Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 36 papers
Filter5

Attack type

Prompt injection20Poisoning and backdoors30

Attack technique

Gradient and representation optimization4Automated search7Encoding and obfuscation3Dormant triggers7

Defense type

Detection and filtering4Instruction–data separation4Permissions and approval3

Impact

Unauthorized actions7Output manipulation26

System type

LLM applications21AI Agent15web agent3

Attack surface / entry point

User input33Web pages and interfaces12Documents and messages18Tool responses16Tool and skill descriptions5Code repositories and dependencies4Retrieval corpus28Memory writes38Inter-agent messages4Distribution channels4

Layer

Application layer36

System component

MCP and skills8Memory11RAG27Guardrails and judges10Monitors5Reasoning chains5Permissions and sandboxing16Vision12Embeddings6Multimodal12
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Web pages and interfacesAttack surface / entry point：Retrieval corpusLayer：Application layerSystem component：MemorySystem component：RAGClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.11932

    A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

    Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.

    arXiv
    2610.11932
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Grok, Doubao, ChatGPT and others10

    AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.

    Paper analysisRead analysis
  4. DefensesarXiv 2610.05826

    研究者提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露

    提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露

    arXiv
    2610.05826
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Abstract用截止期限制未核验可见时长。

    这篇工作给持续摄入的 RAG 向量库一个失败关闭的临时可见性协议，把协议能限制的未核验暴露和依赖检测器的中毒暴露分开。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2609.39146

    MADBench：多智能体辩论安全性评测基准发布

    提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响

    arXiv
    2609.39146
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    gpt-4o, GPT-5, GPT-6 Astra
    AbstractMADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。

    MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。

    Paper analysisRead analysis
  10. DefensesarXiv 2609.17648

    多智能体 LLM 流水线中的信任传播与结构隔离

    用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行

    arXiv
    2609.17648
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    gemma4:31b-cloud
    Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。

    作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。

    Paper analysisRead analysis
  11. DefensesarXiv 2609.04767

    SHAQ: Privacy-preserving retrieval in vector databases using shadow queries

    Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.

    arXiv
    2609.04767
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    GTR-T5 encoder, DPR
    AbstractSHAQ replaces document embeddings with shadow query embeddings.

    SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.

    Paper analysisRead analysis
  12. AttacksarXiv 2609.02774

    CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

    提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞

    arXiv
    2609.02774
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B

    AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2609.02316

    Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息

    构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御

    arXiv
    2609.02316
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8

    Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.01325

    VerTox：用可验证奖励引导的强化学习对神经排序模型实施语料投毒

    提出 VerTox，用可验证奖励强化学习生成误导文档并投毒检索语料

    arXiv
    2609.01325
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    SimLM-base, BGE-base, Cohere-embed-english-v3.0 and others8
    AbstractVerTox 以可验证奖励微调小 LLM，生成能抬高排序并腐蚀事实的投毒文档。

    VerTox 用可验证奖励把小 LLM 微调成语料投毒生成器，用来探测神经排序器在注入文档下的暴露面。

    Paper analysisRead analysis
  16. AttacksarXiv 2608.04565

    Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents

    提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链

    arXiv
    2608.04565
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Qwen3.5-9B, Gemma4-31B, DeepResearch and others7

    Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。

    Paper analysisRead analysis
  19. AttacksarXiv 2607.00422

    KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链

    提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链

    arXiv
    2607.00422
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
    Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。

    KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。

    Paper analysisRead analysis
  20. AttacksarXiv 2606.11265

    论文提出 CRCP 投毒框架，揭示 RAG 分块与重排序下的投毒失效问题

    提出 CRCP 框架，优化分块与重排下的 RAG 语料投毒

    arXiv
    2606.11265
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, DeepSeek-R1, Qwen3-Max and others11
    AbstractCRCP 把投毒做成多阶段一致性问题。

    CRCP 研究的是带分块和重排的 RAG 语料投毒，而不是只提高文档级检索分数。

    Paper analysisRead analysis
Load more