Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 7 papers
Filter4

Attack type

Prompt injection3

Attack technique

Gradient and representation optimization4Automated search26Multi-turn escalation4Encoding and obfuscation21Role-play and persuasion5Conversation structure manipulation3Reasoning-chain manipulation7Cross-modal payloads9Defense-targeted22Dormant triggers27

System type

Models and APIs3AI Agent4

Attacker access

Black-box3

Attack surface / entry point

User input4

Layer

Prompt layer4Application layer3

System component

Memory1Guardrails and judges3Monitors3Reasoning chains13
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.
Attack technique：Reasoning-chain manipulationSystem component：MemorySystem component：Guardrails and judgesSystem component：MonitorsClear all

Another 255papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  2. AttacksarXiv 2609.15989

    研究者提出 plan injection 攻击，可绕过思维链监控

    提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器

    arXiv
    2609.15989
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    Qwen2.5-Coder-7B-Instruct, Qwen3-8B, DeepSeek-R1-0528 and others6

    Abstract论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.09553

    研究：任意密文攻击前沿大模型无需微调即可越狱

    提出任意字母置换密码越狱，无需微调即可诱导有害输出

    arXiv
    2609.09553
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7

    Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.01023

    Akrasia：针对推理型代码 LLM 的隐蔽后门攻击

    提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链

    arXiv
    2609.01023
    Published
    Layer
    Prompt layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7

    Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。

    Paper analysisRead analysis
  6. AttacksarXiv 2604.05549

    Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents

    提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作

    arXiv
    2604.05549
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-3.5-turbo, GPT-4o, GPT-5 and others7
    AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。

    JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。

    Paper analysisRead analysis
You have reached the end