Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 52 papers
Filter6

Attack type

Prompt injection37Poisoning and backdoors33

Attack technique

Gradient and representation optimization6Automated search3Cross-modal payloads5Dormant triggers14

Model risks

Dangerous agent actions4

Defense type

Model hardening4Detection and filtering7Instruction–data separation9Permissions and approval6

Impact

Harmful content4Unauthorized actions23Data and privacy leaks6Output manipulation18

System type

Models and APIs12AI Agent38web agent7Browser and computer use5

Attack surface / entry point

User input90Web pages and interfaces21Documents and messages19Tool responses19Tool and skill descriptions6Code repositories and dependencies3Retrieval corpus6Memory writes40Inter-agent messages4Images, audio and video120Training data14Weights and gradients9Distribution channels9

Layer

Prompt layer4Application layer38Training and data layer10

System component

MCP and skills21Memory26RAG7Guardrails and judges25Monitors18Reasoning chains11Permissions and sandboxing33Fine-tuning and open weights39Vision20Video3Multimodal26
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Web pages and interfacesAttack surface / entry point：Tool responsesAttack surface / entry point：Code repositories and dependenciesAttack surface / entry point：Training dataSystem component：MemorySystem component：MultimodalClear all

Another 201papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.09941

    OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

    提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向

    arXiv
    2610.09941
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
    Abstract一次投影去掉劫持方向。

    OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。

    Paper analysisRead analysis
  4. DefensesarXiv 2610.09469

    Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

    提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响

    arXiv
    2610.09469
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
    AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。

    Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  6. DefensesarXiv 2610.07657

    DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

    实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击

    arXiv
    2610.07657
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
    AbstractDEFER 把确定性检查放在 judge 之前。

    DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。

    Paper analysisRead analysis
  7. DefensesarXiv 2610.02861

    论文提出在 Kubernetes 上保护 AI Agent 的七层纵深防御框架与参考架构

    提出 Kubernetes 运维智能体的七层纵深防御框架与参考架构

    arXiv
    2610.02861
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Abstract把运维智能体当不可信租户，用七层控制在完全攻破假设下约束行动。

    把 Kubernetes 上的运维智能体当作不可信租户，在假定提示注入已完全控制其工具选择的前提下，用基础设施重建数据面与控制面的边界。要解决的是：智能体读日志、注解、工单或 MCP 工具描述时，这些内容可以变成它带着自身凭据执行的命令。模型对齐和分类器只降低概率。

    Paper analysisRead analysis
  11. Evaluation and benchmarksarXiv 2610.06898

    DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准

    用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性

    arXiv
    2610.06898
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7

    Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。

    Paper analysisRead analysis
  16. OtherarXiv 2609.12413

    SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量

    系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御

    arXiv
    2609.12413
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen3.5-4B, Llama-3.1-8B-Instruct
    AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。

    Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。

    Paper analysisRead analysis
  17. AttacksarXiv 2609.07048

    FreqDoor：面向视觉语言模型的频域后门攻击

    提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门

    arXiv
    2609.07048
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
    AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。

    FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。

    Paper analysisRead analysis
  18. DefensesarXiv 2609.06346

    面向后门攻击下持续学习的鲁棒动态扩展：净化与选择性恢复

    提出持续学习下的净化与选择性恢复框架，抵御逐任务训练投毒后门

    arXiv
    2609.06346
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ViT-B/16
    Abstract作者报告任务内净化与恢复可配合动态专家防御后门，但保证依赖分离条件。

    这是一项面向持续图像分类的后门防御研究：模型只使用当前任务数据，同时需要保留过去知识并避免学习恶意监督。

    Paper analysisRead analysis
  19. DefensesarXiv 2609.04875

    Forgetting without restart: execution-state forgetting for stateful LLM agents

    Proposes execution-state forgetting, using provenance-guided selective replay to purify stateful agents

    arXiv
    2609.04875
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractSelective replay concatenates the clean prefix with the sanitized suffix, and main-table metrics match full reset.

    This work defines forgetting in long-horizon agents as runtime counterfactual equivalence, rather than deleting a plaintext memory.

    Paper analysisRead analysis
Load more