Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 94 papers

Filter3

System type

Models and APIs37 LLM applications45 AI Agent12 web agent3

Attacker access

Black-box15 White-box4

Attack surface / entry point

User input25 Web pages and interfaces4 Documents and messages5 Retrieval corpus26 Images, audio and video23

Layer

Prompt layer12 Model layer22 Application layer54 Training and data layer6

System component

MCP and skills82 Memory75 RAG50 Guardrails and judges169 Monitors92 Reasoning chains74 Permissions and sandboxing93 Fine-tuning and open weights63 Vision137 Audio38 Video13 Image generation49 Embeddings12 Multimodal224

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.

System component：RAG System component：Audio System component：Embeddings Clear all

Another 261papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
InterpretabilityarXiv 2610.10865Oct 8
用路由稀疏自编码器解耦语音编码器中的语言学与副语言学信息
提出路由 TopK SAE，把语音编码器稀疏码拆成语言与副语言通路
arXiv
2610.10865
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
SPEAR XLarge, WavLM Large
- ComponentAudio
Abstract路由 SAE 在冻结 SPEAR 与 WavLM 上分开语言和副语言因子，探针与交换支持通路分工。
TopK SAE 的稀疏码被分成语言通路与副语言通路，用来分开冻结语音编码器里同时存在的音素信息和说话人、情感、韵律。只重构不能得到作者选定的这一分解。语言通路由音素识别监督，副语言通路由说话人识别、情感分类和韵律预测监督，作用在对方通路上的梯度反转对抗用来压低交叉因子。
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08585Oct 6
研究：无关信息污染患者病历并干扰 LLM 临床推理
构建 MedDistract 基准，测量偶发信息对临床文书与推理的污染
arXiv
2610.08585
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-5.4, GPT-5.6 Sol, Claude Opus 5 and others9
- RiskHallucination and fabrication
- ComponentAudio
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08571Oct 6
RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准
提出 RAG-PIBench，评测 RAG 上下文中提示注入检测器
arXiv
2610.08571
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
DistilBERT-base-uncased, DeBERTa-v3-base, MiniLM
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Paper analysisRead analysis
InterpretabilityarXiv 2610.08887Oct 6
Moshi 全双工语音模型的情感引导遵循几何结构而非标签
用均值差激活转向检验全双工语音模型的情感方向几何
arXiv
2610.08887
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
kyutai/moshika-pytorch-q8
- ComponentAudio
Abstract转向跟方向几何走而不跟标签走：sad 可单独对准，高唤醒情感共享方向。
Moshi 上的情感激活转向跟方向之间的几何关系走，不跟被请求的标签走。
Paper analysisRead analysis
DefensesarXiv 2610.07276Oct 6
SAFESHIELD：小语言模型部署时安全的决策组织框架
提出 SAFESHIELD，组织小语言模型部署时的安全决策
arXiv
2610.07276
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3-4B-Instruct
- AttacksJailbreaks
- RiskHallucination and fabrication
- ComponentRAG
AbstractSAFESHIELD 用可审计决策轨迹组织 SLM 部署时的四项安全决策，并报告协调依赖影响端到端结果。
SAFESHIELD 是面向小语言模型的部署时安全框架，把运行时安全从单项审核改写成可检查的决策过程。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06339Oct 5
BabelFake：面向多语言音视频 DeepFake 检测的基准数据集
构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
arXiv
2610.06339
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SpeechForensics, AVH-Align, (B)RAVEn
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentAudio
AbstractBabelFake 为五语同意采集基准。
BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
Paper analysisRead analysis
DefensesarXiv 2610.05826Oct 5
研究者提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
arXiv
2610.05826
Published
Oct 5
Layer
Application layer
Setting
LLM applications
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract用截止期限制未核验可见时长。
这篇工作给持续摄入的 RAG 向量库一个失败关闭的临时可见性协议，把协议能限制的未核验暴露和依赖检测器的中毒暴露分开。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05586Oct 5
AgentDoxx：联网搜索 Agent 对匿名访谈文本的再识别评测
构建 AGENTDOXX 基准，评测联网搜索 Agent 对匿名访谈的再识别
arXiv
2610.05586
Published
Oct 5
Layer
Application layer
Setting
web agent
Evaluated models
GPT-5.6 Terra, GPT-5 Mini, GPT-4.1 Mini and others10
- AttacksMalicious use
- ComponentRAG
Abstract论文提出了已知身份的重识别基准 AGENTDOXX，揭示搜索与记忆双重风险及现有防御在检索轨迹中的泄露漏洞。
Paper analysisRead analysis
OtherarXiv 2610.05264Oct 4
面向音频深度伪造检测的任务感知联合剪枝与蒸馏框架
提出任务感知的跨域蒸馏与剪枝方法以压缩音频深度伪造检测器
arXiv
2610.05264
Published
Oct 4
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
XLSR-AASIST
- ComponentAudio
Paper analysisRead analysis
Analysis and theoryarXiv 2610.07005Oct 4
研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因
遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联
arXiv
2610.07005
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2-Audio-7B-Instruct, LLaMA-Omni
- AttacksJailbreaks
- ComponentAudio
AbstractAdvWave-P 的八频带排序与能量相关。
这是对加性音频越狱 AdvWave-P 的频率与解码器深度审计，受害模型主要是 Qwen2-Audio-7B-Instruct，不提出新攻击。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.04888Oct 4
研究：事实核查评测可能混入声明时不可知的未来证据
测量事实核查评测混入的时序证据与参数泄漏
arXiv
2610.04888
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3-14B, phi-4
- ComponentRAG
Abstract两条后见通道会抬高事实核查分数。
作者量的是 LLM 事实核查分数里，有多少来自 claim 当时还不可知的信息。通道有两条：预训练记住的结局，以及检索到的、写于 claim 之后的文档。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.04860Oct 4
Research reveals that text watermarks induce model hallucinations and proposes two mitigation interventions
分析文本水印在 RAG 中诱发事实幻觉的机制并提出干预
arXiv
2610.04860
Published
Oct 4
Layer
Model layer
Setting
LLM applications
Evaluated models
LLaMA 3.1 8B Instruct, Mistral-7B-Instruct-v0.3, Qwen2.5-14B-Instruct
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentRAG
Abstract论文揭示了生产环境文本水印导致模型事实退化的失效模式，分析了解码机制并提出针对性干预。
论文研究生产级文本水印对大语言模型事实准确性的影响，分析了水印诱发幻觉的失效模式并评估了针对性缓解方案。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.04691Oct 4
RAGStress：评测知识库退化下 RAG 鲁棒性的受控基准
提出 RAGStress 受控基准，评测知识库退化下的 RAG
arXiv
2610.04691
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude Sonnet 4, Claude Opus 4.6, DeepSeek R1 and others5
- ComponentRAG
Abstract作者用 RAGStress 比较五系统。
RAGStress 是知识库损坏下的 RAG 受控压力测试。作者明确不把它当作模型排行榜。
Paper analysisRead analysis
DefensesarXiv 2610.04235Oct 3
Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架
提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
arXiv
2610.04235
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-TTS (0.6B), Dots.tts (2B)
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2610.02999Oct 2
OmniConfess：用 Token 级「忏悔」缓解全模态幻觉
提出 OmniConfess，冻结候选并按通道重打分以缓解全模态幻觉
arXiv
2610.02999
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-Omni-7B, Qwen3-Omni-30B-A3B, Nemotron-3-Nano-Omni-30B
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.02373Oct 2
HDI 攻击：篡改 GraphRAG 辅助结构可致 88–94% 攻击成功率
提出 HDI 攻击以篡改 GraphRAG 辅助结构破坏检索
arXiv
2610.02373
Published
Oct 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Microsoft GraphRAG, HippoRAG2
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract论文形式化了 GraphRAG 辅助模式级实体攻击面，提出 HDI 攻击并验证其攻击效果。
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

用路由稀疏自编码器解耦语音编码器中的语言学与副语言学信息

研究：多向量视觉文档索引可被反演还原页面内容

FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

研究：无关信息污染患者病历并干扰 LLM 临床推理

RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准

Moshi 全双工语音模型的情感引导遵循几何结构而非标签

SAFESHIELD：小语言模型部署时安全的决策组织框架

BabelFake：面向多语言音视频 DeepFake 检测的基准数据集

研究者提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露

AgentDoxx：联网搜索 Agent 对匿名访谈文本的再识别评测

面向音频深度伪造检测的任务感知联合剪枝与蒸馏框架

研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因

研究：事实核查评测可能混入声明时不可知的未来证据

Research reveals that text watermarks induce model hallucinations and proposes two mitigation interventions

RAGStress：评测知识库退化下 RAG 鲁棒性的受控基准

Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架

OmniConfess：用 Token 级「忏悔」缓解全模态幻觉

HDI 攻击：篡改 GraphRAG 辅助结构可致 88–94% 攻击成功率

研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像