Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 356 papers

Filter3

Attack type

Jailbreaks250 Prompt injection243 Poisoning and backdoors152 Model tampering35 Extraction and theft81 Detection evasion75 Denial of service10 Malicious use27

Attack technique

Gradient and representation optimization19 Automated search38 Multi-turn escalation4 Encoding and obfuscation16 Role-play and persuasion9 Conversation structure manipulation5 Reasoning-chain manipulation3 Cross-modal payloads13 Side channels4 Defense-targeted14 Dormant triggers22 Selection manipulation10

Model risks

Deception and scheming5 Misalignment and value divergence4 Dangerous agent actions8 Inappropriate refusal3 Hallucination and fabrication4

Defense type

Model hardening34 Inference-time intervention9 Detection and filtering35 Instruction–data separation38 Permissions and approval39 Monitoring and auditing20 Watermarking and provenance4

Impact

Harmful content37 Unauthorized actions122 Data and privacy leaks97 Output manipulation67 Availability and reliability6 Oversight failure9

System component

MCP and skills49 Memory36 RAG17 Guardrails and judges36 Monitors23 Reasoning chains14 Permissions and sandboxing46 Fine-tuning and open weights23 Vision25 Audio5 Image generation6 Embeddings6 Multimodal35

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Attack type：Prompt injection Attack type：Model tampering Attack type：Extraction and theft Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

InterpretabilityarXiv 2610.12361Oct 9
Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
arXiv
2610.12361
Published
Oct 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
- AttacksPrompt injection
- ComponentReasoning chains
AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.
This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
Paper analysisRead analysis
DefensesarXiv 2610.11942Oct 8
LGWM: Verifying GUI agent screen transitions with action-conditioned world models
Proposes LGWM, using an action-conditioned world model to verify GUI agent screen transitions.
arXiv
2610.11942
Published
Oct 8
Layer
Application layer
Setting
Browser and computer use
Evaluated models
LGWM
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2610.11634Oct 8
LTBD：用可学习信任边界分隔符防御提示注入
提出 LTBD，用可学习分隔符隔离可信指令与不可信数据
arXiv
2610.11634
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama3-8B-Instruct, Llama3.1-8B-Instruct, Falcon3-7B-Instruct and others4
- DefensesInstruction–data separation
- AttacksPrompt injection
AbstractLTBD 只训练四个分隔符嵌入。
LTBD 是一种不改基座权重的提示注入防御：只学习用来标出可信指令与不可信数据边界的四个 token 嵌入。
Paper analysisRead analysis
AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。
作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
Paper analysisRead analysis
DefensesarXiv 2610.10655Oct 8
Nullify：面向 LLM 遗忘的零空间激活引导免训练方法
提出零空间激活引导 Nullify，免训练擦除指定记忆并保持效用
arXiv
2610.10655
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Qwen3-8B
- DefensesInference-time intervention
- AttacksExtraction and theft
Paper analysisRead analysis
DefensesarXiv 2610.10345Oct 8
SLDR：通过选择性层恢复与动态路由防御恶意微调
提出 SLDR，用选择性层恢复与动态路由防御恶意微调
arXiv
2610.10345
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称 SLDR 能压低有害输出并保持下游效用。
SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。
Paper analysisRead analysis
AttacksarXiv 2610.09981Oct 7
研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题
提出利用路由元数据推断敏感话题的侧信道攻击
arXiv
2610.09981
Published
Oct 7
Layer
Infrastructure layer
Setting
LLM applications
Evaluated models
RouteLLM (BERT router), notdiamond-0001, Vela (vLLM Semantic Router)
- AttacksExtraction and theft
- TechniqueSide channels
Abstract论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
Paper analysisRead analysis
AttacksarXiv 2610.09973Oct 7
从期望危害到似然：LLM 智能体越狱的概率重构
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
arXiv
2610.09973
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
DefensesarXiv 2610.09935Oct 7
AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击
提出 AgentTracer，事后定位间接提示注入的注入点并重建攻击链
arXiv
2610.09935
Published
Oct 7
Layer
Application layer
Setting
AI Agent
- DefensesMonitoring and auditing
- AttacksPrompt injection
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
DefensesarXiv 2610.09793Oct 7
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
arXiv
2610.09793
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
Paper analysisRead analysis
DefensesarXiv 2610.09469Oct 7
Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents
提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响
arXiv
2610.09469
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentVision
AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。
Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。
Paper analysisRead analysis
AttacksarXiv 2610.09264Oct 7
研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
arXiv
2610.09264
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
- AttacksPrompt injection
- TechniqueAutomated search
AbstractPackHallu 诱导规则文件换包。
PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.09004Oct 7
研究：去除有害信息不足以证明开源权重模型的抗篡改能力
论证发布时互信息不能认证开源权重抗微调恢复
arXiv
2610.09004
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。
作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。
Paper analysisRead analysis
InterpretabilityarXiv 2610.09000Oct 7
研究定位 LLaMA-2-7B-Chat 安全敏感参数
定位安全敏感参数并稀疏改动权重以削弱安全对齐
arXiv
2610.09000
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaMA-2-7B-Chat
- AttacksModel tampering
- RiskInappropriate refusal
Paper analysisRead analysis
AttacksarXiv 2610.08951Oct 7
ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
arXiv
2610.08951
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
- AttacksPrompt injection
- TechniqueAutomated search
AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。
ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
Paper analysisRead analysis
DefensesarXiv 2610.08773Oct 7
AdvSim2Real 用任务与注入对手共同演化训练网页智能体
提出 AdvSim2Real，协同训练网页智能体抵御页面注入
arXiv
2610.08773
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-4B
- DefensesModel hardening
- AttacksPrompt injection
Paper analysisRead analysis
DefensesarXiv 2610.08678Oct 7
研究揭示投机解码的安全代价并提出 SecureSD 加固方法
测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证
arXiv
2610.08678
Published
Oct 7
Layer
Model layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-32B, Llama-3.1-8B-Instruct and others6
- DefensesInference-time intervention
- AttacksJailbreaks
Abstract有损推测解码的早期偏离更快抬高越狱与注入风险。
作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

LGWM: Verifying GUI agent screen transitions with action-conditioned world models

LTBD：用可学习信任边界分隔符防御提示注入

An exploration of attacks on AI agent systems

Nullify：面向 LLM 遗忘的零空间激活引导免训练方法

SLDR：通过选择性层恢复与动态路由防御恶意微调

研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题

从期望危害到似然：LLM 智能体越狱的概率重构

AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击

研究：多向量视觉文档索引可被反演还原页面内容

用时序逻辑监控工具 Agent

Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

WebMirage hijacks visual web agents' browser operations with adversarial images

P-VMI：对抗图像经 KV cache 持续影响多轮对话

研究：去除有害信息不足以证明开源权重模型的抗篡改能力

研究定位 LLaMA-2-7B-Chat 安全敏感参数

ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

AdvSim2Real 用任务与注入对手共同演化训练网页智能体

研究揭示投机解码的安全代价并提出 SecureSD 加固方法