Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 81 papers

Filter2

Attack type

Jailbreaks29 Prompt injection15 Poisoning and backdoors26 Extraction and theft4 Detection evasion14

Attack technique

Gradient and representation optimization6 Automated search26 Encoding and obfuscation18 Role-play and persuasion3 Reasoning-chain manipulation4 Cross-modal payloads11 Defense-targeted19 Dormant triggers10 Selection manipulation3

Defense type

Detection and filtering7

Impact

Harmful content29 Unauthorized actions10 Data and privacy leaks7 Output manipulation34

System component

MCP and skills38 Memory24 RAG26 Guardrails and judges55 Monitors6 Reasoning chains23 Permissions and sandboxing12 Fine-tuning and open weights29 Vision60 Audio13 Video3 Image generation22 Embeddings9 Multimodal96

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

System component：RAG System component：Guardrails and judges Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
AttacksarXiv 2610.11112Oct 8
EpiReal-Bench：商用图像生成模型虚假声明红队基准
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
arXiv
2610.11112
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
- AttacksJailbreaks
- ComponentImage generation
Abstract四款商用图像模型能把假主张画成可信证据。
EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
AttacksarXiv 2610.07723Oct 6
Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.
提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答
arXiv
2610.07723
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。
Paper analysisRead analysis
AttacksarXiv 2610.05943Oct 5
CRIME 框架利用良性 Agent 技能组合诱发恶意行为
提出 CRIME 框架，组合良性 Agent 技能诱发恶意行为
arXiv
2610.05943
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GPT-4o-mini, GPT-4o and others6
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentMCP and skills
Abstract良性技能经 DCA 或 ACA 组合后可产生恶意环境后果，单独审查对不上。
CRIME 把公共技能库中各自通过审查的技能配成两两组合，看联合执行能否实现指定恶意任务。。
Paper analysisRead analysis
AttacksarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2610.02373Oct 2
HDI 攻击：篡改 GraphRAG 辅助结构可致 88–94% 攻击成功率
提出 HDI 攻击以篡改 GraphRAG 辅助结构破坏检索
arXiv
2610.02373
Published
Oct 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Microsoft GraphRAG, HippoRAG2
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract论文形式化了 GraphRAG 辅助模式级实体攻击面，提出 HDI 攻击并验证其攻击效果。
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2609.39607Sep 30
Pretext 攻击绕过 NVIDIA SkillSpector 等 Agent 技能扫描器
提出 PRETEXT 攻击，迭代改写技能文本绕过技能扫描器并让 Agent 执行木马
arXiv
2609.39607
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
glm (z-ai/glm-5.1), qwen3t (qwen/qwen3-235b-a22b-thinking-2507), gpt-oss (openai/gpt-oss-120b)
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentMCP and skills
Abstract论文提出了针对多阶段技能检测器的白盒攻击，揭示了单纯依赖大模型自适应检测的局限。
PRETEXT 是一项针对基于“静态规则加语义大模型”的智能体技能安全检测框架的白盒攻击与协同进化评估研究。
Paper analysisRead analysis
AttacksarXiv 2609.38253Sep 29
CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.
提出 CollageAttack，用空间文本碎片重组越狱文生图模型
arXiv
2609.38253
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
Paper analysisRead analysis
AttacksarXiv 2609.35155Sep 28
LENS：检索增强生成中集合级投毒的整体危害大于各部分之和
提出 LENS，构造集合级 RAG 语料投毒以导向预设答案
arXiv
2609.35155
Published
Sep 28
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3.6-35B-A3B, Llama-3.1-70B-Instruct, DeepSeek-V4-Pro
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2609.34920Sep 28
RISE：用迭代策略演化对现代文生图模型做红队测试
提出 RISE，迭代演化可复用策略对文生图模型做红队
arXiv
2609.34920
Published
Sep 28
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
DALL·E 3, Nano Banana 2, GPT-Image-2 and others7
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.32400Sep 26
SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能
提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
arXiv
2609.32400
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Pro, GLM-5.2, Qwen3.5-397B-A17B and others4
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.30383Sep 25
研究者提出技能级联攻击
提出技能级联攻击，把有害目标拆散到多个技能里绕过单技能扫描
arXiv
2609.30383
Published
Sep 25
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.4 Mini, Claude Opus 4.6 and others11
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文探讨了多技能智能体系统面临的技能级联攻击风险，提出自动化红队框架与基准集，指出跨技能交互存在安全防护盲区。
Paper analysisRead analysis
AttacksarXiv 2609.29130Sep 24
ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断
提出 ClaimMirage，以域名自述声称改变 LLM 威胁告警判断
arXiv
2609.29130
Published
Sep 24
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.3 70B Instruct-Turbo, Gemma 3 4B it, Gemma 3 12B it and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract作者称自述声称可增减告警。
Paper analysisRead analysis
AttacksarXiv 2609.22510Sep 19
特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent
提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse
arXiv
2609.22510
Published
Sep 19
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentGuardrails and judges
Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。
论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

EpiReal-Bench：商用图像生成模型虚假声明红队基准

BRANCH 方法绕过 6 套多扫描器护栏系统

研究：多向量视觉文档索引可被反演还原页面内容

PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.

CRIME 框架利用良性 Agent 技能组合诱发恶意行为

论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

HDI 攻击：篡改 GraphRAG 辅助结构可致 88–94% 攻击成功率

研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像

Pretext 攻击绕过 NVIDIA SkillSpector 等 Agent 技能扫描器

CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.

LENS：检索增强生成中集合级投毒的整体危害大于各部分之和

RISE：用迭代策略演化对现代文生图模型做红队测试

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能

研究者提出技能级联攻击

ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断

特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent