Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 10 papers

Filter3

Attack type

Jailbreaks3 Prompt injection3 Detection evasion3

Defense type

Detection and filtering10

Impact

Harmful content3 Output manipulation3

System type

Models and APIs5 LLM applications3

Attack surface / entry point

User input32 Web pages and interfaces6 Documents and messages6 Tool responses11 Tool and skill descriptions5 Retrieval corpus3 Inter-agent messages3 Images, audio and video10

Layer

Prompt layer4 Application layer5

System component

Guardrails and judges10 Vision9 Image generation3 Multimodal13

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Defense type：Detection and filtering Attack surface / entry point：Images, audio and video System component：Guardrails and judges Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.07939Oct 6
CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it
提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别
arXiv
2610.07939
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C2P-CLIP, ForgeLens, D3-Im and others10
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。
Paper analysisRead analysis
DefensesarXiv 2610.05870Oct 5
MBZUAI 提出可校准的真实图像认证方法
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
arXiv
2610.05870
Published
Oct 5
Layer
Application layer
Setting
LLM applications
Attacker
White-box
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentImage generation
Abstract论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
Paper analysisRead analysis
DefensesarXiv 2609.36562Sep 29
ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
arXiv
2609.36562
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ThinkingGuard（Qwen3-VL-8B-Instruct）
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。
这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。
Paper analysisRead analysis
DefensesarXiv 2609.10613Sep 8
后验重加权框架解释并缓解多模态大模型上下文越狱
用后验重加权解释多模态上下文越狱，并提出风险门控的良性示例注入防御
arXiv
2609.10613
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others8
- DefensesInstruction–data separation
- AttacksJailbreaks
- ComponentVision
Abstract后验重加权解释上下文越狱的缩放，并支持风险门控的良性示例防御。
Zhang 等把多模态 ICL 越狱写成对齐模型在安全与有害隐模式之间的推理时后验漂移，并据此做风险门控防御。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05535Sep 2
Mind2Web-Injection：面向网页 Agent 视觉提示注入护栏的证据对齐评测
提出 Mind2Web-Injection 评测网页 Agent 视觉注入护栏
arXiv
2609.05535
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-5.6-luna, Qwen3-VL-32B, Qwen3-VL-8B and others6
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract作者称检测、定位和反事实响应在六个 VLM 上可分开。
Mind2Web-Injection 用来检查网页截图护栏的判决是否对齐到该用的画面证据。。
Paper analysisRead analysis
DefensesarXiv 2608.12876Aug 13
SPARED：用对抗编辑数据训练基于推理的 AI 生成图像检测器
提出 SPARED，用对抗编辑数据训练基于推理的 AI 生成图像检测器
arXiv
2608.12876
Published
Aug 13
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen3.5-9B
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractSPARED 用防捷径的编辑对抗环训练 9B 推理检测器。
SPARED 是一套用于可解释 AI 生成图像检测的攻防强化学习流程，报告模型是 Qwen3.5-9B 上的第三轮防御器。
Paper analysisRead analysis
DefensesarXiv 2603.14707Mar 16
视觉混淆代理：利用与防御计算机使用智能体的感知失效
提出进程外双通道对比分类，拦截计算机使用智能体的错误点击
arXiv
2603.14707
Published
Mar 16
Layer
Application layer
Setting
Browser and computer use
Evaluated models
multi-modal-embed-small
- DefensesDetection and filtering
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentGuardrails and judges
Abstract感知错误可被屏幕像素对调利用。
作者把 CUA 的感知失败写成安全漏洞visual confused deputy：智能体按看错的屏幕授权 click(x,y)，真实落点与它以为的元素不一致。
Paper analysisRead analysis
DefensesarXiv 2603.01544Mar 2
RA-Det：利用鲁棒性不对称检测 AI 生成图像
提出 RA-Det，利用鲁棒性不对称检测 AI 生成图像
arXiv
2603.01544
Published
Mar 2
Layer
Application layer
Setting
LLM applications
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentGuardrails and judges
AbstractRA-Det 把扰动下特征漂移差变成检测信号，平均 ACC 高于表中通用检测器，但不是每行最高。
RA-Det 是合成图像检测器，用扰动下的表示稳定性差异代替外观痕迹。
Paper analysisRead analysis
AttacksarXiv 2601.05339Jan 9
多模态大语言模型的多轮越狱攻击与 FragGuard 防御
提出多轮多模态越狱，并用 FragGuard 拦截有害响应
arXiv
2601.05339
Published
Jan 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVa-1.6 (7B), LLaVa-1.6 (13B), Qwen-2-7B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2510.01354Oct 2, 2025
WAInjectBench 系统评测网页 Agent 的提示注入检测方法
提出 WAInjectBench 评测网页 Agent 的提示注入检测
arXiv
2510.01354
Published
Oct 2, 2025
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, Mistral-7B-Instruct-v0.1, Llama-Prompt-Guard-2-86M and others8
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractWAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。
WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop