像更易被遗忘：面向合成图像检测的机器遗忘视角

论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险

研究者提出针对世界模型的机器人学习管线投毒攻击