Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 16 papers
Filter5

Attack type

Prompt injection10

Attack technique

Gradient and representation optimization7Cross-modal payloads10

Impact

Unauthorized actions8Output manipulation5

System type

Models and APIs63LLM applications4AI Agent16coding agent1web agent4Browser and computer use3Embodied systems and robotics5

Attack surface / entry point

User input5Web pages and interfaces11Documents and messages4Tool responses4Retrieval corpus5Memory writes3Images, audio and video16

Layer

Prompt layer3Application layer12

System component

RAG0Guardrails and judges3Vision16Multimodal17
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.
System type：AI AgentSystem type：coding agentAttack surface / entry point：Images, audio and videoSystem component：RAGSystem component：VisionClear all

Another 213papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2610.06898

    DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准

    用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性

    arXiv
    2610.06898
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7

    Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2609.09404

    MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测

    用 MMPIBench 评测多模态提示注入对 Agent 框架的影响

    arXiv
    2609.09404
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro and others6

    Abstract论文提出 MMPIBench 评测多模态提示注入对智能体的影响，发现模型主导行为、尝试远超完成，音频通道缺乏防护。

    Paper analysisRead analysis
  8. AttacksarXiv 2609.04533

    Repeat-After-Me：针对黑盒 VLM 的自适应视觉提示注入攻击

    提出 Repeat-After-Me 自适应视觉提示注入，诱导 VLM 智能体执行指定任务

    arXiv
    2609.04533
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Claude-Opus-4.7, GPT-5.5, Gemini-3.1-Pro and others6

    Abstract论文提出了针对黑盒 VLM 的前缀诱导自适应视觉提示注入，在多款模型上诱发了工具调用与隐私泄露。

    Paper analysisRead analysis
  9. AttacksarXiv 2608.10393

    DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

    提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作

    arXiv
    2608.10393
    Published
    Layer
    Prompt layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-7B, π0-FAST, openvla-7B
    AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。

    DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。

    Paper analysisRead analysis
  10. AttacksarXiv 2603.16960

    Adversarial attacks against modern vision-language models

    Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases

    arXiv
    2603.16960
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-7B, Qwen2.5-VL-7B
    AbstractThe authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.

    The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

    Paper analysisRead analysis
  11. DefensesarXiv 2603.14707

    Visual Confusion Agents: Exploiting and Defending Against Perception Failures in Computer-Use Agents

    Proposes out-of-process dual-channel comparison classification to intercept erroneous clicks by computer-use agents

    arXiv
    2603.14707
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    multi-modal-embed-small
    AbstractPerception errors can be exploited by swapping screen pixels.

    The authors frame CUA's perception failure as a security vulnerability, visual confused deputy: the agent authorizes click(x,y) based on a misread screen, and the actual landing point differs from the element it believes it is clicking.

    Paper analysisRead analysis
  12. DefensesarXiv 2602.10915

    Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System

    Proposes Aura, which uses a trusted kernel to mediate the identity, perception, and action control of mobile agents

    arXiv
    2602.10915
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Gemini-3-Flash
    AbstractAura mediates structured interactions via the Agent Kernel.

    Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants..

    Paper analysisRead analysis
  14. Evaluation and benchmarksarXiv 2510.01354

    WAInjectBench 系统评测网页 Agent 的提示注入检测方法

    提出 WAInjectBench 评测网页 Agent 的提示注入检测

    arXiv
    2510.01354
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, Mistral-7B-Instruct-v0.1, Llama-Prompt-Guard-2-86M and others8
    AbstractWAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。

    WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。

    Paper analysisRead analysis
  15. AttacksarXiv 2505.23266

    AdvOF：用对抗物体融合攻击 VLM 驱动的视觉语言导航智能体

    提出 AdvOF，生成对抗物体误导视觉语言导航智能体的场景感知

    arXiv
    2505.23266
    Published
    Layer
    Application layer
    Setting
    Embodied systems and robotics
    Attacker
    White-box
    Evaluated models
    Lseg, Clip, ViT-L/16 and others5
    AbstractAdvOF 以多视角融合生成对抗物体。

    AdvOF 是针对 VLM 驱动 VLN 服务导航的对抗物体攻击。

    Paper analysisRead analysis
  16. AttacksarXiv 2406.12814

    论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性

    提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性

    arXiv
    2406.12814
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, GPT-4V, Claude-3-Opus and others4

    Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。

    Paper analysisRead analysis
You have reached the end