Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

Attack surface / entry point：User input Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Documents and messages Layer：Application layer System component：Reasoning chains System component：Embeddings Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2609.35659Sep 29
Tracekit: A tamper-proof intent-reasoning-action audit system for autonomous coding agents
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
OtherarXiv 2609.12413Sep 11
SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量
系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御
arXiv
2609.12413
Published
Sep 11
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-4B, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- ComponentMemory
AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。
Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。
Paper analysisRead analysis
AttacksarXiv 2607.01276Jul 1
研究者提出嵌入推断攻击 EIA，可在黑盒 IR 系统中识别所用嵌入模型
提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
arXiv
2607.01276
Published
Jul 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
e5-small, e5-small-v2, e5-base and others19
- AttacksExtraction and theft
- ComponentEmbeddings
AbstractEIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。
EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。。
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis
AttacksarXiv 2603.12277Feb 23
Prompt injection is role confusion
提出 CoT Forgery，经用户消息或工具输出注入伪造推理
arXiv
2603.12277
Published
Feb 23
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
gpt-oss-20b, gpt-oss-120b, o4-mini and others11
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract提示注入被作者解释为角色感知失败：听起来像某角色，就在表示里成为该角色。
作者把提示注入解释成角色感知失败：标签划出的权限没有进入模型的内部几何。
Paper analysisRead analysis
AttacksarXiv 2602.18514Feb 20
招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究
用简历中的不可见指令做间接提示注入，操纵招聘推荐
arXiv
2602.18514
Published
Feb 20
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentReasoning chains
Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
Paper analysisRead analysis
AttacksarXiv 2602.00364Jan 31
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
arXiv
2602.00364
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Paper analysisRead analysis
AttacksarXiv 2512.01335Dec 1, 2025
EmoRAG 研究揭示 RAG 检索对表情符号扰动的脆弱性
提出 EmoRAG，向查询与知识库注入同一表情以劫持 RAG 检索
arXiv
2512.01335
Published
Dec 1, 2025
Layer
Application layer
Setting
LLM applications
Evaluated models
SPECTER, Contriever, Qwen2-7B and others11
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractEmoRAG 用表情联动查询与库文本。
EmoRAG 测量 RAG 对符号扰动的反应：同一表情同时出现在查询和库文本里时，检索会偏离语义匹配。作者要检查的是，检索是否真由语义相关性决定。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2510.14207Oct 16, 2025
论文提出多轮在线骚扰 Agent 基准
提出多轮在线骚扰 Agent 基准，评测记忆、规划与微调越狱
arXiv
2510.14207
Published
Oct 16, 2025
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
LLaMA-3.1-8B-Instruct, Qwen3-30B-A3B-Instruct, DeepSeekMoE-16B and others4
- AttacksJailbreaks
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2406.12814Jun 19, 2024
论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性
提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
arXiv
2406.12814
Published
Jun 19, 2024
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, GPT-4V, Claude-3-Opus and others4
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop