Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool and skill descriptions Attack surface / entry point：Images, audio and video System component：Memory System component：Audio System component：Embeddings Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06339Oct 5
BabelFake：面向多语言音视频 DeepFake 检测的基准数据集
构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
arXiv
2610.06339
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SpeechForensics, AVH-Align, (B)RAVEn
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentAudio
AbstractBabelFake 为五语同意采集基准。
BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.07005Oct 4
研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因
遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联
arXiv
2610.07005
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2-Audio-7B-Instruct, LLaMA-Omni
- AttacksJailbreaks
- ComponentAudio
AbstractAdvWave-P 的八频带排序与能量相关。
这是对加性音频越狱 AdvWave-P 的频率与解码器深度审计，受害模型主要是 Qwen2-Audio-7B-Instruct，不提出新攻击。
Paper analysisRead analysis
DefensesarXiv 2610.04235Oct 3
Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架
提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
arXiv
2610.04235
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-TTS (0.6B), Dots.tts (2B)
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2610.02861Oct 2
论文提出在 Kubernetes 上保护 AI Agent 的七层纵深防御框架与参考架构
提出 Kubernetes 运维智能体的七层纵深防御框架与参考架构
arXiv
2610.02861
Published
Oct 2
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract把运维智能体当不可信租户，用七层控制在完全攻破假设下约束行动。
把 Kubernetes 上的运维智能体当作不可信租户，在假定提示注入已完全控制其工具选择的前提下，用基础设施重建数据面与控制面的边界。要解决的是：智能体读日志、注解、工单或 MCP 工具描述时，这些内容可以变成它带着自身凭据执行的命令。模型对齐和分类器只降低概率。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.03153Oct 2
EvoRiskBench: An evolutionary benchmark for runtime security risks of workspace agents
构建 EvoRiskBench 评测工作区 Agent 的运行时安全风险
arXiv
2610.03153
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Sol, DeepSeek-V4-Pro-0813, Claude Opus 5
- AttacksPrompt injection
- ComponentMCP and skills
Abstract论文构建了工作空间智能体运行时风险基准 EvoRiskBench，发现高执行力智能体在 IPI 下面临较高安全风险。
Paper analysisRead analysis
DefensesarXiv 2610.01184Oct 1
ReCast：在固定媒体接口下保护多模态推理的隐私框架
提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
arXiv
2610.01184
Published
Oct 1
Layer
Application layer
Setting
LLM applications
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2609.29287Sep 24
AEGIS：用内部信号在中间层拦截大型音频语言模型越狱
提出 AEGIS，用中层内部信号选择性激活后层适配器拦截音频越狱
arXiv
2609.29287
Published
Sep 24
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-Audio-7B, VITA-1.5, Ultravox v0.5 and others6
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2609.27399Sep 23
GUARD：在 CosyVoice2 上做说话人身份遗忘以阻止重识别
提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别
arXiv
2609.27399
Published
Sep 23
Layer
Model layer
Setting
Models and APIs
Evaluated models
CosyVoice2-0.5B, F5-TTS, FireRedTTS
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentAudio
AbstractGUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。
GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。
Paper analysisRead analysis
DefensesarXiv 2609.27378Sep 23
PALS：面向全双工语音对话模型对抗鲁棒性的心理声学对齐潜空间平滑
提出 PALS，用潜空间平滑防御全双工语音对话的对抗扰动
arXiv
2609.27378
Published
Sep 23
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Moshi-style agent
- DefensesModel hardening
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2609.13889Sep 12
PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
arXiv
2609.13889
Published
Sep 12
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.09404Sep 9
MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测
用 MMPIBench 评测多模态提示注入对 Agent 框架的影响
arXiv
2609.09404
Published
Sep 9
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
Abstract论文提出 MMPIBench 评测多模态提示注入对智能体的影响，发现模型主导行为、尝试远超完成，音频通道缺乏防护。
Paper analysisRead analysis
AttacksarXiv 2609.04260Sep 2
GhostWord：针对自动语音识别的细粒度后门攻击
提出 GhostWord 词级触发后门，对自动语音识别做数据投毒
arXiv
2609.04260
Published
Sep 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Whisper-Small, Whisper-Medium, MMS and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.29647Aug 29
AgentKernel：面向 Agent 的可信原生操作系统内核
提出 AgentKernel，用四支柱强制中介 Agent 的输入、工具与记忆
arXiv
2609.29647
Published
Aug 29
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractAgentKernel 是四支柱智能体 OS 设计，安全论证未附带实测数字。
AgentKernel 是把安全做成组织原则的智能体 OS 架构，不是带跑分的攻防评测。
Paper analysisRead analysis
AttacksarXiv 2608.15578Aug 16
ARENA：面向大型音频语言模型的自动化红队框架
提出 ARENA 音频红队框架，自动构造文本安全且音频接地的越狱输入
arXiv
2608.15578
Published
Aug 16
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Audio Flamingo 3, Qwen2-Audio-7B-Instruct, MiMo-Audio-7B-Instruct and others4
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2607.14737Jul 16
GeoDetect：面向视觉语言预训练模型的几何对抗检测方法
提出 GeoDetect 以几何分数检测视觉语言预训练模型的对抗样本
arXiv
2607.14737
Published
Jul 16
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
CLIPViT (ViT-B/16), CLIPCNN (ResNet-50), ALBEF and others4
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentEmbeddings
AbstractGeoDetect 用几何分数检测 VLP 对抗样本。
GeoDetect 是面向视觉-语言预训练模型的对抗样本检测方法，用嵌入几何而不是任务 logits 区分干净样本与对抗样本。
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis
AttacksarXiv 2605.20519May 20
CodecAttack：在音频编解码器潜空间构造对抗扰动，绕过有损压缩防御
提出 CodecAttack，在编解码器隐空间构造可穿透有损压缩的对抗音频
arXiv
2605.20519
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-Audio-7B-Instruct, Audio Flamingo 3, Qwen2.5-Omni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2605.18168May 18
研究者提出声学干扰攻击 AIA，可通用越狱 10 个大型音频语言模型
提出声学干扰攻击 AIA，用良性音频潜语义越狱音频语言模型
arXiv
2605.18168
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen3-Omni, Qwen2.5-Omni, Qwen2-Audio and others10
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop