All papers

The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.

WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

本文研究了智能体基于摘要的提示词压缩所引入的新型安全漏洞——重链（Relinking），并提出了系统化的攻击构建方法与边界审计防御机制。

PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。

SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。

This work evaluates and hardens the confidentiality of LLM system instructions under encoded extraction. The authors are concerned with: when direct extraction has been rejected, whether the model still surrenders protected content when the same request is rewritten as a formatting or encoding task.

The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.

The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

WebWeaver is an inference attack against the confidentiality of LLM-MAS communication topology: it controls only one arbitrary agent and recovers the full graph from dialogue context, rather than querying agent IDs.

Thought Virus puts subliminal prompting into multi-agent communication, to see whether a single-point deviation spreads across the network without naming the target concept.