Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 85 papers
Filter5

Attack type

Jailbreaks45Prompt injection15Poisoning and backdoors18Extraction and theft8

Attack technique

Gradient and representation optimization6Automated search8Multi-turn escalation5Encoding and obfuscation17Role-play and persuasion3Conversation structure manipulation3Reasoning-chain manipulation10Cross-modal payloads24Defense-targeted4Dormant triggers12

Defense type

Model hardening4Inference-time intervention6Detection and filtering4Instruction–data separation3Permissions and approval3

Impact

Harmful content44Unauthorized actions6Data and privacy leaks11Output manipulation18Availability and reliability3

System type

Models and APIs60LLM applications4AI Agent21Multi-agent systems3

Attacker access

Black-box29White-box4

Attack surface / entry point

User input85Web pages and interfaces20Documents and messages22Tool responses19Tool and skill descriptions6Code repositories and dependencies6Retrieval corpus14Memory writes38Inter-agent messages4Images, audio and video83Training data12Weights and gradients4Distribution channels5

Layer

Prompt layer44Model layer10Application layer24Training and data layer6

System component

MCP and skills15Memory19RAG16Guardrails and judges81Monitors22Reasoning chains27Permissions and sandboxing16Fine-tuning and open weights12Vision42Audio8Image generation22Embeddings2Multimodal71
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
Attack surface / entry point：User inputSystem component：MemorySystem component：Reasoning chainsSystem component：VisionSystem component：EmbeddingsClear all

Another 232papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  2. InterpretabilityarXiv 2610.12361

    Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

    Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.

    arXiv
    2610.12361
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
    AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.

    This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.09703

    研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

    提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱

    arXiv
    2610.09703
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    LLaVA-1.5-7B
    Abstract剪枝去掉背景 token 后注意力塌向恶意前景。

    这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  5. DefensesarXiv 2610.07657

    DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

    实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击

    arXiv
    2610.07657
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
    AbstractDEFER 把确定性检查放在 judge 之前。

    DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.04589

    StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

    提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道

    arXiv
    2610.04589
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13

    Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。

    Paper analysisRead analysis
  10. AttacksarXiv 2609.38270

    VirusCascade：劫持 LLM 推荐智能体的协同反思机制

    提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思

    arXiv
    2609.38270
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    AgentCF, AgentSEQ, AgentRAG and others4
    Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。

    VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。

    Paper analysisRead analysis
  13. DefensesarXiv 2609.36562

    ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害

    构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险

    arXiv
    2609.36562
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    ThinkingGuard（Qwen3-VL-8B-Instruct）
    AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。

    这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。

    Paper analysisRead analysis
  14. AttacksarXiv 2609.35699

    论文：蒸馏防御在蒸馏后强化学习下易被攻破

    提出用 API 推理摘要重建轨迹再蒸馏加强化学习，攻破蒸馏防御

    arXiv
    2609.35699
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others12
    Abstract更现实的蒸馏攻击是蒸馏后再 RL。

    这篇工作修订蒸馏攻击的威胁模型：攻击者经合法 API 收集闭源推理数据，先蒸馏自有模型，再做强化学习。作者认为只在蒸馏后评估防御，会漏掉后续 RL，从而高估防御。

    Paper analysisRead analysis
  17. Evaluation and benchmarksarXiv 2609.33481

    IDUnlearn-Bench：面向视觉语言模型的个体级遗忘基准

    提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留

    arXiv
    2609.33481
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others6
    AbstractIDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。

    IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。

    Paper analysisRead analysis
  19. InterpretabilityarXiv 2609.23587

    大型推理模型的效率与安全困境：量化与剪枝如何影响越狱鲁棒性

    分析量化、剪枝与 KV 缓存压缩对推理模型越狱鲁棒性的影响

    arXiv
    2609.23587
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    QwQ-32B, DeepSeek-R1-Distill-Qwen-32B, DeepSeek-R1-Distill-Llama-8B
    Abstract效率压缩常使 LRM 越狱 HR 下降，作者将其归因于推理退化而非对齐增强。

    作者分析量化、剪枝和 KV 缓存压缩如何同时改变 LRM 的显存、推理和越狱脆弱性。。

    Paper analysisRead analysis
Load more