Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 44 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 247papers have no tags yet and are not included in filtered results.

Attack type：Poisoning and backdoors Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Code repositories and dependencies Attack surface / entry point：Memory writes Layer：Application layer Clear all

Another 247papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
AttacksarXiv 2610.09264Oct 7
研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
arXiv
2610.09264
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
- AttacksPrompt injection
- TechniqueAutomated search
AbstractPackHallu 诱导规则文件换包。
PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
AttacksarXiv 2610.07645Oct 6
SkillPoison：用成功经验投毒自进化 Agent 的技能形成
提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能
arXiv
2610.07645
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。
SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。
Paper analysisRead analysis
AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
AttacksarXiv 2610.04589Oct 3
StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel
提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道
arXiv
2610.04589
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMemory
Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。
Paper analysisRead analysis
AttacksarXiv 2610.04195Oct 3
MemLeak research: multi-tenant agents sharing vector memory stores have cross-user memory leakage
提出 MemLeak，评估多租户 Agent 共享向量记忆的跨用户泄露
arXiv
2610.04195
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 2.5 Flash, Claude Sonnet 4.5, all-MiniLM-L6-v2 and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2610.00450Oct 1
ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
arXiv
2610.00450
Published
Oct 1
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Claude Sonnet 4.6, GPT-5.5, GLM-5.2 and others4
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.35576Sep 29
研究提出跨 LLM 助手的记忆跳跃攻击
提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播
arXiv
2609.35576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Luna, Kimi-K2.6, GPT-OSS-120B and others6
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。
该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34790Sep 28
CoSec：面向社区场景的 LLM Agent 安全基准
用 CoSec 评测社区 Agent 是否越界披露受保护信息
arXiv
2609.34790
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
OpenClaw with Gemini 3.1 Pro, OpenClaw with Qwen 3.8 Max, OpenClaw with MiniMax M2.5 and others13
- AttacksPrompt injection
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.32616Sep 26
Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作
提出 CAVE-BENCH，评测智能体在虚假指责下破坏已完成的正确工作
arXiv
2609.32616
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-Sonnet-5, Claude-Opus-5, GPT-5.6-Sol and others14
- AttacksPrompt injection
- RiskDangerous agent actions
Abstract论文提出了评估智能体在虚假指责下破坏已有正确成果的 CAVE-BENCH，发现强模型易推翻已知证据，提出了门控缓解方案。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.28915Sep 24
研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性
构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性
arXiv
2609.28915
Published
Sep 24
Layer
Application layer
Setting
coding agent
Evaluated models
AdaBoost, XGBoost, TabPFN and others10
- AttacksPrompt injection
- ComponentMCP and skills
AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。
ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.22818Sep 19
研究测量 LLM Agent 记忆投毒防御的良性场景开销
测量记忆投毒防御在良性对话上的效用与 token 开销
arXiv
2609.22818
Published
Sep 19
Layer
Application layer
Setting
AI Agent
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract写时代价落在噪声内。
在没有攻击的对话上，给记忆投毒防御计价，而不是再测一轮攻击是否被挡住。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.19705Sep 17
SoK 论文提出 FARSIGHT 框架，评测 15 个学术金融 LLM 交易 Agent 的鲁棒性与安全失败
用 FARSIGHT 方案级评测金融 LLM 交易 Agent 的稳健性与安全失败
arXiv
2609.19705
Published
Sep 17
Layer
Application layer
Setting
AI Agent
Evaluated models
ChatGPT Deep Research
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
DefensesarXiv 2609.16098Sep 14
研究者提出面向工具集成 LLM Agent 的通用对抗攻击防御方法
提出 ATF 与 NTR，过滤或恢复工具集以阻止 Agent 调用攻击工具
arXiv
2609.16098
Published
Sep 14
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma2-9B, Qwen2-7B, LLaMA3-8B and others7
- DefensesPermissions and approval
- AttacksPrompt injection
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
DefensesarXiv 2609.02127Sep 2
论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史
提出类型化溯源与断言护栏，约束持久 Agent 释放自传断言
arXiv
2609.02127
Published
Sep 2
Layer
Application layer
Setting
AI Agent
- DefensesWatermarking and provenance
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.29647Aug 29
AgentKernel：面向 Agent 的可信原生操作系统内核
提出 AgentKernel，用四支柱强制中介 Agent 的输入、工具与记忆
arXiv
2609.29647
Published
Aug 29
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractAgentKernel 是四支柱智能体 OS 设计，安全论证未附带实测数字。
AgentKernel 是把安全做成组织原则的智能体 OS 架构，不是带跑分的攻防评测。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

SkillPoison：用成功经验投毒自进化 Agent 的技能形成

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

MemLeak research: multi-tenant agents sharing vector memory stores have cross-user memory leakage

ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击

研究提出跨 LLM 助手的记忆跳跃攻击

CoSec：面向社区场景的 LLM Agent 安全基准

Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作

研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性

研究测量 LLM Agent 记忆投毒防御的良性场景开销

SoK 论文提出 FARSIGHT 框架，评测 15 个学术金融 LLM 交易 Agent 的鲁棒性与安全失败

多智能体 LLM 流水线中的信任传播与结构隔离

研究者提出面向工具集成 LLM Agent 的通用对抗攻击防御方法

CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

AgentKernel：面向 Agent 的可信原生操作系统内核