Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 7 papers

Filter4

Attack type

Prompt injection3

Impact

Output manipulation3

System type

LLM applications3

Attack surface / entry point

User input28 Web pages and interfaces3 Documents and messages5 Tool responses3 Code repositories and dependencies3 Retrieval corpus9 Images, audio and video8 Training data4 Inference services and hardware2

Layer

Application layer5

System component

MCP and skills8 Memory14 RAG3 Guardrails and judges10 Monitors9 Reasoning chains4 Permissions and sandboxing10 Vision4 Embeddings3 Multimodal4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Documents and messages Attack surface / entry point：Inference services and hardware System component：Reasoning chains System component：Embeddings Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
AttacksarXiv 2609.06749Sep 7
PMA 攻击：针对隐私保护 LLM 中嵌入到嵌入混淆的语义流形对齐方法
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
arXiv
2609.06749
Published
Sep 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
BERT-base, RoBERTa-base, T5-base and others6
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis
AttacksarXiv 2605.30040May 28
研究揭示 LLM 按 token 计费可被服务商系统性虚报
构造可通过计费审计的 token 虚报，使服务商系统性超收
arXiv
2605.30040
Published
May 28
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
PALACE domain-adapted auditor
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMonitors
Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。
不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。
Paper analysisRead analysis
AttacksarXiv 2602.18514Feb 20
招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究
用简历中的不可见指令做间接提示注入，操纵招聘推荐
arXiv
2602.18514
Published
Feb 20
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentReasoning chains
Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
Paper analysisRead analysis
AttacksarXiv 2602.00364Jan 31
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
arXiv
2602.00364
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Impact

System type

Attack surface / entry point

Layer

System component

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

PMA 攻击：针对隐私保护 LLM 中嵌入到嵌入混淆的语义流形对齐方法

Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails

PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

研究揭示 LLM 按 token 计费可被服务商系统性虚报

招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究

"Someone hid it": Query-agnostic black-box attacks against LLM retrieval