Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Code repositories and dependencies Attack surface / entry point：Weights and gradients System component：Guardrails and judges System component：Monitors Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2609.35659Sep 29
Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
AttacksarXiv 2609.22510Sep 19
特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent
提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse
arXiv
2609.22510
Published
Sep 19
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentGuardrails and judges
Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。
论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。
Paper analysisRead analysis
DefensesarXiv 2608.05578Aug 6
AMS 工具通过激活分析检测语言模型的安全训练改动
提出 AMS，用激活分离与方向相似度检测安全训练改动
arXiv
2608.05578
Published
Aug 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
- DefensesMonitoring and auditing
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。
AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
Paper analysisRead analysis
DefensesarXiv 2608.06422Aug 6
CMU 研究：分片判断可避免 LLM 监督失效并抵御对抗利用
提出分片监督，将评判标准分配给独立调用以抵御展示攻击
arXiv
2608.06422
Published
Aug 6
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Claude Opus 4.8, Claude Sonnet 4.6, Claude Opus 4.6 and others4
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract论文揭示决策负载是大模型监督的独立瓶颈，提出分片与辩论机制有效分离注意力与平衡证据，在多项高难度基准上实现稳健评判。
本文系统研究了大语言模型在执行多标准监督与评判时的决策负载瓶颈及其安全风险。
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2604.03890Apr 5
From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems
Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA
arXiv
2604.03890
Published
Apr 5
Layer
Training and data layer
Setting
Embodied systems and robotics, LLM applications
Evaluated models
Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract推理层后门传不到执行。
Paper analysisRead analysis
AttacksarXiv 2602.01658Feb 2
Efficient Adversarial Attacks on High-Dimensional Offline Bandits
提出三类攻击，训练前扰动奖励模型以劫持离线 bandit
arXiv
2602.01658
Published
Feb 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Image Reward, Aesthetic Model
- AttacksPoisoning and backdoors
- ComponentGuardrails and judges
Abstract公开奖励权重可被小扰动劫持离线 bandit，打乱日志只部分缓解。
作者研究离线 bandit 在奖励模型被事先改权重时，还会不会选出最优臂。
Paper analysisRead analysis
AttacksarXiv 2601.14310Jan 19
CORVUS：用 LoRA 伪装内部信号绕过单次幻觉检测器
提出 CORVUS，用 LoRA 伪装内部遥测以绕过幻觉检测器
arXiv
2601.14310
Published
Jan 19
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Vicuna-7B (v1.5), Llama-3-8B-Instruct and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMonitors
Abstract作者称内部遥测在自适应模型侧对抗下易被操纵，CORVUS 通过轻量适配器微调降低了多种幻觉检测器的效果。
Paper analysisRead analysis
AttacksarXiv 2509.05372Sep 4, 2025
研究：对抗性 bug 报告可诱导 LLM 自动程序修复系统生成不安全补丁
用对抗缺陷报告诱导自动程序修复系统生成不安全补丁
arXiv
2509.05372
Published
Sep 4, 2025
Layer
Application layer
Setting
coding agent
Evaluated models
claude-sonnet-4-20250514, o4-mini, GPT-4.1-mini and others8
- AttacksPrompt injection
- TechniqueRole-play and persuasion
- ComponentGuardrails and judges
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Impact

System type

Attack surface / entry point

Layer

System component

Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent

AMS 工具通过激活分析检测语言模型的安全训练改动

CMU 研究：分片判断可避免 LLM 监督失效并抵御对抗利用

Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails

From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems

Efficient Adversarial Attacks on High-Dimensional Offline Bandits

CORVUS：用 LoRA 伪装内部信号绕过单次幻觉检测器

研究：对抗性 bug 报告可诱导 LLM 自动程序修复系统生成不安全补丁