Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 67 papers
Filter3

Attack type

Jailbreaks207Prompt injection16Poisoning and backdoors47Model tampering33Extraction and theft61Detection evasion51Denial of service4Malicious use13

Attack technique

Gradient and representation optimization13Automated search4Encoding and obfuscation4Cross-modal payloads7Defense-targeted11Dormant triggers3

Defense type

Model hardening3Detection and filtering12Watermarking and provenance12

Impact

Harmful content4Output manipulation41Oversight failure8

System type

Models and APIs67LLM applications37AI Agent213coding agent35science agent3web agent24Browser and computer use8Multi-agent systems24Embodied systems and robotics3

Attacker access

Black-box12Gray-box5White-box7

Attack surface / entry point

User input25Documents and messages8Tool responses4Images, audio and video29Training data3Weights and gradients5

Layer

Prompt layer30Model layer27Training and data layer7

System component

Guardrails and judges12Monitors4Reasoning chains4Vision13Audio3Video3Image generation6Multimodal23
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Attack type：Prompt injectionAttack type：Detection evasionSystem type：Models and APIsClear all

Another 265papers do not have category tags yet and are not included in filtered results.

  1. InterpretabilityarXiv 2610.12361

    Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

    Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.

    arXiv
    2610.12361
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
    AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.

    This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.11848

    SemField: training-free semantic watermark

    Proposes the semantic watermark SemField, which still identifies the attribution of generated text after paraphrasing and structural changes.

    arXiv
    2610.11848
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.2-1B, Qwen3-1.7B, OPT-1.3B
    AbstractTraining-independent document-level semantic watermark.

    SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.

    Paper analysisRead analysis
  3. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2610.07939

    CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it

    提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别

    arXiv
    2610.07939
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    C2P-CLIP, ForgeLens, D3-Im and others10

    Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.07323

    ATLAS：用自适应信任域与主动学习搜索潜在对抗样本集

    提出 ATLAS 用水平集估计恢复黑盒分类器的对抗输入集合

    arXiv
    2610.07323
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    LeNet5, ResNet50 (CIFAR-10 standard), ResNet50 (ImageNet standard) and others5
    AbstractATLAS 用主动水平集估计构造黑盒对抗集，作者称其集合比单点攻击更具代表性。

    ATLAS 是一个查询式 black-box 框架，用来构造诱发失败的对抗输入集合，供鲁棒性审计使用。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2610.06339

    BabelFake：面向多语言音视频 DeepFake 检测的基准数据集

    构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器

    arXiv
    2610.06339
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    SpeechForensics, AVH-Align, (B)RAVEn
    AbstractBabelFake 为五语同意采集基准。

    BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。

    Paper analysisRead analysis
  8. DefensesarXiv 2610.04763

    UT Austin 将 SynthID 水印嵌入基因组语言模型，凭 DNA 序列和密钥追溯 AI 生成片段

    把 SynthID 嵌入基因组语言模型采样，并用位置无关检测追溯生成序列

    arXiv
    2610.04763
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Carbon-500M, GENERator-v2-eukaryote-1.2b-base
    Abstract两个六碱基基因组模型嵌入 SynthID 后，位置无关验证能找回水印，作者称这只是统计检测。

    作者在两个六碱基基因组模型的采样里嵌入 SynthID，并让验证者在不知道起点、链和 token phase 时做一次校正后的检出。

    Paper analysisRead analysis
  10. AttacksarXiv 2610.03166

    LiBRA：通过双向隐空间优化实现检测感知的图像水印去除

    提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测

    arXiv
    2610.03166
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Stable Signature, YU1, HiDDeN and others4

    AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。

    Paper analysisRead analysis
  11. DefensesarXiv 2610.03073

    SecJev：为 System One 决策模型引入安全专业知识

    提出 SecJev，用场景加权训练把决策模型适配为安全类型化判断

    arXiv
    2610.03073
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    SecJev-0.8B, SecJev-2B, SecJev-4B and others4
    AbstractSecJev 用共享打分器做安全决策，0.8B 的 task-macro 超过 Kev-9B。

    SecJev 是 0.8B 到 9B 的安全决策模型族，作者称据其所知是首个面向安全的 Jev-like 家族。

    Paper analysisRead analysis
  12. DefensesarXiv 2610.02853

    研究提出基于收缩约束状态空间模型的有界可达性与越狱检测方法

    提出收缩约束 SSM 安全头，认证嵌入扰动并检测越狱

    arXiv
    2610.02853
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    ToySSMClassifier, S4 safety head
    Abstract收缩给出玩具 LTI 的有界认证。

    给 SSM 安全头一个收缩条件，并在越狱检测上使用收缩正则的 S4 头。。

    Paper analysisRead analysis
  14. DefensesarXiv 2610.02413

    研究：分类后缀可提升激活探针的分布外恶意输入检测

    用分类后缀提升激活探针对分布外恶意输入的检测

    arXiv
    2610.02413
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
    Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。

    用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。

    Paper analysisRead analysis
  15. AttacksarXiv 2610.03124

    研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效

    提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测

    arXiv
    2610.03124
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box, White-box
    Evaluated models
    Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
    Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。

    UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。

    Paper analysisRead analysis
  16. DefensesarXiv 2610.00883

    DeBERTa-ConPara：面向部署的 AI 生成文本检测，推理端 Unicode 归一化提升对抗鲁棒性

    提出推理时 Unicode 归一化的检测器，识别遭字符级扰动的 AI 生成文本

    arXiv
    2610.00883
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    microsoft/deberta-v3-large, deberta-v3-base, bert-large-cased and others4
    Abstract推理时归一化消除两类 Unicode 攻击，训练时归一化则会删掉对抗监督。

    DeBERTa-ConPara 是一个面向部署的 AI 文本检测器：DeBERTa-v3-large 在多数据集原始文本上训练，推理前做确定性 Unicode 归一化，用一个固定阈值面对没有目标域标签的场景。

    Paper analysisRead analysis
  18. Analysis and theoryarXiv 2610.00417

    研究：合成数据溯源识别在改写后准确率大幅下降

    检验合成数据来源识别是否等于再训练适配筛选

    arXiv
    2610.00417
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-3B-Instruct, DistilRoBERTa, word TF-IDF logistic regression and others5
    Abstract来源识别在原文上准确，改写后精确归因下降。

    作者在金融风险文本上把来源识别和训练样本是否有用拆成两次测量，并写明这不是电信部署实验。

    Paper analysisRead analysis
  19. InterpretabilityarXiv 2609.37737

    研究用因果激活修补定位模型服从提示注入指令的决策层

    用因果激活修补定位模型服从提示注入的决策层

    arXiv
    2609.37737
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-4B, Qwen3-14B, Qwen3-32B and others7
    Abstract合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。

    这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。。

    Paper analysisRead analysis
  20. DefensesarXiv 2609.37310

    AutoMark：让自动研究流程自主发现更优 LLM 水印方案

    提出 AutoMark，自动搜索并统计检验 LLM 文本水印

    arXiv
    2609.37310
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen3.8-27B, GPT-6 Astra and others5
    AbstractAutoMark 的贡献同时包含搜索出的水印，以及用于约束自动研究误报与评测漏洞的验证框架。

    AutoMark 是一套自动水印研究框架：先检查生成分布和误报性质，再比较检测、编辑鲁棒性与质量，最后人工分析组件并做留出评测。

    Paper analysisRead analysis
Load more