Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 90 papers
Filter3

Attack type

Jailbreaks59Prompt injection3Poisoning and backdoors3Extraction and theft11Denial of service3Malicious use5

Attack technique

Gradient and representation optimization5Automated search16Multi-turn escalation6Encoding and obfuscation19Role-play and persuasion3Conversation structure manipulation3Reasoning-chain manipulation9Cross-modal payloads28Defense-targeted3

Defense type

Model hardening8Inference-time intervention9Detection and filtering4

Impact

Harmful content62Data and privacy leaks10Output manipulation13Availability and reliability3

System type

Models and APIs84AI Agent5

Attacker access

Black-box43White-box6

Attack surface / entry point

User input90Web pages and interfaces12Documents and messages7Tool responses5Code repositories and dependencies3Retrieval corpus3Images, audio and video114Training data17Weights and gradients11Distribution channels6

Layer

Prompt layer59Model layer17Application layer5Training and data layer8

System component

MCP and skills15Memory17RAG16Guardrails and judges80Monitors22Reasoning chains26Permissions and sandboxing16Fine-tuning and open weights12Vision39Audio8Image generation22Multimodal68
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Attack surface / entry point：User inputSystem component：Reasoning chainsSystem component：MultimodalClear all

Another 265papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  2. InterpretabilityarXiv 2610.12361

    Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

    Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.

    arXiv
    2610.12361
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
    AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.

    This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

    Paper analysisRead analysis
  3. Evaluation and benchmarksarXiv 2610.11112

    EpiReal-Bench：商用图像生成模型虚假声明红队基准

    构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据

    arXiv
    2610.11112
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
    Abstract四款商用图像模型能把假主张画成可信证据。

    EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。

    Paper analysisRead analysis
  4. DefensesarXiv 2610.09703

    研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

    提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱

    arXiv
    2610.09703
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    LLaVA-1.5-7B
    Abstract剪枝去掉背景 token 后注意力塌向恶意前景。

    这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  7. DefensesarXiv 2610.05401

    AVCE：面向扩散模型可验证概念擦除的审计感知遗忘框架

    提出审计感知遗忘框架 AVCE，从文本与视觉通路擦除扩散模型概念

    arXiv
    2610.05401
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Stable Diffusion XL (SDXL), Stable Diffusion v1.5 (SD v1.5), Flux 1.0
    AbstractAVCE 在审计锚点上改两条注意力通路。

    AVCE 是面向扩散模型的概念擦除方法，要让擦除经得起绕过文本条件的潜空间审计，而不只是挡住对抗提示词。

    Paper analysisRead analysis
  9. DefensesarXiv 2610.03980

    FADE：面向视频扩散模型的帧感知多概念擦除框架

    提出 FADE，对文生视频模型做帧感知多概念擦除

    arXiv
    2610.03980
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-T2V-1.3B, Wan2.1-T2V-14B, CogVideoX-2B and others4
    AbstractFADE 用闭式编辑、帧感知适配器和软路由，在单骨干上擦除多概念并压低逐帧残差。

    FADE 是面向文生视频扩散 Transformer 的多概念遗忘方法，用来抑制指定物体、画风、裸体、暴力、仇恨和名人身份，并尽量保持其他生成。作者要处理两件事。与帧无关的抑制会让概念在少数帧重现，片段均值会掩盖这一失败。

    Paper analysisRead analysis
  11. DefensesarXiv 2609.39548

    NDDL：用正常扩散动力学为文生图模型做后门防御

    提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token

    arXiv
    2609.39548
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
    AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。

    NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。

    Paper analysisRead analysis
  14. AttacksarXiv 2609.38253

    CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.

    提出 CollageAttack，用空间文本碎片重组越狱文生图模型

    arXiv
    2609.38253
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5

    Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。

    Paper analysisRead analysis
  15. DefensesarXiv 2609.36562

    ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害

    构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险

    arXiv
    2609.36562
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    ThinkingGuard（Qwen3-VL-8B-Instruct）
    AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。

    这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。

    Paper analysisRead analysis
  16. AttacksarXiv 2609.35699

    论文：蒸馏防御在蒸馏后强化学习下易被攻破

    提出用 API 推理摘要重建轨迹再蒸馏加强化学习，攻破蒸馏防御

    arXiv
    2609.35699
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others12
    Abstract更现实的蒸馏攻击是蒸馏后再 RL。

    这篇工作修订蒸馏攻击的威胁模型：攻击者经合法 API 收集闭源推理数据，先蒸馏自有模型，再做强化学习。作者认为只在蒸馏后评估防御，会漏掉后续 RL，从而高估防御。

    Paper analysisRead analysis
  19. Evaluation and benchmarksarXiv 2609.33481

    IDUnlearn-Bench：面向视觉语言模型的个体级遗忘基准

    提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留

    arXiv
    2609.33481
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others6
    AbstractIDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。

    IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。

    Paper analysisRead analysis
Load more