Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 21 papers

Filter2

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Attack type：Poisoning and backdoors Defense type：Detection and filtering Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

Analysis and theoryarXiv 2610.13051Oct 9
Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors
Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining
arXiv
2610.13051
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-32
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.
The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.06001Oct 5
AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks
提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入
arXiv
2610.06001
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。
本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。
Paper analysisRead analysis
DefensesarXiv 2610.01788Oct 1
SAGE：基于相似度从少量已验证样本中清洗中毒训练数据
提出 SAGE，用少量已核验样本按相似度清洗投毒训练数据
arXiv
2610.01788
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18, VGG-16
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
Paper analysisRead analysis
DefensesarXiv 2609.36879Sep 29
SKILLLITE：用小模型做证据引导的恶意 Agent Skill 审计
提出证据引导的 SKILLLITE，审计部署前恶意 Agent Skill
arXiv
2609.36879
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma4:e4b, Qwen3.5:9B, DeepSeek-R1:8B and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMCP and skills
AbstractSKILLLITE 把证据抽取外置，让紧凑 LLM 只做意图条件下的风险裁决，三个基准上 F1 高于所列基线。
SKILLLITE是面向紧凑、可本地部署 LLM 的恶意 Agent Skill 预执行审计框架，作者单位为南洋理工大学。
Paper analysisRead analysis
DefensesarXiv 2609.34804Sep 28
物理认证联邦学习：为关键水务基础设施的协同异常检测提供安全保障
为协同异常检测提出物理准入门，在聚合前拦截不合规训练批次
arXiv
2609.34804
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
deep reconstruction autoencoder
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
Abstract物理准入为联邦检测增加数据约束，但合规证明不等于无投毒或训练来源证明。
这是一项面向水基础设施联邦异常检测的物理准入防御研究。 作者针对隐藏训练遥测带来的投毒检查问题，结合不变量挖掘、聚合前过滤和零知识抽样证明。
Paper analysisRead analysis
AttacksarXiv 2609.27124Sep 23
Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习
提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复
arXiv
2609.27124
Published
Sep 23
Layer
Training and data layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
CNN（MNIST：2 Conv + 3 FC）, CNN（Fashion-MNIST：6 Conv + 1 FC）, ResNet18（CIFAR-10）
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。
Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。
Paper analysisRead analysis
DefensesarXiv 2609.16098Sep 14
研究者提出面向工具集成 LLM Agent 的通用对抗攻击防御方法
提出 ATF 与 NTR，过滤或恢复工具集以阻止 Agent 调用攻击工具
arXiv
2609.16098
Published
Sep 14
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma2-9B, Qwen2-7B, LLaMA3-8B and others7
- DefensesPermissions and approval
- AttacksPrompt injection
Paper analysisRead analysis
DefensesarXiv 2609.14079Sep 13
SkillSecurer：检测并修补 AI Agent 技能中的提示注入漏洞
提出 SkillSecurer，检测并修补 Agent 技能中的提示注入漏洞
arXiv
2609.14079
Published
Sep 13
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 5, Gemini 3.6 Flash, GPT-5.6 Sol and others10
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis
DefensesarXiv 2609.10707Sep 10
面向 AI-SOC 的神经符号防御框架：用 SIEM 解码器与 NeMo Guardrails 阻断日志投毒提示注入
提出神经符号纵深架构，阻断 AI-SOC 的日志投毒与间接提示注入
arXiv
2609.10707
Published
Sep 10
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma 3 (12B)
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2609.07063Sep 7
VERITAS：抗投毒的本地差分隐私图学习协议
提出 VERITAS，用双边背书剪除本地隐私图学习中的投毒节点
arXiv
2609.07063
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
GCN, GraphSAGE, GAT
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
AbstractVERITAS 用分级信任的双边背书剪除 LDP 图学习中的投毒节点，并恢复分类准确率。
VERITAS 是面向本地差分隐私图学习的投毒防御协议，按 trust-but-verify 在保持 ϵ-LDP 的同时剪除伪造节点。
Paper analysisRead analysis
DefensesarXiv 2609.06346Sep 6
面向后门攻击下持续学习的鲁棒动态扩展：净化与选择性恢复
提出持续学习下的净化与选择性恢复框架，抵御逐任务训练投毒后门
arXiv
2609.06346
Published
Sep 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ViT-B/16
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentVision
Abstract作者报告任务内净化与恢复可配合动态专家防御后门，但保证依赖分离条件。
这是一项面向持续图像分类的后门防御研究：模型只使用当前任务数据，同时需要保留过去知识并避免学习恶意监督。
Paper analysisRead analysis
DefensesarXiv 2609.27760Sep 4
FedMAST：用多轴结构痕迹检测并遏制联邦学习后门
提出 FedMAST，用多轴结构痕迹检测并遏制联邦学习后门
arXiv
2609.27760
Published
Sep 4
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Tiny ResNet-18
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
Paper analysisRead analysis
DefensesarXiv 2609.02127Sep 2
论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史
提出类型化溯源与断言护栏，约束持久 Agent 释放自传断言
arXiv
2609.02127
Published
Sep 2
Layer
Application layer
Setting
AI Agent
- DefensesWatermarking and provenance
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2608.03485Aug 4
SkillSentry：用自适应蜜罐世界动态检测 Agent 技能安全
提出 SkillSentry，用自适应蜜罐世界在安装前检测 Agent 技能是否越出能力契约
arXiv
2608.03485
Published
Aug 4
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Pro, Qwen, Kimi and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract契约加配对执行审计技能越权。
SkillSentry 是安装前的动态技能审计，用来发现超出宣称功能的能力漂移。技能一旦安装，就能使用宿主的文件、shell、凭证和网络，而有害分支可能要等特定资源才出现。作者认为，源码或一次性语义判断既不能确认分支会执行，也不能把技能造成的效果与任务或基座智能体的动作分开。
Paper analysisRead analysis
DefensesarXiv 2608.02271Aug 3
Z-PEFT：基于规范谱特征的参数高效微调零样本后门检测
提出 Z-PEFT，用逐头谱特征零样本检测 PEFT 后门
arXiv
2608.02271
Published
Aug 3
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Z-PEFT, Llama-2-7B, Llama-2-13B and others6
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2607.25297Jul 28
MTGuard：面向 LLM 智能体安全 MCP 工具调用的混合分析
提出 MTGuard，对照 MCP 调用声明与执行痕迹拦截不安全工具调用
arXiv
2607.25297
Published
Jul 28
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, GPT-5.6 Luna
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2607.06595Jul 7
当 Agent 记得太多：针对大语言模型 Agent 的记忆投毒攻击
提出 GhostWriter 记忆投毒，经邮件与日程写入 Agent 长期记忆并跨会话激活
arXiv
2607.06595
Published
Jul 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4-mini, DeepSeek-V4-Flash, Gemini-2.5-Flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2607.04379Jul 6
PA-LLM-RAG 框架的知识库投毒攻击与防御
提出策略 RAG 的知识库投毒攻击与检测防御 CLD-KB
arXiv
2607.04379
Published
Jul 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.2
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentRAG
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks

SAGE：基于相似度从少量已验证样本中清洗中毒训练数据

SKILLLITE：用小模型做证据引导的恶意 Agent Skill 审计

物理认证联邦学习：为关键水务基础设施的协同异常检测提供安全保障

Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习

研究者提出面向工具集成 LLM Agent 的通用对抗攻击防御方法

SkillSecurer：检测并修补 AI Agent 技能中的提示注入漏洞

面向 AI-SOC 的神经符号防御框架：用 SIEM 解码器与 NeMo Guardrails 阻断日志投毒提示注入

VERITAS：抗投毒的本地差分隐私图学习协议

面向后门攻击下持续学习的鲁棒动态扩展：净化与选择性恢复

FedMAST：用多轴结构痕迹检测并遏制联邦学习后门

论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史

SkillSentry：用自适应蜜罐世界动态检测 Agent 技能安全

Z-PEFT：基于规范谱特征的参数高效微调零样本后门检测

MTGuard：面向 LLM 智能体安全 MCP 工具调用的混合分析

当 Agent 记得太多：针对大语言模型 Agent 的记忆投毒攻击

PA-LLM-RAG 框架的知识库投毒攻击与防御