Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 15 papers
Filter3

Attack type

Prompt injection13

Attack technique

Gradient and representation optimization4Cross-modal payloads4

Defense type

Detection and filtering6Instruction–data separation3

Impact

Unauthorized actions8Output manipulation5

System type

LLM applications3AI Agent12web agent7Browser and computer use3

Attack surface / entry point

User input132Web pages and interfaces15Documents and messages13Tool responses13Tool and skill descriptions11Code repositories and dependencies4Retrieval corpus6Memory writes3Inter-agent messages3Images, audio and video118Training data16Weights and gradients11Distribution channels12

Layer

Application layer15

System component

MCP and skills7Memory8RAG4Guardrails and judges7Monitors5Reasoning chains3Permissions and sandboxing13Vision10Multimodal10
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Web pages and interfacesSystem component：Guardrails and judgesSystem component：MultimodalClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  2. DefensesarXiv 2610.09469

    Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

    提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响

    arXiv
    2610.09469
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
    AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。

    Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  4. Evaluation and benchmarksarXiv 2610.06898

    DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准

    用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性

    arXiv
    2610.06898
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7

    Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.22510

    特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent

    提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse

    arXiv
    2609.22510
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
    Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。

    论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2609.02316

    Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息

    构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御

    arXiv
    2609.02316
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8

    Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2609.05535

    Mind2Web-Injection：面向网页 Agent 视觉提示注入护栏的证据对齐评测

    提出 Mind2Web-Injection 评测网页 Agent 视觉注入护栏

    arXiv
    2609.05535
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-5.6-luna, Qwen3-VL-32B, Qwen3-VL-8B and others6
    Abstract作者称检测、定位和反事实响应在六个 VLM 上可分开。

    Mind2Web-Injection 用来检查网页截图护栏的判决是否对齐到该用的画面证据。。

    Paper analysisRead analysis
  8. Evaluation and benchmarksarXiv 2608.16824

    GEO-Flag：检测与测量面向生成式引擎优化的网页内容

    提出 GEOFlagBench 与 IPT，检测并测量生成式引擎优化网页

    arXiv
    2608.16824
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    ModernBERT-base, Qwen3-0.6B, Gemini-3.5-flash and others11
    AbstractGEOFlagBench 与 IPT 用于检测 GEO 页，并估计真实检索中的占比与引用可核验性。

    GEO-Flag 把页面级 GEO 检测做成可评测任务，并在发布的检索结果上估计被判为 GEO 的页面占比。

    Paper analysisRead analysis
  10. AttacksarXiv 2603.16960

    Adversarial attacks against modern vision-language models

    Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases

    arXiv
    2603.16960
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-7B, Qwen2.5-VL-7B
    AbstractThe authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.

    The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

    Paper analysisRead analysis
  11. DefensesarXiv 2602.10915

    Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System

    提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制

    arXiv
    2602.10915
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Gemini-3-Flash
    AbstractAura mediates structured interactions via the Agent Kernel.

    Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants..

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2510.01354

    WAInjectBench 系统评测网页 Agent 的提示注入检测方法

    提出 WAInjectBench 评测网页 Agent 的提示注入检测

    arXiv
    2510.01354
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, Mistral-7B-Instruct-v0.1, Llama-Prompt-Guard-2-86M and others8
    AbstractWAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。

    WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。

    Paper analysisRead analysis
  14. AttacksarXiv 2505.11717

    WebInject：通过网页像素扰动对多模态网页 Agent 实施提示注入

    提出 WebInject，用网页像素扰动诱导网页 Agent 执行指定动作

    arXiv
    2505.11717
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    UI-TARS-7B-SFT, Phi-4-multimodal-instruct, Llama-3.2-11B-Vision-Instruct and others5
    AbstractWebInject 经源码扰动原始像素。

    WebInject 是对 MLLM 网页智能体的环境提示注入：修改网页源码，使原始像素上的扰动经过显示器映射后，诱导智能体执行攻击者指定动作。

    Paper analysisRead analysis
  15. AttacksarXiv 2406.12814

    论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性

    提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性

    arXiv
    2406.12814
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, GPT-4V, Claude-3-Opus and others4

    Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。

    Paper analysisRead analysis
You have reached the end