Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 140 papers
Filter3

Attack type

Jailbreaks237Prompt injection140Poisoning and backdoors39Model tampering4Extraction and theft53Detection evasion31Denial of service5Malicious use19

Attack technique

Automated search20Encoding and obfuscation7Defense-targeted9Dormant triggers9Selection manipulation3

Model risks

Deception and scheming4Misalignment and value divergence3Dangerous agent actions7

Defense type

Model hardening7Inference-time intervention4Detection and filtering24Instruction–data separation23Permissions and approval28Monitoring and auditing17

Impact

Harmful content8Unauthorized actions75Data and privacy leaks12Output manipulation31Oversight failure6

System type

Models and APIs11LLM applications9AI Agent122coding agent13science agent3web agent3Multi-agent systems12

Attacker access

Black-box8

Attack surface / entry point

User input69Web pages and interfaces63Documents and messages68Tool responses99Tool and skill descriptions45Code repositories and dependencies18Retrieval corpus20Memory writes27Inter-agent messages19Images, audio and video19Distribution channels27

Layer

Prompt layer6Model layer5Application layer127

System component

MCP and skills21Memory19RAG5Guardrails and judges23Monitors19Reasoning chains4Permissions and sandboxing29Vision3Multimodal3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Attack type：Prompt injectionAttack surface / entry point：User inputAttack surface / entry point：Tool responsesClear all

Another 265papers do not have category tags yet and are not included in filtered results.

  1. InterpretabilityarXiv 2610.12361

    Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

    Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.

    arXiv
    2610.12361
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
    AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.

    This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

    Paper analysisRead analysis
  2. AttacksarXiv 2610.12524

    An exploration of attacks on AI agent systems

    重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择

    arXiv
    2610.12524
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
    Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。

    作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。

    Paper analysisRead analysis
  5. DefensesarXiv 2610.09793

    用时序逻辑监控工具 Agent

    提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链

    arXiv
    2610.09793
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    Black-box
    Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。

    这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.08951

    ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

    提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞

    arXiv
    2610.08951
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
    AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。

    ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。

    Paper analysisRead analysis
  8. DefensesarXiv 2610.08678

    研究揭示投机解码的安全代价并提出 SecureSD 加固方法

    测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证

    arXiv
    2610.08678
    Published
    Layer
    Model layer
    Setting
    AI Agent
    Attacker
    Black-box
    Evaluated models
    Qwen3-8B, Qwen3-32B, Llama-3.1-8B-Instruct and others6
    Abstract有损推测解码的早期偏离更快抬高越狱与注入风险。

    作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。

    Paper analysisRead analysis
  9. DefensesarXiv 2610.07657

    DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

    实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击

    arXiv
    2610.07657
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
    AbstractDEFER 把确定性检查放在 judge 之前。

    DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。

    Paper analysisRead analysis
  12. Evaluation and benchmarksarXiv 2610.07089

    研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹

    提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视

    arXiv
    2610.07089
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Gemma 4 26B-A4B, Qwen3.6 27B, Qwen3.5 27B and others12

    Abstract统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。

    Paper analysisRead analysis
  13. DefensesarXiv 2610.05640

    研究揭示 CaMeL 防护在多智能体系统中失效并提出 multi-CaMeL

    提出 multi-CaMeL，在智能体调用边界隔离可信指令与非可信数据

    arXiv
    2610.05640
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Claude Fable 5, GPT-5.5, GPT-4.1 and others6

    Abstract论文针对多智能体中单体防御不组合的边界清洗问题，提出 multi-CaMeL 协议彻底阻断了 MultiAgentDojo 上的注入攻击。

    Paper analysisRead analysis
  14. InterpretabilityarXiv 2610.05295

    研究用因果追踪区分间接提示注入中的可读信号与有效干预

    用因果追踪区分间接提示注入中的角色可读性与有效干预

    arXiv
    2610.05295
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen-2.5-7B, Qwen-2.5-1.5B, Llama-3.1-8B and others8
    Abstract作者称源角色先于强工具选择效应可读，有效编辑还取决于位置、长度和方向来源。

    在权重固定的白盒模型上，源角色可以先被读出。沿相关方向的编辑是否改变行为，要在目标位点上另测。。

    Paper analysisRead analysis
  15. DefensesarXiv 2610.05163

    Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

    提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入

    arXiv
    2610.05163
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
    Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。

    本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。

    Paper analysisRead analysis
  16. AttacksarXiv 2610.04985

    研究揭示 Jev 作为应用决策层的安全与隐私风险

    评估应用决策层的输入注入与隐私推断风险

    arXiv
    2610.04985
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box, Gray-box
    Evaluated models
    Jev, NanoJev
    AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。

    Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。

    Paper analysisRead analysis
  19. DefensesarXiv 2610.04412

    论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性

    提出检测、结构化与 GSPO 流程，降低共识生成的提示注入错位

    arXiv
    2610.04412
    Published
    Layer
    Application layer
    Setting
    LLM applications, Multi-agent systems
    Evaluated models
    LLaMA-2 7B, LLaMA-3 8B, GPT 3.5 Turbo and others14
    Abstract三章依次做个体偏好预测、政党知识图谱审议，以及共识生成对提示注入的脆弱性与一条防御流程。

    这是一篇把 LLM 数字孪生放进增强民主的博士论文，分个体表示、政党聚合和共识生成的提示注入三章。

    Paper analysisRead analysis
Load more