Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 48 papers
Filter4

Attack type

Jailbreaks216Prompt injection48Poisoning and backdoors52Model tampering33Extraction and theft62Detection evasion52Denial of service4Malicious use18

Attack technique

Gradient and representation optimization8Automated search3Cross-modal payloads8Dormant triggers3

Defense type

Detection and filtering6Instruction–data separation9Permissions and approval5

Impact

Unauthorized actions21Data and privacy leaks4Output manipulation15

System type

Models and APIs16LLM applications24AI Agent211coding agent33science agent3web agent24Browser and computer use8Multi-agent systems24

Attack surface / entry point

User input9Web pages and interfaces29Documents and messages6Tool responses9Retrieval corpus3Images, audio and video13

Layer

Prompt layer9Model layer4Application layer33

System component

Guardrails and judges6Permissions and sandboxing5Vision15Multimodal16
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Attack type：Prompt injectionSystem type：Models and APIsSystem type：web agentSystem type：Browser and computer useClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. InterpretabilityarXiv 2610.12361

    Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

    Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.

    arXiv
    2610.12361
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
    AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.

    This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.09469

    Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

    提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响

    arXiv
    2610.09469
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
    AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。

    Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  8. DefensesarXiv 2610.03073

    SecJev：为 System One 决策模型引入安全专业知识

    提出 SecJev，用场景加权训练把决策模型适配为安全类型化判断

    arXiv
    2610.03073
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    SecJev-0.8B, SecJev-2B, SecJev-4B and others4
    AbstractSecJev 用共享打分器做安全决策，0.8B 的 task-macro 超过 Kev-9B。

    SecJev 是 0.8B 到 9B 的安全决策模型族，作者称据其所知是首个面向安全的 Jev-like 家族。

    Paper analysisRead analysis
  9. DefensesarXiv 2610.02413

    研究：分类后缀可提升激活探针的分布外恶意输入检测

    用分类后缀提升激活探针对分布外恶意输入的检测

    arXiv
    2610.02413
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
    Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。

    用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。

    Paper analysisRead analysis
  10. DefensesarXiv 2610.03089

    COBRA: A Dual-LLM Architecture for Defending Computer-Using Agents Against Branch-Jumping Attacks

    提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击

    arXiv
    2610.03089
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    gpt-5, UI-TARS-1.5-7B, claude-sonnet-5 and others6

    Abstract提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。

    Paper analysisRead analysis
  12. InterpretabilityarXiv 2609.37737

    研究用因果激活修补定位模型服从提示注入指令的决策层

    用因果激活修补定位模型服从提示注入的决策层

    arXiv
    2609.37737
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-4B, Qwen3-14B, Qwen3-32B and others7
    Abstract合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。

    这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。。

    Paper analysisRead analysis
  14. Evaluation and benchmarksarXiv 2610.06898

    DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准

    用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性

    arXiv
    2610.06898
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7

    Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。

    Paper analysisRead analysis
  16. Evaluation and benchmarksarXiv 2609.29429

    Jev 被用于零样本检测十类对齐失败，中位 AUROC 达 0.886

    提出 RLCDAlignBench，零样本检测多种对齐失败

    arXiv
    2609.29429
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Jev (jev-1.13.0)
    Abstract一次通用问题已能给多数对齐失败排序，大的误差来自状态和标签。

    RLCDAlignBench 测量用强化学习做校准决策的 Jev，能否当作对齐失败的零样本检测器。

    Paper analysisRead analysis
  17. AttacksarXiv 2609.28613

    研究：提示注入可改变 Jev 决策模型的行动概率

    测量间接提示注入对类型化概率决策的动作劫持

    arXiv
    2609.28613
    Published
    Layer
    Application layer
    Setting
    Models and APIs
    Evaluated models
    jev-1.13.0
    Abstract封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。

    作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。

    Paper analysisRead analysis
  18. Evaluation and benchmarksarXiv 2609.19140

    AgentLSD：在对抗性任务污染下评测 AI 安全 Agent

    评测安全 Agent 在对抗性任务污染下的解题成功与开销

    arXiv
    2609.19140
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Gemma-4 31B, DeepSeek-V4 Flash, GPT-OSS 120B and others6
    AbstractAgentLSD 用配对 web CTF 表明，欺骗性环境证据会改变安全智能体的解题率与工作量。

    AgentLSD 是一个对照框架，用来测量安全智能体在任务本身不变时，对对抗性任务污染的反应。

    Paper analysisRead analysis
  20. Evaluation and benchmarksarXiv 2609.04859

    MM-IFEval-Pro：面向视觉语言模型的多语言抗攻击指令遵循基准

    提出抗攻击多语言视觉指令遵循基准 MM-IFEval-Pro

    arXiv
    2609.04859
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-VL-8B-Instruct, InternVL3.5-8B, MiniCPM-V4.5 and others5
    AbstractMM-IFEval-Pro 以规则验证评测中英指令遵循与视觉劫持，GRPO 提高两基座平均分。

    MM-IFEval-Pro 是面向 VLM 的中英多模态指令遵循基准，并配有可用规则计算奖励的 GRPO 训练集。

    Paper analysisRead analysis
Load more