Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 11 papers

Filter5

Attack type

Prompt injection4 Poisoning and backdoors10

Attack technique

Gradient and representation optimization6 Automated search9 Encoding and obfuscation4 Conversation structure manipulation1 Defense-targeted8 Dormant triggers24

Impact

Output manipulation7

System type

Models and APIs3 LLM applications5 AI Agent3

Attack surface / entry point

Retrieval corpus7

Layer

Application layer8

System component

MCP and skills7 Memory4 RAG7 Guardrails and judges21 Reasoning chains9 Fine-tuning and open weights4 Vision41 Audio6 Image generation7 Embeddings3 Multimodal54

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Encoding and obfuscation Attack technique：Conversation structure manipulation System component：RAG System component：Fine-tuning and open weights Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.01367Oct 1
研究：高质量数据筛选挡不住投毒
提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本
arXiv
2610.01367
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Abstract质量筛选挡不住部分高分样本的安全削弱。
Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。
Paper analysisRead analysis
AttacksarXiv 2608.06862Aug 7
SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
arXiv
2608.06862
Published
Aug 7
Layer
Application layer
Setting
Browser and computer use, coding agent
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
Paper analysisRead analysis
AttacksarXiv 2606.11265Jun 9
论文提出 CRCP 投毒框架，揭示 RAG 分块与重排序下的投毒失效问题
提出 CRCP 框架，优化分块与重排下的 RAG 语料投毒
arXiv
2606.11265
Published
Jun 9
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, DeepSeek-R1, Qwen3-Max and others11
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractCRCP 把投毒做成多阶段一致性问题。
CRCP 研究的是带分块和重排的 RAG 语料投毒，而不是只提高文档级检索分数。
Paper analysisRead analysis
AttacksarXiv 2605.28074May 27
SilentRetrieval: Hijacking retrieval-augmented generation with semantically preserved adversarial data poisoning
提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成
arXiv
2605.28074
Published
May 27
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-2-7B-Chat, Mistral-7B-Instruct-v0.2, Qwen-7B-Chat and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
Abstract两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。
SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。
Paper analysisRead analysis
AttacksarXiv 2605.10253May 11
Knowledge poisoning attacks against multimodal retrieval-augmented generation in healthcare
提出 M3 Att，在不知查询时投毒医学多模态 RAG 并误导临床决策
arXiv
2605.10253
Published
May 11
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, GPT-5 Chat, Gemini-2.5-Flash and others8
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2603.17239Mar 18
LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems
Proposes LAAF, which automatically attacks LPCI vulnerabilities in agent systems in stages
arXiv
2603.17239
Published
Mar 18
Layer
Application layer
Setting
AI Agent
Evaluated models
gemini-2.0-flash-001, claude-3-haiku-20240307, meta-llama/llama-3.1-70b-instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractLAAF does LPCI red teaming with taxonomy plus stage seeding.
The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
Paper analysisRead analysis
AttacksarXiv 2602.05444Feb 5
Causal front-door adjustment for robust jailbreak attacks on LLMs
提出 CFA2，用 SAE 定位防御方向并正交化输出权重实现越狱
arXiv
2602.05444
Published
Feb 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama 3.1 8B Instruct, Llama2 7B Chat, Mistral 7B Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2602.00364Jan 31
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
arXiv
2602.00364
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.10923Jan 16
Hidden-in-Plain-Text：面向社交网络 RAG 间接提示注入的基准
用 OpenRAG-Soc 评测社交网页 RAG 的间接提示注入与检索投毒
arXiv
2601.10923
Published
Jan 16
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3-8B-Instruct, Mistral-7B-Instruct, Qwen2.5-14B and others8
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2507.10457Jul 15, 2025
论文提出 LPCI：针对 Agent 逻辑层与持久记忆的提示控制注入攻击
提出 LPCI，把延迟条件载荷写入记忆与检索库以跨会话触发
arXiv
2507.10457
Published
Jul 15, 2025
Layer
Application layer
Setting
AI Agent
Evaluated models
ChatGPT, Claude, LLaMA3 and others8
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者定义 LPCI。
作者把LPCI定义为针对智能体逻辑执行、记忆留存和工具集成的跨阶段漏洞类，而不是单次输入上的提示改写。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop