Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 24 papers
Filter2

Attack type

Jailbreaks9Prompt injection7Poisoning and backdoors5

Attack technique

Gradient and representation optimization4Automated search3Cross-modal payloads6Dormant triggers5

Defense type

Permissions and approval3

Impact

Harmful content6Unauthorized actions6Data and privacy leaks3Output manipulation6

System type

Models and APIs11AI Agent12

Attacker access

Black-box7

Attack surface / entry point

User input10Tool responses3Tool and skill descriptions4Inter-agent messages3Images, audio and video11Distribution channels3

Layer

Prompt layer8Application layer13

System component

MCP and skills38Memory24RAG26Guardrails and judges55Monitors6Reasoning chains23Permissions and sandboxing12Fine-tuning and open weights29Vision60Audio13Video3Image generation22Embeddings9Multimodal96
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
System component：Permissions and sandboxingSystem component：AudioClear all

Another 232papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.09819

    FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

    提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门

    arXiv
    2610.09819
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    HuBERT-base, WavLM-base

    Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.00392

    A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型

    提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调

    arXiv
    2610.00392
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    MiniMax-M3, deepseek-v4-pro, glm-5.3 and others8
    AbstractA2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。

    A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.34518

    SEAD 论文提出工具型 Agent 的状态视角攻击与防御方法 DART 与 SAGE

    提出工具型 Agent 的自适应攻击 DART 与预执行防御 SAGE

    arXiv
    2609.34518
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.6 Luna, GPT-5.6 Terra, Gemini 3.8 Flash and others5

    Abstract论文提出状态控制框架 SEAD、攻击 DART 与防御 SAGE，实验显示执行反馈与环境探测在攻防交互中具有关键作用。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.14003

    FlowSeal：用信息流控制阻断 LLM Agent 的隐私泄露

    提出 FLOWSEAL，用工具级信息流控制阻断智能体隐私泄露

    arXiv
    2609.14003
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    DeepSeek-V3.2, GPT-4.1-mini, Gemini-Flash-2.5

    Abstract作者分析大模型智能体隐私检查与攻击面重合问题，提出外部拦截防御 FLOWSEAL 并验证有效性。

    Paper analysisRead analysis
  7. AttacksarXiv 2609.11757

    Researchers disclose a Whisper prompt injection attack on the AP2 payment protocol and propose the A-VIP defense

    提出 AP2 支付协议的 Whisper 攻击与 A-VIP 绑定防御

    arXiv
    2609.11757
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gemini-2.5-flash-lite, gemini-3.1-flash-lite, gemini-3-flash-preview and others15

    Abstract论文揭示了 AP2 协议决策层受操纵的风险，提出结构化与权能绑定防御 A-VIP，并发布评测基准。

    Paper analysisRead analysis
  10. AttacksarXiv 2609.01723

    研究者提出针对微调 TTS 模型的黑盒成员推断攻击

    提出针对微调 TTS 的黑盒成员推断攻击

    arXiv
    2609.01723
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    CosyVoice2, F5-TTS, XTTS-v2
    Abstract黑盒 TTS 成员推断以 recitation 加分层语音表示为分数，说话人级强于记录级，DP-SGD 可压到随机附近。

    作者给出一个针对微调文本转语音模型的黑盒成员推断框架，分别审计说话人是否进入微调集，以及某一条文本–音频记录是否进入微调集。微调 TTS 以合成文本和参考语音双条件生成，既有生成模型 MIA 的单条件查询和图像/文本上的逐点比较不能直接套用。作者用 scorable extent 与 memorization elicitation 比较五种查询，认为只有 recitation（用目标转写和干净目标语音要求模型复现）同时满足两条，并把它作为主查询。

    Paper analysisRead analysis
  11. AttacksarXiv 2608.29381

    Researchers propose five categories of safety failures in agent checkpoint rollback and implement three attacks on Hermes, Cline, and LangGraph

    提出利用检查点回滚破坏 Agent 执行连续性的攻击

    arXiv
    2608.29381
    Published
    Layer
    Application layer
    Setting
    AI Agent

    Abstract论文系统研究了智能体 C/R 的安全性，分析了合法回滚破坏执行连续性的机理，并实证评估了其普遍性与危害。

    Paper analysisRead analysis
  16. AttacksarXiv 2605.12673

    UC Berkeley proposes BenchJack, which automatically audits 10 agent benchmarks and finds 219 reward hacking defects.

    提出 BENCHJACK，审计 Agent 基准中的奖励作弊缺陷

    arXiv
    2605.12673
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Abstract论文系统揭示了智能体基准的奖励作弊隐患，提出自动化红队审计与迭代修补系统 BENCHJACK。

    论文系统研究了主流 AI 智能体基准评测中的奖励作弊问题，提出了首个针对基准缺陷的自动化红队审计与生成对抗式迭代修补系统 BENCHJACK。

    Paper analysisRead analysis
  17. AttacksarXiv 2605.08460

    论文建模多智能体网络中的子智能体继承攻击面

    建模并利用多智能体网络中子智能体生成时的记忆继承漏洞

    arXiv
    2605.08460
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    MiniMax M2.5, Llama-4-Maverick-17B-128E-Instruct-FP8, Qwen3.5-Plus and others5
    Abstract形式化子智能体继承，在 OpenClaw 上演示四类编排层漏洞并提出防御。

    作者对多智能体网络里的子智能体继承做形式化分析，并用开源框架上的 PoC 演示编排层如何让单点妥协继续扩散。

    Paper analysisRead analysis
  18. AttacksarXiv 2604.14604

    The AudioHijack framework achieves covert audio prompt injection against 13 speech large models

    提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入

    arXiv
    2604.14604
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    SpeechGPT, GLM-4-Voice, VITA-Audio and others15

    Abstract提出了 AudioHijack 框架，揭示了 LALM 对听觉提示注入的脆弱性与传统防御的局限。

    Paper analysisRead analysis
  20. AttacksarXiv 2602.07379

    Aegis: Governance, Integrity, and Security for AI Voice Agents

    提出 Aegis 红队框架，多轮攻击高风险语音 Agent

    arXiv
    2602.07379
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4o, GPT-4o-mini, Gemini-1.5 Pro and others7
    AbstractAegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.

    Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.

    Paper analysisRead analysis
Load more