Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers

Filter4

Attack type

Prompt injection6 Poisoning and backdoors6

Attack technique

Encoding and obfuscation3

Impact

Output manipulation7

System type

LLM applications5 AI Agent4

Attack surface / entry point

User input16 Web pages and interfaces4 Documents and messages3 Retrieval corpus26 Memory writes2

Layer

Application layer9

System component

MCP and skills17 Memory46 RAG9 Guardrails and judges17 Monitors10 Reasoning chains7 Permissions and sandboxing26 Vision13 Multimodal13

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Documents and messages Attack surface / entry point：Memory writes System component：RAG Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39146Sep 30
MADBench：多智能体辩论安全性评测基准发布
提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响
arXiv
2609.39146
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gpt-4o, GPT-5, GPT-6 Astra
- AttacksPrompt injection
- ComponentRAG
AbstractMADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。
MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。
Paper analysisRead analysis
AttacksarXiv 2609.12448Sep 11
GraphProfiler 用个人知识图谱推断敏感属性并溯源到具体帖子
提出 GraphProfiler，用个人知识图谱从帖子历史推断敏感属性并溯源
arXiv
2609.12448
Published
Sep 11
Layer
Application layer
Setting
LLM applications
- AttacksMalicious use
- ComponentRAG
AbstractGraphProfiler 用源链接个人知识图谱做属性推断，准确率接近文本基线，并把证据定位到少量源帖。
GraphProfiler 是一个可审计的 LLM 敏感属性画像器：用源链接个人知识图谱，把推断落到具体帖子。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.02316Sep 2
Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息
构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御
arXiv
2609.02316
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。
Paper analysisRead analysis
AttacksarXiv 2608.04565Aug 5
Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents
提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链
arXiv
2608.04565
Published
Aug 5
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-9B, Gemma4-31B, DeepResearch and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentRAG
Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。
Paper analysisRead analysis
AttacksarXiv 2603.17239Mar 18
LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems
提出 LAAF，分阶段自动攻击智能体系统的 LPCI 漏洞
arXiv
2603.17239
Published
Mar 18
Layer
Application layer
Setting
AI Agent
Evaluated models
gemini-2.0-flash-001, claude-3-haiku-20240307, meta-llama/llama-3.1-70b-instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractLAAF does LPCI red teaming with taxonomy plus stage seeding.
The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
Paper analysisRead analysis
AttacksarXiv 2602.00364Jan 31
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
arXiv
2602.00364
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.10923Jan 16
Hidden-in-Plain-Text：面向社交网络 RAG 间接提示注入的基准
用 OpenRAG-Soc 评测社交网页 RAG 的间接提示注入与检索投毒
arXiv
2601.10923
Published
Jan 16
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3-8B-Instruct, Mistral-7B-Instruct, Qwen2.5-14B and others8
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2507.10457Jul 15, 2025
论文提出 LPCI：针对 Agent 逻辑层与持久记忆的提示控制注入攻击
提出 LPCI，把延迟条件载荷写入记忆与检索库以跨会话触发
arXiv
2507.10457
Published
Jul 15, 2025
Layer
Application layer
Setting
AI Agent
Evaluated models
ChatGPT, Claude, LLaMA3 and others8
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者定义 LPCI。
作者把LPCI定义为针对智能体逻辑执行、记忆留存和工具集成的跨阶段漏洞类，而不是单次输入上的提示改写。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop