Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 8 papers
Filter5

Attack type

Prompt injection6

Attack technique

Defense-targeted3Dormant triggers3

Defense type

Detection and filtering5

Impact

Unauthorized actions4

System type

LLM applications5AI Agent8coding agent0

Attack surface / entry point

User input19Web pages and interfaces4Documents and messages5Tool responses8Tool and skill descriptions10Code repositories and dependencies3Memory writes3Inter-agent messages3Images, audio and video3Distribution channels6

Layer

Application layer8

System component

MCP and skills14Memory45RAG3Guardrails and judges8Monitors8Reasoning chains4Permissions and sandboxing16Vision3Multimodal3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 247papers have no tags yet and are not included in filtered results.
System type：AI AgentSystem type：coding agentAttack surface / entry point：Documents and messagesAttack surface / entry point：Memory writesSystem component：Guardrails and judgesClear all

Another 247papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.07657

    DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

    实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击

    arXiv
    2610.07657
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
    AbstractDEFER 把确定性检查放在 judge 之前。

    DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。

    Paper analysisRead analysis
  2. DefensesarXiv 2609.30657

    研究者提出面向邮件 Agent 的攻击链建模提示注入检测框架

    提出面向邮件 Agent 的攻击链提示注入检测框架

    arXiv
    2609.30657
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Proposed framework
    Abstract攻击链与动作一致性融合改善了严格检测的平均 F1，但迁移、误报和攻击召回仍需分别看。

    这是一项邮件智能体提示注入防御的离线建模与评测研究：作者把攻击文本是否恶意、攻击是否推进到工具操作、最终参数是否达标分开处理。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.22510

    特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent

    提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse

    arXiv
    2609.22510
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
    Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。

    论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。

    Paper analysisRead analysis
  6. AttacksarXiv 2606.09084

    研究者提出 Context-Fractured Decomposition 攻击

    提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查

    arXiv
    2606.09084
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4.1, GPT-5-nano, Claude-3.5-Sonnet and others6
    AbstractCFD 用无指令 artifact 把越狱拆到跨会话。

    CFD针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。

    Paper analysisRead analysis
  7. DefensesarXiv 2603.04474

    从火花到烈火：建模并缓解基于 LLM 的多智能体协作中的错误级联

    提出谱系图治理层抑制多智能体协作的错误级联

    arXiv
    2603.04474
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Abstract单一种子可沿固定协作图固化为错误共识。

    作者把 LLM-MAS 中“小错变成集体错误共识”做成图上的可测传播，并用只改消息、不改拓扑的插件压低最终感染。

    Paper analysisRead analysis
  8. Evaluation and benchmarksarXiv 2510.01354

    WAInjectBench 系统评测网页 Agent 的提示注入检测方法

    提出 WAInjectBench 评测网页 Agent 的提示注入检测

    arXiv
    2510.01354
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, Mistral-7B-Instruct-v0.1, Llama-Prompt-Guard-2-86M and others8
    AbstractWAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。

    WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。

    Paper analysisRead analysis
You have reached the end