Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 87 papers

Filter3

System component

MCP and skills10 Memory11 RAG3 Guardrails and judges20 Monitors11 Reasoning chains3 Permissions and sandboxing11 Vision17 Multimodal18

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Attack type：Prompt injection Attack surface / entry point：User input Attack surface / entry point：Images, audio and video Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

InterpretabilityarXiv 2610.12361Oct 9
Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
arXiv
2610.12361
Published
Oct 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
- AttacksPrompt injection
- ComponentReasoning chains
AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.
This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
Paper analysisRead analysis
AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。
作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
Paper analysisRead analysis
AttacksarXiv 2610.09973Oct 7
从期望危害到似然：LLM 智能体越狱的概率重构
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
arXiv
2610.09973
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
DefensesarXiv 2610.08678Oct 7
研究揭示投机解码的安全代价并提出 SecureSD 加固方法
测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证
arXiv
2610.08678
Published
Oct 7
Layer
Model layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-32B, Llama-3.1-8B-Instruct and others6
- DefensesInference-time intervention
- AttacksJailbreaks
Abstract有损推测解码的早期偏离更快抬高越狱与注入风险。
作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07089Oct 5
研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹
提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视
arXiv
2610.07089
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma 4 26B-A4B, Qwen3.6 27B, Qwen3.5 27B and others12
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。
Paper analysisRead analysis
AttacksarXiv 2610.04985Oct 4
研究揭示 Jev 作为应用决策层的安全与隐私风险
评估应用决策层的输入注入与隐私推断风险
arXiv
2610.04985
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box, Gray-box
Evaluated models
Jev, NanoJev
- AttacksPrompt injection
- TechniqueRole-play and persuasion
AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。
Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
Paper analysisRead analysis
DefensesarXiv 2610.04504Oct 3
论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证
提出 VAL 框架，并用确认门与参数沙箱约束智能体高风险工具调用
arXiv
2610.04504
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-chat, Meta Llama 3.1 8B, Kimi
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.04412Oct 3
论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性
提出检测、结构化与 GSPO 流程，降低共识生成的提示注入错位
arXiv
2610.04412
Published
Oct 3
Layer
Application layer
Setting
LLM applications, Multi-agent systems
Evaluated models
LLaMA-2 7B, LLaMA-3 8B, GPT 3.5 Turbo and others14
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract三章依次做个体偏好预测、政党知识图谱审议，以及共识生成对提示注入的脆弱性与一条防御流程。
这是一篇把 LLM 数字孪生放进增强民主的博士论文，分个体表示、政党聚合和共识生成的提示注入三章。
Paper analysisRead analysis
AttacksarXiv 2610.03857Oct 3
研究者提出 EviLLM 攻击：通过被入侵账号向 AI 代码生成流程注入漏洞
提出 EviLLM，经账户指令或插件向代码生成流程注入漏洞
arXiv
2610.03857
Published
Oct 3
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, Llama 3.2 (3B)
- AttacksPrompt injection
- TechniqueDefense-targeted
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.04378Oct 3
COPEX：面向 MCP 智能体的受控攻击评测基准发布
提出 COPEX 基准，评测 MCP 智能体对多入口攻击的抵抗力
arXiv
2610.04378
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.7, Claude Sonnet 4.6, GPT-5.5 and others9
- AttacksPrompt injection
- ComponentMCP and skills
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.02413Oct 2
研究：分类后缀可提升激活探针的分布外恶意输入检测
用分类后缀提升激活探针对分布外恶意输入的检测
arXiv
2610.02413
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。
用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
Paper analysisRead analysis
DefensesarXiv 2610.00400Sep 30
DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift
提出 DART，用去噪表征转移检测多轮智能体攻击并注入提醒
arXiv
2610.00400
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-14B, Qwen3-32B and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39146Sep 30
MADBench：多智能体辩论安全性评测基准发布
提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响
arXiv
2609.39146
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gpt-4o, GPT-5, GPT-6 Astra
- AttacksPrompt injection
- ComponentRAG
AbstractMADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。
MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。
Paper analysisRead analysis
InterpretabilityarXiv 2609.37737Sep 29
研究用因果激活修补定位模型服从提示注入指令的决策层
用因果激活修补定位模型服从提示注入的决策层
arXiv
2609.37737
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3-14B, Qwen3-32B and others7
- AttacksPrompt injection
Abstract合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。
这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。。
Paper analysisRead analysis
AttacksarXiv 2609.38270Sep 29
VirusCascade：劫持 LLM 推荐智能体的协同反思机制
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
arXiv
2609.38270
Published
Sep 29
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
AgentCF, AgentSEQ, AgentRAG and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。
VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
Paper analysisRead analysis
InterpretabilityarXiv 2609.37040Sep 29
研究：自然语言自动编码器中哪些 token 最值得审计
比较用于审计提示注入与隐瞒的 token 位置选择信号
arXiv
2609.37040
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B, Gemma-3-12B, Gemma-3-27B and others4
- AttacksPrompt injection
- RiskDeception and scheming
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

An exploration of attacks on AI agent systems

从期望危害到似然：LLM 智能体越狱的概率重构

WebMirage hijacks visual web agents' browser operations with adversarial images

P-VMI：对抗图像经 KV cache 持续影响多轮对话

研究揭示投机解码的安全代价并提出 SecureSD 加固方法

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹

研究揭示 Jev 作为应用决策层的安全与隐私风险

论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证

论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性

研究者提出 EviLLM 攻击：通过被入侵账号向 AI 代码生成流程注入漏洞

COPEX：面向 MCP 智能体的受控攻击评测基准发布

论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

研究：分类后缀可提升激活探针的分布外恶意输入检测

DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift

MADBench：多智能体辩论安全性评测基准发布

研究用因果激活修补定位模型服从提示注入指令的决策层

VirusCascade：劫持 LLM 推荐智能体的协同反思机制

研究：自然语言自动编码器中哪些 token 最值得审计