DefensesarXiv 2609.02127
论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史
提出类型化溯源与断言护栏，约束持久 Agent 释放自传断言
- arXiv
- 2609.02127
- Published
- Layer
- Application layer
- Setting
- AI Agent
- DefensesWatermarking and provenance
- AttacksPoisoning and backdoors
- ComponentMemory
All papers
Filter5
Attack type
Attack technique
Impact
System type
Attack surface / entry point
Layer
System component
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
Another 232papers do not have category tags yet and are not included in filtered results.
- DefensesarXiv 2607.04379
PA-LLM-RAG 框架的知识库投毒攻击与防御
提出策略 RAG 的知识库投毒攻击与检测防御 CLD-KB
- arXiv
- 2607.04379
- Published
- Layer
- Application layer
- Setting
- LLM applications
- Evaluated models
- Llama 3.2
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentRAG
- AttacksarXiv 2606.04329
研究者系统研究 LLM 智能体记忆投毒攻击并提出 MPBench 基准
系统研究 LLM 智能体记忆投毒并构建基准 MPBench
- arXiv
- 2606.04329
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Meta-Llama-3.1-70B-Instruct, Deberta-v3-base, Llama-3.1-8B-Instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。
- AttacksarXiv 2605.28074
SilentRetrieval: Hijacking retrieval-augmented generation with semantically preserved adversarial data poisoning
提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成
- arXiv
- 2605.28074
- Published
- Layer
- Application layer
- Setting
- LLM applications
- Evaluated models
- Llama-2-7B-Chat, Mistral-7B-Instruct-v0.2, Qwen-7B-Chat and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
Abstract两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。
SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。
- AttacksarXiv 2605.15338
Hidden in Memory: Latent Memory Poisoning of LLM Agents
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
- arXiv
- 2605.15338
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。
sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
- AttacksarXiv 2603.17239
LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems
Proposes LAAF, which automatically attacks LPCI vulnerabilities in agent systems in stages
- arXiv
- 2603.17239
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- gemini-2.0-flash-001, claude-3-haiku-20240307, meta-llama/llama-3.1-70b-instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractLAAF does LPCI red teaming with taxonomy plus stage seeding.
The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
- AttacksarXiv 2602.00364
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
- arXiv
- 2602.00364
- Published
- Layer
- Application layer
- Setting
- LLM applications
- Evaluated models
- Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
- AttacksarXiv 2512.01335
EmoRAG 研究揭示 RAG 检索对表情符号扰动的脆弱性
提出 EmoRAG，向查询与知识库注入同一表情以劫持 RAG 检索
- arXiv
- 2512.01335
- Published
- Layer
- Application layer
- Setting
- LLM applications
- Evaluated models
- SPECTER, Contriever, Qwen2-7B and others11
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractEmoRAG 用表情联动查询与库文本。
EmoRAG 测量 RAG 对符号扰动的反应：同一表情同时出现在查询和库文本里时，检索会偏离语义匹配。作者要检查的是，检索是否真由语义相关性决定。
You have reached the end