Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 7 papers
Filter3

Attack type

Prompt injection3Poisoning and backdoors6

Attack technique

Dormant triggers7

Impact

Output manipulation3

System type

AI Agent7

Attack surface / entry point

User input7Web pages and interfaces3Documents and messages7Tool responses5Memory writes16

Layer

Application layer7

System component

Memory7RAG3Guardrails and judges3Fine-tuning and open weights4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Attack technique：Dormant triggersAttack surface / entry point：User inputSystem component：MemoryClear all

Another 265papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.04589

    StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

    提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道

    arXiv
    2610.04589
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13

    Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。

    Paper analysisRead analysis
  2. AttacksarXiv 2609.38270

    VirusCascade：劫持 LLM 推荐智能体的协同反思机制

    提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思

    arXiv
    2609.38270
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    AgentCF, AgentSEQ, AgentRAG and others4
    Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。

    VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。

    Paper analysisRead analysis
  6. AttacksarXiv 2606.09084

    研究者提出 Context-Fractured Decomposition 攻击

    提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查

    arXiv
    2606.09084
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4.1, GPT-5-nano, Claude-3.5-Sonnet and others6
    AbstractCFD 用无指令 artifact 把越狱拆到跨会话。

    CFD针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。

    Paper analysisRead analysis
  7. AttacksarXiv 2603.17239

    LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems

    提出 LAAF，分阶段自动攻击智能体系统的 LPCI 漏洞

    arXiv
    2603.17239
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gemini-2.0-flash-001, claude-3-haiku-20240307, meta-llama/llama-3.1-70b-instruct and others5
    AbstractLAAF does LPCI red teaming with taxonomy plus stage seeding.

    The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.

    Paper analysisRead analysis
You have reached the end