Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 201 papers
Filter6

Attack type

Jailbreaks56Prompt injection22Poisoning and backdoors16Extraction and theft7Detection evasion18Malicious use11

Attack technique

Gradient and representation optimization22Automated search16Multi-turn escalation5Encoding and obfuscation18Reasoning-chain manipulation3Cross-modal payloads44Defense-targeted8Dormant triggers5

Model risks

Deception and scheming15Reward hacking10Inappropriate refusal9Hallucination and fabrication12

Defense type

Model hardening18Inference-time intervention13Detection and filtering13Instruction–data separation3Monitoring and auditing32Watermarking and provenance4

Impact

Harmful content70Unauthorized actions11Data and privacy leaks11Output manipulation54Availability and reliability3Oversight failure24

System type

Models and APIs171LLM applications16AI Agent93coding agent23science agent4web agent7Browser and computer use8Multi-agent systems7Embodied systems and robotics14

Attacker access

Black-box40Gray-box5White-box10No-box (offline transfer)3

Attack surface / entry point

User input73Web pages and interfaces8Documents and messages5Tool responses4Tool and skill descriptions6Images, audio and video79Training data10Weights and gradients10Distribution channels9

Layer

Prompt layer75Model layer66Application layer27Training and data layer31

System component

MCP and skills27Memory12RAG4Guardrails and judges98Monitors49Reasoning chains65Permissions and sandboxing15Fine-tuning and open weights62Vision109Audio32Video11Image generation46Embeddings4Multimodal188
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：coding agentSystem type：web agentSystem component：MonitorsSystem component：VisionSystem component：Image generationClear all

Another 215papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.13333

    LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

    Proposes LETHE, which perturbs reference images to block unauthorized image-to-video

    arXiv
    2610.13333
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
    AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.

    LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.

    Paper analysisRead analysis
  3. Evaluation and benchmarksarXiv 2610.11112

    EpiReal-Bench：商用图像生成模型虚假声明红队基准

    构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据

    arXiv
    2610.11112
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
    Abstract四款商用图像模型能把假主张画成可信证据。

    EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。

    Paper analysisRead analysis
  5. DefensesarXiv 2610.09941

    OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

    提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向

    arXiv
    2610.09941
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
    Abstract一次投影去掉劫持方向。

    OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。

    Paper analysisRead analysis
  6. DefensesarXiv 2610.09703

    研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

    提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱

    arXiv
    2610.09703
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    LLaVA-1.5-7B
    Abstract剪枝去掉背景 token 后注意力塌向恶意前景。

    这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。

    Paper analysisRead analysis
  7. DefensesarXiv 2610.09469

    Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

    提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响

    arXiv
    2610.09469
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
    AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。

    Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。

    Paper analysisRead analysis
  8. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  9. DefensesarXiv 2610.09167

    Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果

    提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源

    arXiv
    2610.09167
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
    AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。

    Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。

    Paper analysisRead analysis
  10. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2610.07939

    CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it

    提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别

    arXiv
    2610.07939
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    C2P-CLIP, ForgeLens, D3-Im and others10

    Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。

    Paper analysisRead analysis
  14. DefensesarXiv 2610.07774

    研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器

    AI summary研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。

    arXiv
    2610.07774
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-VL-30B-A3B-Instruct, Kimi-VL-A3B-Instruct
    Abstract读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。

    作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。

    Paper analysisRead analysis
  16. OtherarXiv 2610.06452

    研究者提出多模态安全评测应衡量可控性而非仅做分类

    主张多模态安全评测应衡量可控性，并用 SAE 建立四轴画像

    arXiv
    2610.06452
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    LlavaGuard-v1.2-7B-OV, Qwen3.5-9B
    Abstract四轴画像把读出与选择性控制分开。

    作者主张多模态安全评测在行为分类之外，单独报告可控性画像，而不是把检测准确当成控制证据。

    Paper analysisRead analysis
  17. Evaluation and benchmarksarXiv 2610.06406

    AgentMonBench：面向长时程智能体行为监控的软件工程基准

    提出 AgentMonBench 评测长时程编程智能体监控并检验 EBG

    arXiv
    2610.06406
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol and others8
    AbstractAgentMonBench 评测后果性决策监控，EBG 组织证据。

    长时程软件工程任务里，用户要判断智能体哪些选择值得核验。作者用 AgentMonBench 评测监控器，并用免训练的 EBG 组织带源证据。

    Paper analysisRead analysis
  19. DefensesarXiv 2610.05637

    Study shows VLM visual grounding refusal rates are on average 31 to 59 percentage points lower by harm domain

    提出融合定位拒答与能力保留的安全微调，补齐视觉定位输出的拒答缺口

    arXiv
    2610.05637
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Claude Sonnet 4.6, Gemini 3.5 Flash, Molmo2-8B and others5

    Abstract论文揭示了 VLM 定位安全落后于 VQA 的对齐断层，提出三成分微调方案有效弥合差距并保留定位能力，表征分析揭示了对齐机制。

    Paper analysisRead analysis
  20. AttacksarXiv 2610.05601

    Tracer 框架可从遗忘后的扩散模型中识别被擦除概念

    提出 TRACER，从权重差识别扩散模型被擦除概念

    arXiv
    2610.05601
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
    AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。

    TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。

    Paper analysisRead analysis
Load more