Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 17 papers
Filter3

Attack type

Prompt injection4Poisoning and backdoors3Detection evasion9

Attack technique

Automated search8Encoding and obfuscation4Defense-targeted4

Defense type

Detection and filtering3

Impact

Harmful content3Unauthorized actions5Output manipulation9

System type

Models and APIs28LLM applications12AI Agent17coding agent5

Attacker access

Black-box7

Attack surface / entry point

User input8Documents and messages3Tool and skill descriptions4

Layer

Prompt layer3Application layer13

System component

MCP and skills16Memory3RAG21Guardrails and judges17Reasoning chains3Fine-tuning and open weights4Vision6Embeddings7Multimodal7
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
System type：LLM applicationsSystem type：coding agentSystem component：Guardrails and judgesClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12292

    The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

    Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations

    arXiv
    2610.12292
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    LAYA-TD, LAYA-EN, LAYA-ML and others5

    AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.

    Paper analysisRead analysis
  3. AttacksarXiv 2610.10612

    PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

    提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器

    arXiv
    2610.10612
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    CISCO, HSS, AUDITOR and others8
    Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。

    这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.02432

    论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

    提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感

    arXiv
    2610.02432
    Published
    Layer
    Application layer
    Setting
    LLM applications, AI Agent
    Attacker
    Black-box
    Evaluated models
    Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
    Paper analysisRead analysis
  7. AttacksarXiv 2609.09798

    CS-Guard：首个面向代码生成安全的 LLM 护栏评测基准

    提出 CS-Guard 基准，评测代码生成护栏对虚构场景攻击的防御

    arXiv
    2609.09798
    Published
    Layer
    Prompt layer
    Setting
    coding agent
    Attacker
    Black-box
    Evaluated models
    CodeLlama-13B-Instruct, DeepSeekCoder-V2-Lite-16B, GPT-OSS-20B and others7

    Abstract论文提出了代码安全护栏基准 CS-Guard，评估发现现有护栏对虚构场景攻击和代码级恶意请求防御较弱。

    Paper analysisRead analysis
  8. AttacksarXiv 2608.09732

    ColluSkill 用跨技能组合绕过 Agent 技能扫描器

    提出 ColluSkill，用跨技能组合绕过 Agent 技能扫描器

    arXiv
    2608.09732
    Published
    Layer
    Application layer
    Setting
    coding agent
    Attacker
    Black-box, Gray-box
    Evaluated models
    GPT-5.5, DeepSeek-V4-Pro, GLM-5.2

    Abstract论文揭示了单技能孤立扫描的盲区，提出多技能链攻击 ColluSkill 与上下文防御 ChainGuard 并验证了有效性。

    Paper analysisRead analysis
  9. AttacksarXiv 2607.14493

    LogInject 框架披露 LLM 日志分析中的被动提示注入

    提出 LogInject 框架，评测日志分析中的被动提示注入及缓解

    arXiv
    2607.14493
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct

    Abstract论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。

    Paper analysisRead analysis
  10. AttacksarXiv 2606.13044

    研究者提出对抗性重新包装：不改科学内容仅调整表述即可拉高 AI 审稿分数

    提出对抗重构，仅改表述以拉高 AI 审稿分数

    arXiv
    2606.13044
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Claude Sonnet 4, Claude Sonnet 4.5, GPT-5-mini

    Abstract揭示 AI 审稿系统易受纯表述重构操纵，建议在部署前解耦科学与写作评价。

    Paper analysisRead analysis
  11. AttacksarXiv 2606.09700

    The researchers propose the HPAA attack: bypassing 13 content moderation systems with typographic visual cues

    提出 HPAA 攻击，用排版视觉线索绕过内容审核系统

    arXiv
    2606.09700
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    Llama-Guard-3-8B, Perspective API, ShieldGemma-2B and others13
    Abstract揭示了排版视觉线索与分词差异带来的审核盲区，HPAA 以极低查询实现近乎完全规避。

    这篇论文研究了人类视觉感知与大模型分词处理机制之间的差异所导致的内容审核漏洞。

    Paper analysisRead analysis
  12. AttacksarXiv 2605.26156

    BITE：用上下文赌博机操纵风格偏置攻击 LLM 评委

    提出 BITE，用上下文赌博机选择风格修改抬高 LLM 评委打分

    arXiv
    2605.26156
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    o3-mini, Gemini-2.5-Flash, Llama-3.3-70B-Instruct and others8
    AbstractBITE 用黑盒赌博机利用风格偏差抬分，作者称这对 LLM-as-a-judge 构成威胁。

    BITE 是黑盒风格操纵：在保持答案语义的同时，抬高 LLM 评审给出的分数。

    Paper analysisRead analysis
  14. AttacksarXiv 2604.03890

    From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems

    Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA

    arXiv
    2604.03890
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics, LLM applications
    Evaluated models
    Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4

    Abstract推理层后门传不到执行。

    Paper analysisRead analysis
  15. AttacksarXiv 2601.21360

    Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation

    提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分

    arXiv
    2601.21360
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    DeepSeek-V3.2, Qwen3-235B, GPT-OSS-120B and others9
    Abstract作者称 RLHF 的服从性使评分脱离代码。

    这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。

    Paper analysisRead analysis
  16. AttacksarXiv 2601.06884

    研究者提出改写式对抗攻击 PAA，可在不改变论文主张的情况下抬高 LLM 审稿评分

    提出保义释义攻击 PAA，抬高 LLM 审稿评分

    arXiv
    2601.06884
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, Gemini 2.5, Sonnet 4
    AbstractPAA 用保义释义抬高 LLM 审稿分。

    PAA 是对 LLM-as-a-Reviewer 的 black-box 攻击：只改写摘要，用评审分做 ICL 搜索，并用 BERTScore 与困惑度限制语义和自然度。

    Paper analysisRead analysis
You have reached the end