Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 48 papers

Filter6

Attack type

Prompt injection27 Poisoning and backdoors42

Attack technique

Automated search4 Encoding and obfuscation3 Dormant triggers20

Defense type

Model hardening3 Detection and filtering3 Instruction–data separation5 Permissions and approval6

Impact

Harmful content5 Unauthorized actions18 Data and privacy leaks8 Output manipulation15

System component

MCP and skills6 Memory38 Guardrails and judges7 Reasoning chains6 Permissions and sandboxing7 Fine-tuning and open weights37 Vision8 Video3 Image generation2 Embeddings0 Multimodal14

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Memory writes Attack surface / entry point：Training data System component：Memory System component：Vision System component：Image generation System component：Embeddings Clear all

Another 227papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.13267Oct 9
Forgetting is not always bad: a neuroscience-inspired memory repair mechanism for poisoned LLM agents
Proposes DREAM, which selectively weakens agent-poisoned memories while preserving benign memories.
arXiv
2610.13267
Published
Oct 9
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4-mini, Claude-Haiku-4.5
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
AttacksarXiv 2610.07645Oct 6
SkillPoison：用成功经验投毒自进化 Agent 的技能形成
提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能
arXiv
2610.07645
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。
SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。
Paper analysisRead analysis
AttacksarXiv 2610.04589Oct 3
StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel
提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道
arXiv
2610.04589
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMemory
Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。
Paper analysisRead analysis
DefensesarXiv 2610.04504Oct 3
论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证
提出 VAL 框架，并用确认门与参数沙箱约束智能体高风险工具调用
arXiv
2610.04504
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-chat, Meta Llama 3.1 8B, Kimi
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2610.04195Oct 3
MemLeak research: multi-tenant agents sharing vector memory stores have cross-user memory leakage
提出 MemLeak，评估多租户 Agent 共享向量记忆的跨用户泄露
arXiv
2610.04195
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 2.5 Flash, Claude Sonnet 4.5, all-MiniLM-L6-v2 and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2610.00450Oct 1
ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
arXiv
2610.00450
Published
Oct 1
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Claude Sonnet 4.6, GPT-5.5, GLM-5.2 and others4
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.39047Sep 30
BadAction：通过动作引导触发器对交互式视频生成模型实施后门攻击
提出 BadAction，通过动作触发器给交互式视频生成植入后门
arXiv
2609.39047
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Astra (Wan2.1-T2V-1.3B)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2609.35576Sep 29
研究提出跨 LLM 助手的记忆跳跃攻击
提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播
arXiv
2609.35576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Luna, Kimi-K2.6, GPT-OSS-120B and others6
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。
该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34790Sep 28
CoSec：面向社区场景的 LLM Agent 安全基准
用 CoSec 评测社区 Agent 是否越界披露受保护信息
arXiv
2609.34790
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
OpenClaw with Gemini 3.1 Pro, OpenClaw with Qwen 3.8 Max, OpenClaw with MiniMax M2.5 and others13
- AttacksPrompt injection
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.28239Sep 23
ODPure：通过集成破坏共识实现目标检测后门净化
提出 ODPure，在输入阶段用腐蚀重建与共识净化目标检测后门
arXiv
2609.28239
Published
Sep 23
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
YOLOv5, Faster R-CNN
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.22818Sep 19
研究测量 LLM Agent 记忆投毒防御的良性场景开销
测量记忆投毒防御在良性对话上的效用与 token 开销
arXiv
2609.22818
Published
Sep 19
Layer
Application layer
Setting
AI Agent
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract写时代价落在噪声内。
在没有攻击的对话上，给记忆投毒防御计价，而不是再测一轮攻击是否被挡住。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.19705Sep 17
SoK 论文提出 FARSIGHT 框架，评测 15 个学术金融 LLM 交易 Agent 的鲁棒性与安全失败
用 FARSIGHT 方案级评测金融 LLM 交易 Agent 的稳健性与安全失败
arXiv
2609.19705
Published
Sep 17
Layer
Application layer
Setting
AI Agent
Evaluated models
ChatGPT Deep Research
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
OtherarXiv 2609.12413Sep 11
SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量
系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御
arXiv
2609.12413
Published
Sep 11
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-4B, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- ComponentMemory
AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。
Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。
Paper analysisRead analysis
AttacksarXiv 2609.07048Sep 7
FreqDoor：面向视觉语言模型的频域后门攻击
提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门
arXiv
2609.07048
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentVision
AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。
FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。
Paper analysisRead analysis
DefensesarXiv 2609.06346Sep 6
面向后门攻击下持续学习的鲁棒动态扩展：净化与选择性恢复
提出持续学习下的净化与选择性恢复框架，抵御逐任务训练投毒后门
arXiv
2609.06346
Published
Sep 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ViT-B/16
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentVision
Abstract作者报告任务内净化与恢复可配合动态专家防御后门，但保证依赖分离条件。
这是一项面向持续图像分类的后门防御研究：模型只使用当前任务数据，同时需要保留过去知识并避免学习恶意监督。
Paper analysisRead analysis
DefensesarXiv 2609.04875Sep 4
Forgetting without restart: execution-state forgetting for stateful LLM agents
Proposes execution-state forgetting, using provenance-guided selective replay to purify stateful agents
arXiv
2609.04875
Published
Sep 4
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPrompt injection
- ComponentMemory
AbstractSelective replay concatenates the clean prefix with the sanitized suffix, and main-table metrics match full reset.
This work defines forgetting in long-horizon agents as runtime counterfactual equivalence, rather than deleting a plaintext memory.
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attack surface / entry point

Layer

System component