Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 15 papers

Filter3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Layer：Application layer System component：Reasoning chains System component：Fine-tuning and open weights Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
DefensesarXiv 2609.35659Sep 29
Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.34572Sep 28
论文提出 Nudgeability：推理模型会跟随置信信号却不追踪自身能力
测量固定推理轨迹中信心信号对工具委派的敏感性与对准性
arXiv
2609.34572
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-4B, Qwen3-8B, Qwen3-14B and others11
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
研究者用控制 token 注入删除 gpt-oss-20b 推理链并绕过思维链监控
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
OtherarXiv 2609.12413Sep 11
SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量
系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御
arXiv
2609.12413
Published
Sep 11
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-4B, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- ComponentMemory
AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。
Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。
Paper analysisRead analysis
DefensesarXiv 2608.27348Aug 28
INTENT-AS-A-TOOL：用意图工具追踪智能体失准
提出 INTENT-AS-A-TOOL，用意图工具概率跟踪并干预智能体失准
arXiv
2608.27348
Published
Aug 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma-4-31B-IT, Qwen3.5-27B, Qwen3-235B-A22B and others5
- DefensesMonitoring and auditing
- RiskMisalignment and value divergence
- ComponentMonitors
Abstract用意图工具的下一动作概率跟踪推理中的失准承诺，并在其成为首选时插入反思。
Zhang 等人研究推理型语言模型在职场邮件沙箱里如何走向智能体失准，并提出用动作偏好而不是事后文本标签来跟踪承诺。问题是：有害执行往往出现在推理已经形成意图之后，但 CoT 监控是事后、粗粒度、依赖外部评审的，也看不到模型倾向调用哪个动作。
Paper analysisRead analysis
AttacksarXiv 2608.06862Aug 7
SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
arXiv
2608.06862
Published
Aug 7
Layer
Application layer
Setting
Browser and computer use, coding agent
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.00711Aug 1
SCHEMA：面向科学 Agent 幻觉的拓扑感知评测框架
提出 SCHEMA，用概念图与轨迹分评测科学 Agent 幻觉
arXiv
2608.00711
Published
Aug 1
Layer
Application layer
Setting
science agent
Evaluated models
Kimi-K2.5, Qwen3.6-Plus, Llama-4-Scout and others10
- RiskHallucination and fabrication
- ComponentReasoning chains
AbstractSCHEMA 用知识拓扑评估科学智能体幻觉，终答正确仍可能来自有缺陷的中间推理。
SCHEMA 是面向科学智能体幻觉的证据锚定评测框架，实例化在生物医学的 Protein Domain 与 PathVQA-Enhanced。作者在摘要中称它是首个同时做到证据锚定和拓扑感知的此类框架。
Paper analysisRead analysis
AttacksarXiv 2607.00422Jul 1
KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
arXiv
2607.00422
Published
Jul 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentReasoning chains
Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。
KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
研究者披露针对 LLM Agent 护栏的推理扩展型拒绝服务攻击
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2604.12201Apr 14
AdversarialCoT：针对 LLM 推理的单文档检索投毒
提出 AdversarialCoT 单文档检索投毒以操纵 RAG 推理答案
arXiv
2604.12201
Published
Apr 14
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-R1, Qwen3, GLM4.5 and others5
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2602.18514Feb 20
招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究
用简历中的不可见指令做间接提示注入，操纵招聘推荐
arXiv
2602.18514
Published
Feb 20
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentReasoning chains
Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2510.14207Oct 16, 2025
论文提出多轮在线骚扰 Agent 基准
提出多轮在线骚扰 Agent 基准，评测记忆、规划与微调越狱
arXiv
2510.14207
Published
Oct 16, 2025
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
LLaMA-3.1-8B-Instruct, Qwen3-30B-A3B-Instruct, DeepSeekMoE-16B and others4
- AttacksJailbreaks
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2406.12814Jun 19, 2024
论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性
提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
arXiv
2406.12814
Published
Jun 19, 2024
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, GPT-4V, Claude-3-Opus and others4
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

System component

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

论文提出 Nudgeability：推理模型会跟随置信信号却不追踪自身能力

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

研究者用控制 token 注入删除 gpt-oss-20b 推理链并绕过思维链监控

SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量

INTENT-AS-A-TOOL：用意图工具追踪智能体失准

SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

SCHEMA：面向科学 Agent 幻觉的拓扑感知评测框架

KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链

研究者披露针对 LLM Agent 护栏的推理扩展型拒绝服务攻击

AdversarialCoT：针对 LLM 推理的单文档检索投毒

招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究

论文提出多轮在线骚扰 Agent 基准

论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性