Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 10 papers
Filter5

Attack type

Prompt injection5Poisoning and backdoors4

Attack technique

Gradient and representation optimization5Automated search5Encoding and obfuscation3Conversation structure manipulation4Reasoning-chain manipulation15Cross-modal payloads4Defense-targeted3Dormant triggers3Selection manipulation1

Impact

Output manipulation5

System type

Models and APIs4LLM applications3AI Agent3

Attacker access

Black-box3

Attack surface / entry point

User input4Documents and messages3Retrieval corpus3

Layer

Prompt layer3Application layer6

System component

MCP and skills10RAG6Guardrails and judges6Reasoning chains7Fine-tuning and open weights3Vision28Audio4Embeddings3Multimodal34
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 216papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Conversation structure manipulationAttack technique：Selection manipulationSystem component：Reasoning chainsSystem component：EmbeddingsClear all

Another 216papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  3. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  4. AttacksarXiv 2608.09867

    Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

    利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链

    arXiv
    2608.09867
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13

    Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。

    Paper analysisRead analysis
  5. AttacksarXiv 2607.00422

    KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链

    提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链

    arXiv
    2607.00422
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
    Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。

    KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。

    Paper analysisRead analysis
  6. AttacksarXiv 2606.12716

    PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

    提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令

    arXiv
    2606.12716
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
    AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。

    PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。

    Paper analysisRead analysis
  7. AttacksarXiv 2605.28074

    SilentRetrieval: Hijacking retrieval-augmented generation with semantically preserved adversarial data poisoning

    提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成

    arXiv
    2605.28074
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Llama-2-7B-Chat, Mistral-7B-Instruct-v0.2, Qwen-7B-Chat and others10
    Abstract两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。

    SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。

    Paper analysisRead analysis
  8. AttacksarXiv 2602.00364

    "Someone hid it": Query-agnostic black-box attacks against LLM retrieval

    提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名

    arXiv
    2602.00364
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
    AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。

    DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。

    Paper analysisRead analysis
  10. AttacksarXiv 2406.12814

    论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性

    提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性

    arXiv
    2406.12814
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, GPT-4V, Claude-3-Opus and others4

    Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。

    Paper analysisRead analysis
You have reached the end