Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 64 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack technique：Conversation structure manipulation Attack technique：Cross-modal payloads System component：Reasoning chains System component：Multimodal Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2610.06814Oct 6
TAPDreamer：可跨任务迁移的世界动作模型对抗补丁
TAPDreamer 用公开编码器做固定补丁。
arXiv
2610.06814
Published
Oct 6
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
FastWAM, DreamWAM-uncond, DreamWAM-joint and others4
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.06977Oct 4
IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法
提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
arXiv
2610.06977
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-VL-7B, Qwen2.5-VL-72B, InternVL3-14B and others17
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2609.38899Sep 30
SceneJail: Jailbreaking multimodal large models using video scene context
提出 SceneJail，利用视频情境上下文越狱视频多模态模型
arXiv
2609.38899
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-VL-7B-Instruct, Qwen2.5-VL-32B-Instruct, Qwen3-VL-8B-Instruct and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVideo
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
AttacksarXiv 2609.29775Sep 24
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
arXiv
2609.29775
Published
Sep 24
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.09404Sep 9
MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测
用 MMPIBench 评测多模态提示注入对 Agent 框架的影响
arXiv
2609.09404
Published
Sep 9
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
Abstract论文提出 MMPIBench 评测多模态提示注入对智能体的影响，发现模型主导行为、尝试远超完成，音频通道缺乏防护。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
AttacksarXiv 2609.04533Sep 4
Repeat-After-Me：针对黑盒 VLM 的自适应视觉提示注入攻击
提出 Repeat-After-Me 自适应视觉提示注入，诱导 VLM 智能体执行指定任务
arXiv
2609.04533
Published
Sep 4
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude-Opus-4.7, GPT-5.5, Gemini-3.1-Pro and others6
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentVision
Abstract论文提出了针对黑盒 VLM 的前缀诱导自适应视觉提示注入，在多款模型上诱发了工具调用与隐私泄露。
Paper analysisRead analysis
AttacksarXiv 2609.05525Sep 2
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
arXiv
2609.05525
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.27531Aug 27
MAMJ：面向视觉语言模型的元自适应多模态越狱攻击
提出 MAMJ，在元层面交替优化多模态越狱的策略提示与攻击者权重
arXiv
2608.27531
Published
Aug 27
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Gemini-3-Pro-Preview, Seed 2.0
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.15578Aug 16
ARENA：面向大型音频语言模型的自动化红队框架
提出 ARENA 音频红队框架，自动构造文本安全且音频接地的越狱输入
arXiv
2608.15578
Published
Aug 16
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Audio Flamingo 3, Qwen2-Audio-7B-Instruct, MiMo-Audio-7B-Instruct and others4
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2608.10393Aug 11
DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型
提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作
arXiv
2608.10393
Published
Aug 11
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
OpenVLA-7B, π0-FAST, openvla-7B
- TechniqueCross-modal payloads
- ComponentVision
AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。
DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。
Paper analysisRead analysis
AttacksarXiv 2608.09867Aug 11
Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
arXiv
2608.09867
Published
Aug 11
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13
- AttacksExtraction and theft
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
Paper analysisRead analysis
AttacksarXiv 2608.04034Aug 3
HACA：原子越狱策略解耦组合的多模态自动红队方法
提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
arXiv
2608.04034
Published
Aug 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-1.6-Mistral-7B, InternVL-3.5-8B, VLGuard (LLaVA-v1.5-7B-Mixed) and others5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2607.02961Jul 3
研究者提出信息过载方法越狱大型视觉语言模型
提出 INFER+ 信息过载方法，越狱大型视觉语言模型
arXiv
2607.02961
Published
Jul 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, Gray-box
Evaluated models
Qwen3-VL-8B, Qwen2-VL-7B, InternVL3.5-8B and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Abstract用图文过载越狱 LVLM。
这篇工作用信息过载越狱 LVLM，而不是靠 OOD 变换隐藏意图。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

WebMirage hijacks visual web agents' browser operations with adversarial images

STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击

TAPDreamer：可跨任务迁移的世界动作模型对抗补丁

IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法

研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像

SceneJail: Jailbreaking multimodal large models using video scene context

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

输出前缀攻击瞄准推理模型

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测

DIVA：利用视觉锚点对视频生成模型实施多模态越狱

Repeat-After-Me：针对黑盒 VLM 的自适应视觉提示注入攻击

DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱

MAMJ：面向视觉语言模型的元自适应多模态越狱攻击

ARENA：面向大型音频语言模型的自动化红队框架

DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

HACA：原子越狱策略解耦组合的多模态自动红队方法

研究者提出信息过载方法越狱大型视觉语言模型