Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 66 papers
Filter4

Attack type

Jailbreaks221Prompt injection49Poisoning and backdoors76Model tampering33Extraction and theft64Detection evasion54Denial of service5Malicious use19

Attack technique

Gradient and representation optimization4Automated search5Encoding and obfuscation4Role-play and persuasion3Cross-modal payloads5Defense-targeted4Dormant triggers5Selection manipulation3

Model risks

Deception and scheming3

Defense type

Inference-time intervention4Detection and filtering9Permissions and approval4Monitoring and auditing6

Impact

Harmful content7Unauthorized actions20Data and privacy leaks9Output manipulation18Oversight failure3

System type

Models and APIs30LLM applications26AI Agent218coding agent36science agent4web agent26Browser and computer use10Multi-agent systems24

Attacker access

Black-box4

Attack surface / entry point

User input29Web pages and interfaces3Documents and messages5Tool responses10Tool and skill descriptions16Code repositories and dependencies15Memory writes3Images, audio and video14Distribution channels13

Layer

Prompt layer17Model layer10Application layer35Training and data layer3

System component

MCP and skills14Memory3Guardrails and judges6Monitors9Reasoning chains3Permissions and sandboxing6Vision9Image generation6Multimodal17
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 248papers have no tags yet and are not included in filtered results.
Attack type：Prompt injectionAttack type：Malicious useSystem type：Models and APIsSystem type：coding agentClear all

Another 248papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.13333

    LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

    Proposes LETHE, which perturbs reference images to block unauthorized image-to-video

    arXiv
    2610.13333
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
    AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.

    LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.

    Paper analysisRead analysis
  3. InterpretabilityarXiv 2610.12361

    Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

    Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.

    arXiv
    2610.12361
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
    AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.

    This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

    Paper analysisRead analysis
  4. AttacksarXiv 2610.09264

    研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

    提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包

    arXiv
    2610.09264
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
    AbstractPackHallu 诱导规则文件换包。

    PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  6. DefensesarXiv 2610.08316

    MARCO：面向蛋白质生成模型的放射性水印框架

    提出 MARCO 放射性水印，冻结蛋白质生成模型并在去噪时嵌入签名

    arXiv
    2610.08316
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    RFdiffusion, ESMFold, Chroma and others6
    AbstractMARCO 在冻结的 PGM 上去噪时嵌构象水印，作者称能兼顾保真与抗扰动，并使盗版模型继承水印。

    MARCO 是加在蛋白质生成模型推理过程上的构象水印，用来标记知识产权，并为可能的生物安全滥用保留可追溯信号。作者还把它说成数字权利管理工具，以及符合生物武器公约的数字监管链。问题在于：专有 PGM 的三维输出可能被拿去训练盗版模型，也可能在来源被抹掉后绕过筛查。

    Paper analysisRead analysis
  10. Analysis and theoryarXiv 2610.06001

    AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks

    提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入

    arXiv
    2610.06001
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
    Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。

    本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。

    Paper analysisRead analysis
  11. DefensesarXiv 2610.05163

    Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

    提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入

    arXiv
    2610.05163
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
    Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。

    本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。

    Paper analysisRead analysis
  13. DefensesarXiv 2610.03980

    FADE：面向视频扩散模型的帧感知多概念擦除框架

    提出 FADE，对文生视频模型做帧感知多概念擦除

    arXiv
    2610.03980
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-T2V-1.3B, Wan2.1-T2V-14B, CogVideoX-2B and others4
    AbstractFADE 用闭式编辑、帧感知适配器和软路由，在单骨干上擦除多概念并压低逐帧残差。

    FADE 是面向文生视频扩散 Transformer 的多概念遗忘方法，用来抑制指定物体、画风、裸体、暴力、仇恨和名人身份，并尽量保持其他生成。作者要处理两件事。与帧无关的抑制会让概念在少数帧重现，片段均值会掩盖这一失败。

    Paper analysisRead analysis
  15. DefensesarXiv 2610.03073

    SecJev：为 System One 决策模型引入安全专业知识

    提出 SecJev，用场景加权训练把决策模型适配为安全类型化判断

    arXiv
    2610.03073
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    SecJev-0.8B, SecJev-2B, SecJev-4B and others4
    AbstractSecJev 用共享打分器做安全决策，0.8B 的 task-macro 超过 Kev-9B。

    SecJev 是 0.8B 到 9B 的安全决策模型族，作者称据其所知是首个面向安全的 Jev-like 家族。

    Paper analysisRead analysis
  16. DefensesarXiv 2610.02413

    研究：分类后缀可提升激活探针的分布外恶意输入检测

    用分类后缀提升激活探针对分布外恶意输入的检测

    arXiv
    2610.02413
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
    Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。

    用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。

    Paper analysisRead analysis
  18. AttacksarXiv 2610.01768

    LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄

    提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传

    arXiv
    2610.01768
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
    Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。

    LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。

    Paper analysisRead analysis
  19. InterpretabilityarXiv 2609.37737

    研究用因果激活修补定位模型服从提示注入指令的决策层

    用因果激活修补定位模型服从提示注入的决策层

    arXiv
    2609.37737
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-4B, Qwen3-14B, Qwen3-32B and others7
    Abstract合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。

    这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。。

    Paper analysisRead analysis
Load more