Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Training data Attack surface / entry point：Distribution channels System component：Memory System component：Embeddings System component：Multimodal Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
AttacksarXiv 2610.05453Oct 5
研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私
提出 PLW，用微调把先前对话敏感触发编码进后续生成图像
arXiv
2610.05453
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
OmniGen2, BAGEL-7B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。
Paper analysisRead analysis
DefensesarXiv 2610.02861Oct 2
论文提出在 Kubernetes 上保护 AI Agent 的七层纵深防御框架与参考架构
提出 Kubernetes 运维智能体的七层纵深防御框架与参考架构
arXiv
2610.02861
Published
Oct 2
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract把运维智能体当不可信租户，用七层控制在完全攻破假设下约束行动。
把 Kubernetes 上的运维智能体当作不可信租户，在假定提示注入已完全控制其工具选择的前提下，用基础设施重建数据面与控制面的边界。要解决的是：智能体读日志、注解、工单或 MCP 工具描述时，这些内容可以变成它带着自身凭据执行的命令。模型对齐和分类器只降低概率。
Paper analysisRead analysis
DefensesarXiv 2609.39548Sep 30
NDDL：用正常扩散动力学为文生图模型做后门防御
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
arXiv
2609.39548
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentImage generation
AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。
NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
Paper analysisRead analysis
AttacksarXiv 2609.39047Sep 30
BadAction：通过动作引导触发器对交互式视频生成模型实施后门攻击
提出 BadAction，通过动作触发器给交互式视频生成植入后门
arXiv
2609.39047
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Astra (Wan2.1-T2V-1.3B)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34092Sep 28
机器遗忘在 ASR 中是否有效：arXiv 论文评估现有算法与评测工具
arXiv
2609.34092
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
E-Branchformer
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentAudio
Abstract梯度上升类方法更接近简单评测下的重训参照，复杂方法会被知情攻击认出，多说话人更差。
Paper analysisRead analysis
DefensesarXiv 2609.28239Sep 23
ODPure：通过集成破坏共识实现目标检测后门净化
提出 ODPure，在输入阶段用腐蚀重建与共识净化目标检测后门
arXiv
2609.28239
Published
Sep 23
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
YOLOv5, Faster R-CNN
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2609.07048Sep 7
FreqDoor：面向视觉语言模型的频域后门攻击
提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门
arXiv
2609.07048
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentVision
AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。
FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。
Paper analysisRead analysis
DefensesarXiv 2609.06346Sep 6
面向后门攻击下持续学习的鲁棒动态扩展：净化与选择性恢复
提出持续学习下的净化与选择性恢复框架，抵御逐任务训练投毒后门
arXiv
2609.06346
Published
Sep 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ViT-B/16
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentVision
Abstract作者报告任务内净化与恢复可配合动态专家防御后门，但保证依赖分离条件。
这是一项面向持续图像分类的后门防御研究：模型只使用当前任务数据，同时需要保留过去知识并避免学习恶意监督。
Paper analysisRead analysis
DefensesarXiv 2609.03139Sep 3
TRIM：面向多种后门触发器的黑盒检测与净化方法
提出 TRIM，在黑盒推理时定位并净化图像后门区域
arXiv
2609.03139
Published
Sep 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ResNet-50
- DefensesInference-time intervention
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2609.04260Sep 2
GhostWord：针对自动语音识别的细粒度后门攻击
提出 GhostWord 词级触发后门，对自动语音识别做数据投毒
arXiv
2609.04260
Published
Sep 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Whisper-Small, Whisper-Medium, MMS and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2608.24354Aug 25
RACER：面向多模态大模型后门的区域感知一致性修复框架
提出 RACER，用区域感知一致性对抗微调去除多模态大模型后门
arXiv
2608.24354
Published
Aug 25
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen2-VL-7B, Qwen2.5-VL-7B
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2607.13336Jul 15
TC-UAP：针对图像转视频与微调定制的通用视频保护方法
提出 TC-UAP，用身份级多帧扰动保护视频免被定制复现身份
arXiv
2607.13336
Published
Jul 15
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LTX-2.3, Wan2.2-5B
- ComponentVideo
AbstractTC-UAP 以可复用的时间一致扰动干扰两类定制共用的 VAE 隐空间。
作者要解决的是：发布前如何给视频加不可见扰动，使片段既不能被拿去微调视频扩散模型，也不能被抽帧做 image-to-video。
Paper analysisRead analysis
AttacksarXiv 2606.09499Jun 8
研究者提出针对世界模型的机器人学习管线投毒攻击
提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略
arXiv
2606.09499
Published
Jun 8
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentVideo
Abstract只改视频帧经世界模型投毒。
只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。
Paper analysisRead analysis
DefensesarXiv 2603.12644Mar 13
Revealing security threats and defense architectures for autonomous agents: an OpenClaw case study
Reviews threats to autonomous agents and proposes a full-lifecycle defense blueprint, FASA
arXiv
2603.12644
Published
Mar 13
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractUsing OpenClaw as an example, it divides risks into three layers and uses FASA to describe defense from input to system execution.
This is a threat review and defense architecture report using OpenClaw as a case study, not a scored attack or defense evaluation.
Paper analysisRead analysis
DefensesarXiv 2603.11619Mar 12
Taming OpenClaw: Security Analysis and Mitigation of Threats in Autonomous LLM Agents
Proposes a defense-in-depth aligned with the five stages to mitigate cross-stage threats to autonomous agents
arXiv
2603.11619
Published
Mar 12
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentMCP and skills
AbstractThis is a lifecycle threat analysis and layered mitigation design for OpenClaw, with the cases serving as qualitative evidence.
This is a lifecycle threat analysis of OpenClaw, accompanied by a set of layered mitigation designs. The problem addressed is: when autonomous agents connect instant messaging, persistent memory, third-party plugins, and high-privilege execution, attacks are no longer limited to single-turn jailbreaks but can compound across multiple stages from initialization to execution. The authors argue that defenses hardening only individual interfaces cannot stop such cross-temporal attacks.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2511.18921Nov 24, 2025
BackdoorVLM：面向视觉语言模型后门攻击与防御的基准
提出 BackdoorVLM 基准，评测视觉语言模型微调中的后门攻击与防御
arXiv
2511.18921
Published
Nov 24, 2025
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen2.5-VL-7B
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
AbstractBackdoorVLM 统一评测 VLM 后门与防御：含文本触发在低投毒率下更易激活，现有防御跨类型不稳定。
BackdoorVLM 是作者提出的 VLM 后门攻击与防御评测基准，作者称它是首个此类综合基准。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop