Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 LogInject 框架，评测日志分析中的被动提示注入及缓解
Published Jul 16
Evaluated models GPT-4o , Claude 3.5 Sonnet , Llama-3-70B-Instruct Abstract 论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
Published Jul 1
Evaluated models Qwen2.5-32B-Instruct , Llama-3.3-70B-Instruct , QwQ-32B and others5 Abstract 顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
提出 Ghostwriter 攻击，用伪权威证据条件注入操纵模型观点
Published Jun 4
Evaluated models GPT-4o , Claude-3.7-Sonnet , DeepSeek-V3 and others10 Abstract 作者称攻击未被消除。Ghostwriter 是一种针对上下文窗口的观点引导攻击：把误导陈述改写成伪权威文本，再在相关查询中让目标模型把该观点写进回答。
提出 PIDP-Attack，用查询后缀与语料投毒操纵 RAG 回答
Published Mar 26
Evaluated models qwen/qwen2.5-7b-instruct , qwen/qwen2-7b-instruct , meta/llama-3.1-8b-instruct and others8 提出 LAAF，分阶段自动攻击智能体系统的 LPCI 漏洞
Published Mar 18
Evaluated models gemini-2.0-flash-001 , claude-3-haiku-20240307 , meta-llama/llama-3.1-70b-instruct and others5 Abstract LAAF does LPCI red teaming with taxonomy plus stage seeding.The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
Attacks arXiv 2507.10457 · Jul 15, 2025 提出 LPCI，把延迟条件载荷写入记忆与检索库以跨会话触发
Published Jul 15, 2025
Evaluated models ChatGPT , Claude , LLaMA3 and others8 Abstract 作者定义 LPCI。作者把LPCI 定义为针对智能体逻辑执行、记忆留存和工具集成的跨阶段漏洞类，而不是单次输入上的提示改写。
You have reached the end