Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 61 papers
Filter5

Attack type

Prompt injection29Poisoning and backdoors49Extraction and theft5

Attack technique

Automated search4Encoding and obfuscation3Defense-targeted3Dormant triggers25

Defense type

Model hardening4Detection and filtering3Instruction–data separation5Permissions and approval6

Impact

Harmful content6Unauthorized actions20Data and privacy leaks13Output manipulation18

System type

Models and APIs19AI Agent40coding agent3Multi-agent systems5

Attacker access

White-box3

Attack surface / entry point

User input90Web pages and interfaces21Documents and messages19Tool responses19Tool and skill descriptions6Code repositories and dependencies3Retrieval corpus6Memory writes40Inter-agent messages4Images, audio and video120Training data14Weights and gradients9Distribution channels9

Layer

Prompt layer4Model layer3Application layer40Training and data layer14

System component

MCP and skills7Memory40RAG4Guardrails and judges8Monitors4Reasoning chains7Permissions and sandboxing7Fine-tuning and open weights58Vision9Audio3Video3Image generation7Multimodal21
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Memory writesAttack surface / entry point：Training dataAttack surface / entry point：Weights and gradientsSystem component：MemorySystem component：MultimodalClear all

Another 213papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.09941

    OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

    提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向

    arXiv
    2610.09941
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
    Abstract一次投影去掉劫持方向。

    OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.09819

    FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

    提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门

    arXiv
    2610.09819
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    HuBERT-base, WavLM-base

    Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。

    Paper analysisRead analysis
  5. DefensesarXiv 2610.07657

    DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

    实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击

    arXiv
    2610.07657
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
    AbstractDEFER 把确定性检查放在 judge 之前。

    DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.07645

    SkillPoison：用成功经验投毒自进化 Agent 的技能形成

    提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能

    arXiv
    2610.07645
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
    AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。

    SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.05601

    Tracer 框架可从遗忘后的扩散模型中识别被擦除概念

    提出 TRACER，从权重差识别扩散模型被擦除概念

    arXiv
    2610.05601
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
    AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。

    TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。

    Paper analysisRead analysis
  8. AttacksarXiv 2610.05453

    研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私

    提出 PLW，用微调把先前对话敏感触发编码进后续生成图像

    arXiv
    2610.05453
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    OmniGen2, BAGEL-7B

    AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。

    Paper analysisRead analysis
  9. AttacksarXiv 2610.04589

    StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

    提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道

    arXiv
    2610.04589
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13

    Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。

    Paper analysisRead analysis
  13. DefensesarXiv 2609.39548

    NDDL：用正常扩散动力学为文生图模型做后门防御

    提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token

    arXiv
    2609.39548
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
    AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。

    NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.35576

    研究提出跨 LLM 助手的记忆跳跃攻击

    提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播

    arXiv
    2609.35576
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.6 Luna, Kimi-K2.6, GPT-OSS-120B and others6
    Abstract论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。

    该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。

    Paper analysisRead analysis
  20. DefensesarXiv 2609.23586

    VidMark：面向视频生成模型知识产权保护的高效水印方案

    提出 VidMark 水印方案，核验视频生成模型的输出来源与所有权

    arXiv
    2609.23586
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Stable Video Diffusion (SVD), Open-Sora, Wan
    AbstractVidMark 加解码器引导微调，把模型签名写入 VGM 输出并用于两项核验。

    Huang 等人提出一套面向视频生成模型的生成内嵌水印方案，用来同时判断一条视频是否来自受保护模型，以及一个嫌疑模型是否为该模型的拷贝。

    Paper analysisRead analysis
Load more