Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 15 papers
Filter4

Attack type

Jailbreaks7Prompt injection15Poisoning and backdoors34Detection evasion32Malicious use3

Attack technique

Gradient and representation optimization4Cross-modal payloads4

Impact

Unauthorized actions19Data and privacy leaks6Output manipulation15Oversight failure3

System type

Models and APIs10LLM applications21AI Agent38coding agent5web agent3Multi-agent systems8

Attack surface / entry point

User input6Code repositories and dependencies3Images, audio and video6

Layer

Prompt layer9Application layer4

System component

Vision5Multimodal6
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Attack type：Prompt injectionImpact：Output manipulationSystem type：Models and APIsSystem type：coding agentClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.09264

    研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

    提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包

    arXiv
    2610.09264
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
    AbstractPackHallu 诱导规则文件换包。

    PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  5. InterpretabilityarXiv 2609.37737

    研究用因果激活修补定位模型服从提示注入指令的决策层

    用因果激活修补定位模型服从提示注入的决策层

    arXiv
    2609.37737
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-4B, Qwen3-14B, Qwen3-32B and others7
    Abstract合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。

    这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.28613

    研究：提示注入可改变 Jev 决策模型的行动概率

    测量间接提示注入对类型化概率决策的动作劫持

    arXiv
    2609.28613
    Published
    Layer
    Application layer
    Setting
    Models and APIs
    Evaluated models
    jev-1.13.0
    Abstract封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。

    作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2609.04859

    MM-IFEval-Pro：面向视觉语言模型的多语言抗攻击指令遵循基准

    提出抗攻击多语言视觉指令遵循基准 MM-IFEval-Pro

    arXiv
    2609.04859
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-VL-8B-Instruct, InternVL3.5-8B, MiniCPM-V4.5 and others5
    AbstractMM-IFEval-Pro 以规则验证评测中英指令遵循与视觉劫持，GRPO 提高两基座平均分。

    MM-IFEval-Pro 是面向 VLM 的中英多模态指令遵循基准，并配有可用规则计算奖励的 GRPO 训练集。

    Paper analysisRead analysis
  8. AttacksarXiv 2609.01023

    Akrasia：针对推理型代码 LLM 的隐蔽后门攻击

    提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链

    arXiv
    2609.01023
    Published
    Layer
    Prompt layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7

    Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。

    Paper analysisRead analysis
  9. AttacksarXiv 2606.06244

    研究者提出 Ghostwriter 攻击：用伪造证据注入操纵 LLM 观点

    提出 Ghostwriter 攻击，用伪权威证据条件注入操纵模型观点

    arXiv
    2606.06244
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-4o, Claude-3.7-Sonnet, DeepSeek-V3 and others10
    Abstract作者称攻击未被消除。

    Ghostwriter 是一种针对上下文窗口的观点引导攻击：把误导陈述改写成伪权威文本，再在相关查询中让目标模型把该观点写进回答。

    Paper analysisRead analysis
  11. AttacksarXiv 2604.14604

    The AudioHijack framework achieves covert audio prompt injection against 13 speech large models

    提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入

    arXiv
    2604.14604
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    SpeechGPT, GLM-4-Voice, VITA-Audio and others15

    Abstract提出了 AudioHijack 框架，揭示了 LALM 对听觉提示注入的脆弱性与传统防御的局限。

    Paper analysisRead analysis
  13. AttacksarXiv 2602.15927

    研究者提出面向多轮对话的视觉记忆注入攻击 VMI

    提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息

    arXiv
    2602.15927
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-VL-7B-Instruct, Qwen3-VL-8B-Instruct, LLaVA-OneVision-1.5-8B-Instruct and others5
    AbstractVMI 让扰动图像在多轮 LVLM 中潜伏，作者称触发话题出现后仍可输出预定消息。

    VMI 是面向多轮 LVLM 的定向图像攻击：第三方发布带小扰动的图像，良性用户把它当作普通输入。

    Paper analysisRead analysis
You have reached the end