Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers
Filter4

Attack type

Prompt injection7

Attack technique

Reasoning-chain manipulation3

Impact

Unauthorized actions3

System type

AI Agent6

Attack surface / entry point

User input94Web pages and interfaces12Documents and messages7Tool responses5Code repositories and dependencies3Retrieval corpus4Images, audio and video118Training data17Weights and gradients11Distribution channels6

Layer

Application layer8

System component

MCP and skills9Memory16RAG4Guardrails and judges11Monitors8Reasoning chains5Permissions and sandboxing15Vision4Multimodal4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Attack surface / entry point：Documents and messagesAttack surface / entry point：Code repositories and dependenciesSystem component：Reasoning chainsSystem component：MultimodalClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  2. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  4. Evaluation and benchmarksarXiv 2609.09404

    MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测

    用 MMPIBench 评测多模态提示注入对 Agent 框架的影响

    arXiv
    2609.09404
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro and others6

    Abstract论文提出 MMPIBench 评测多模态提示注入对智能体的影响，发现模型主导行为、尝试远超完成，音频通道缺乏防护。

    Paper analysisRead analysis
  5. AttacksarXiv 2608.09867

    Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

    利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链

    arXiv
    2608.09867
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13

    Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。

    Paper analysisRead analysis
  7. AttacksarXiv 2606.12716

    PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

    提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令

    arXiv
    2606.12716
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
    AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。

    PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。

    Paper analysisRead analysis
  8. AttacksarXiv 2602.18514

    招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究

    用简历中的不可见指令做间接提示注入，操纵招聘推荐

    arXiv
    2602.18514
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507

    Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2510.01354

    WAInjectBench 系统评测网页 Agent 的提示注入检测方法

    提出 WAInjectBench 评测网页 Agent 的提示注入检测

    arXiv
    2510.01354
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, Mistral-7B-Instruct-v0.1, Llama-Prompt-Guard-2-86M and others8
    AbstractWAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。

    WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。

    Paper analysisRead analysis
You have reached the end